Slimpdf Reader from investintech,
http://www.investintech.com/resources/freetools/slimpdfreader/ is prone to
several overflows that can lead to code execution. The crash below is
triggered by simply adding 50.000 random characters in the header of a pdf
file. Initial bug and directions to exploitation were given from Jason
Kratzer.
PoC at http://www.deventum.com/research/crash_slimpdf.pdf
CommandLine: "C:\Program Files\Investintech.com Inc\SlimPDF Reader\SlimPDF
Reader.exe"
Executable search path is:
ModLoad: 00400000 00776000 SlimPDF Reader.exe
ModLoad: 779c0000 77afd000 ntdll.dll
ModLoad: 76990000 76a64000 C:\Windows\system32\kernel32.dll
ModLoad: 75e10000 75e5a000 C:\Windows\system32\KERNELBASE.dll
ModLoad: 77920000 779c0000 C:\Windows\system32\ADVAPI32.dll
ModLoad: 77870000 7791c000 C:\Windows\system32\msvcrt.dll
ModLoad: 75e70000 75e89000 C:\Windows\SYSTEM32\sechost.dll
ModLoad: 77760000 77801000 C:\Windows\system32\RPCRT4.dll
ModLoad: 76470000 76539000 C:\Windows\system32\USER32.dll
ModLoad: 767e0000 7682e000 C:\Windows\system32\GDI32.dll
ModLoad: 762c0000 762ca000 C:\Windows\system32\LPK.dll
ModLoad: 75f70000 7600d000 C:\Windows\system32\USP10.dll
ModLoad: 75ef0000 75f6b000 C:\Windows\system32\COMDLG32.dll
ModLoad: 75e90000 75ee7000 C:\Windows\system32\SHLWAPI.dll
ModLoad: 74a40000 74bde000
C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16661_none_420fe3fa2b8113bd\COMCTL32.dll
ModLoad: 76a80000 776c9000 C:\Windows\system32\SHELL32.dll
ModLoad: 6cbf0000 6cc41000 C:\Windows\system32\WINSPOOL.DRV
ModLoad: 6ab80000 6ab9c000 C:\Windows\system32\oledlg.dll
ModLoad: 76830000 7698c000 C:\Windows\system32\ole32.dll
ModLoad: 776d0000 7775f000 C:\Windows\system32\OLEAUT32.dll
ModLoad: 76540000 76575000 C:\Windows\system32\WS2_32.dll
ModLoad: 76a70000 76a76000 C:\Windows\system32\NSI.dll
ModLoad: 74730000 748c0000
C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7600.16385_none_72fc7cbf861225ca\gdiplus.dll
ModLoad: 76580000 7669a000 C:\Windows\system32\WININET.dll
ModLoad: 75e60000 75e63000 C:\Windows\system32\Normaliz.dll
ModLoad: 76100000 762b6000 C:\Windows\system32\iertutil.dll
ModLoad: 766a0000 767b0000 C:\Windows\system32\urlmon.dll
(9d8.c1c): Break instruction exception - code 80000003 (first chance)
eax=00000000 ebx=00000000 ecx=0012fb0c edx=77a06344 esi=fffffffe
edi=00000000
eip=77a5ebbe esp=0012fb28 ebp=0012fb54 iopl=0 nv up ei pl zr na pe
nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000
efl=00000246
ntdll!LdrVerifyImageMatchesChecksum+0x633:
77a5ebbe cc int 3
0:000> g
ModLoad: 76010000 7602f000 C:\Windows\system32\IMM32.DLL
ModLoad: 76030000 760fc000 C:\Windows\system32\MSCTF.dll
ModLoad: 748c0000 74900000 C:\Windows\system32\uxtheme.dll
ModLoad: 73650000 7365f000 C:\Windows\system32\inetmib1.dll
ModLoad: 73b90000 73bac000 C:\Windows\system32\IPHLPAPI.DLL
ModLoad: 730d0000 730d7000 C:\Windows\system32\WINNSI.DLL
ModLoad: 6c8d0000 6c8d9000 C:\Windows\system32\snmpapi.dll
ModLoad: 75ab0000 75abc000 C:\Windows\system32\CRYPTBASE.dll
ModLoad: 74480000 74493000 C:\Windows\system32\dwmapi.dll
ModLoad: 77810000 77815000 C:\Windows\system32\psapi.dll
ModLoad: 77b00000 77b83000 C:\Windows\system32\CLBCatQ.DLL
ModLoad: 6afe0000 6b038000 C:\Program Files\Common Files\microsoft
shared\ink\tiptsf.dll
ModLoad: 74270000 7436b000 C:\Windows\system32\WindowsCodecs.dll
ModLoad: 75a60000 75aab000 C:\Windows\system32\apphelp.dll
ModLoad: 6bdc0000 6bdf1000 C:\Windows\system32\EhStorShell.dll
ModLoad: 762d0000 7646d000 C:\Windows\system32\SETUPAPI.dll
ModLoad: 75d20000 75d47000 C:\Windows\system32\CFGMGR32.dll
ModLoad: 75d00000 75d12000 C:\Windows\system32\DEVOBJ.dll
ModLoad: 74900000 749f5000 C:\Windows\system32\PROPSYS.dll
ModLoad: 6bd50000 6bdba000 C:\Windows\System32\cscui.dll
ModLoad: 6bd40000 6bd49000 C:\Windows\System32\CSCDLL.dll
ModLoad: 714e0000 714eb000 C:\Windows\system32\CSCAPI.dll
ModLoad: 6bcd0000 6bd3f000 C:\Windows\system32\ntshrui.dll
ModLoad: 757f0000 75809000 C:\Windows\system32\srvcli.dll
ModLoad: 73cf0000 73cfa000 C:\Windows\system32\slc.dll
ModLoad: 74ea0000 74ec1000 C:\Windows\system32\ntmarta.dll
ModLoad: 77820000 77865000 C:\Windows\system32\WLDAP32.dll
ModLoad: 75b60000 75b6b000 C:\Windows\system32\profapi.dll
ModLoad: 755e0000 755f6000 C:\Windows\system32\CRYPTSP.dll
ModLoad: 75380000 753bb000 C:\Windows\system32\rsaenh.dll
ModLoad: 75b20000 75b2e000 C:\Windows\system32\RpcRtRemote.dll
ModLoad: 66030000 6608c000 C:\Windows\System32\StructuredQuery.dll
ModLoad: 75900000 75908000 C:\Windows\System32\Secur32.dll
ModLoad: 75a40000 75a5a000 C:\Windows\system32\SSPICLI.DLL
ModLoad: 6b450000 6b49e000 C:\Windows\system32\actxprxy.dll
ModLoad: 665e0000 66612000 C:\Program Files\Internet Explorer\ieproxy.dll
ModLoad: 67620000 67636000 C:\Windows\system32\thumbcache.dll
ModLoad: 6b3f0000 6b41e000 C:\Windows\system32\SHDOCVW.dll
ModLoad: 69f80000 6a8c5000 C:\Windows\system32\ieframe.DLL
ModLoad: 72bb0000 72bec000 C:\Windows\system32\OLEACC.dll
ModLoad: 73440000 734df000 C:\Windows\system32\SearchFolder.dll
ModLoad: 6a9e0000 6ab78000 C:\Windows\system32\NetworkExplorer.dll
ModLoad: 6b4d0000 6b4d9000 C:\Windows\system32\LINKINFO.dll
ModLoad: 74120000 7412f000 C:\Windows\system32\samcli.dll
ModLoad: 74a00000 74a12000 C:\Windows\system32\SAMLIB.dll
ModLoad: 74140000 74149000 C:\Windows\system32\netutils.dll
(9d8.c1c): Access violation - code c0000005 (first chance)
First chance exceptions are reported before any exception handling.
This exception may be expected and handled.
eax=01d32eb0 ebx=01d1fdc8 ecx=01d2fd68 edx=00000150 esi=01d32e08
edi=01d2fde8
eip=004419c4 esp=0012ebcc ebp=0012ebe8 iopl=0 nv up ei pl zr na pe
nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000
efl=00010246
*** WARNING: Unable to verify checksum for SlimPDF Reader.exe
*** ERROR: Module load completed but symbols could not be loaded for SlimPDF
Reader.exe
SlimPDF_Reader+0x419c4:
004419c4 880c02 mov byte ptr [edx+eax],cl
ds:0023:01d33000=??
0:000> !exploitable
Exploitability Classification: EXPLOITABLE
Recommended Bug Title: Exploitable - User Mode Write AV starting at
SlimPDF_Reader+0x00000000000419c4 (Hash=0x566e1f14.0x18331e13)
User mode write access violations that are not near NULL are exploitable.
POC: https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/17274.poc.tar.gz
