Exploit-DB #19139
Description: Adobe Illustrator CS5.5 - Memory Corruption
Type: local
Platform: multiple
Date: 2012-06-14
Author: Felipe Andres Manzano

Exploit:
##########################################################################
####   Felipe Andres Manzano * felipe.andres.manzano@gmail.com        ####
##########################################################################
'''
The vulnerable function follows...
----------------------------------
.text:004A7200 ; =============== S U B R O U T I N E =======================================
.text:004A7200
.text:004A7200 ; Attributes: bp-based frame
.text:004A7200
.text:004A7200 sub_4A7200      proc near               
.text:004A7200
.text:004A7200 var_11C         = dword ptr -11Ch
.text:004A7200 var_118         = dword ptr -118h
.text:004A7200 var_114         = byte ptr -114h
.text:004A7200 var_14          = dword ptr -14h
.text:004A7200 var_10          = dword ptr -10h
.text:004A7200 var_C           = dword ptr -0Ch
.text:004A7200 var_4           = dword ptr -4
.text:004A7200 arg_0           = dword ptr  8
.text:004A7200
.text:004A7200                 push    ebp
.text:004A7201                 mov     ebp, esp
.text:004A7203                 push    0FFFFFFFFh
.text:004A7205                 push    offset loc_C3B8C0
.text:004A720A                 mov     eax, large fs:0
.text:004A7210                 push    eax
.text:004A7211                 sub     esp, 110h            ;Make room for a 256 bytes buffer, etc 
.text:004A7217                 mov     eax, dword_FB3380    
.text:004A721C                 xor     eax, ebp
.text:004A721E                 mov     [ebp+var_14], eax    ;Cookie! Immediately after the buffer
.text:004A7221                 push    ebx
.text:004A7222                 push    esi
.text:004A7223                 push    edi
.text:004A7224                 push    eax
.text:004A7225                 lea     eax, [ebp+var_C]
.text:004A7228                 mov     large fs:0, eax
.text:004A722E                 mov     [ebp+var_10], esp
.text:004A7231                 mov     ebx, [ebp+arg_0]
.text:004A7234                 mov     edi, ecx
.text:004A7236                 mov     ecx, ebx
.text:004A7238                 mov     [ebp+var_118], ebx
.text:004A723E                 call    std::basic_string::length(...) ;Original size offending size
                                                                      ;(It doesn;t stop at null chars)
.text:004A7244                 mov     esi, eax
.text:004A7246                 push    esi
.text:004A7247                 mov     ecx, ebx
.text:004A7249                 call    std::basic_string::c_str(...)
.text:004A724F                 push    eax
.text:004A7250                 lea     eax, [ebp+var_114]
.text:004A7256                 push    eax
.text:004A7257                 call    memcpy                     ;STACK OVERFLOW! (If more than 256 bytes)
.text:004A725C                 lea     eax, [ebp+esi+var_114]
.text:004A7263                 add     esp, 0Ch
.text:004A7266                 mov     [ebp+var_11C], eax
.text:004A726C                 mov     byte ptr [eax], 0
.text:004A726F                 mov     [ebp+var_4], 0
.text:004A7276                 lea     esi, [ebp+var_114]
.text:004A727C                 lea     esp, [esp+0]
.text:004A7280
.text:004A7280 loc_4A7280:                             
.text:004A7280                 cmp     esi, eax
.text:004A7282                 jnb     short loc_4A72B6
.text:004A7284                 mov     edx, [edi]
.text:004A7286                 mov     eax, [edx+4]
.text:004A7289                 push    esi
.text:004A728A                 mov     ecx, edi
.text:004A728C                 call    eax                       ;Iterates over the stack copied buffer
                                                                 ;applying a 'locale'? character translation
                                                                 ;(Invalid chars noted in exploit)
.text:004A728E                 test    eax, eax
.text:004A7290                 jg      short loc_4A7297
.text:004A7292                 mov     eax, 1
.text:004A7297
.text:004A7297 loc_4A7297:                             
.text:004A7297                 add     esi, eax
.text:004A7299                 mov     eax, [ebp+var_11C]
.text:004A729F                 jmp     short loc_4A7280
.text:004A72AE ; ---------------------------------------------------------------------------
.text:004A72AE
.text:004A72AE loc_4A72AE:                             
.text:004A72AE                 mov     ebx, [ebp+var_118]
.text:004A72B4                 jmp     short loc_4A72BD
.text:004A72B6 ; ---------------------------------------------------------------------------
.text:004A72B6
.text:004A72B6 loc_4A72B6:                             
.text:004A72B6                 mov     [ebp+var_4], 0FFFFFFFFh
.text:004A72BD
.text:004A72BD loc_4A72BD:                             
.text:004A72BD                 lea     ecx, [ebp+var_114]
.text:004A72C3                 push    ecx
.text:004A72C4                 mov     ecx, ebx
.text:004A72C6                 call    std::basic_string::operator=(...)   ;Here, due to local values 
                                                                           ;corruption it is possible to
                                                                           ;write a translated version of
                                                                           ;our buffer to anywhere 
.text:004A72CC                 mov     ecx, [ebp+var_C]
.text:004A72CF                 mov     large fs:0, ecx
.text:004A72D6                 pop     ecx
.text:004A72D7                 pop     edi
.text:004A72D8                 pop     esi
.text:004A72D9                 pop     ebx
.text:004A72DA                 mov     ecx, [ebp+var_14]
.text:004A72DD                 xor     ecx, ebp
.text:004A72DF                 call    sub_C27512                           ;Check the cookie
.text:004A72E4                 mov     esp, ebp
.text:004A72E6