Novell GroupWise Multiple Untrusted Pointer Dereferences Exploitation

Novell GroupWise 2012
Multiple Untrusted Pointer Dereferences Exploitation

April 3th, 2013
Brian MARIANI & Frédéric BOURLA
©2013 High-Tech Bridge SA – www.htbridge.com

TIMELINE

 On the 24th of November 2012, High-Tech Bridge Security Research Lab
discovered multiple vulnerabilities in Novell GroupWise 2012.

 On the 26th November 2012, High-Tech Bridge Security Research Lab informed
Novell about these vulnerabilities which existed in two core ActiveX modules.

 On the 30th January 2013, Novell published a security bulletin and released a
security patch.

 Finally, on the 3rd April 2013 High-Tech Bridge Security Research Lab disclosed
the vulnerability details.

 This paper is a technical explanation of the latter vulnerability and its
exploitation.


ABOUT NOVELL GROUPWISE

 According to Wikipedia:

 GroupWise is a messaging and collaborative software platform from Novell
Inc. that supports email, calendaring, personal information management,
instant messaging, and document management.

 The platform consists of the client software, which is available for Windows,
Mac OS X, Linux, and the server software part which is supported on
Windows Server, NetWare and Linux systems.

 The latest generation of the platform is GroupWise 2012 which only
supports Windows and Linux servers.


THE VULNERABILITIES

 The vulnerabilities exist in the gwmim1.ocx and gwabdlg.dll libraries.

 In order to trigger the flaw one should pass a non properly initialized value to
the vulnerable methods.

 By default any long integer value is assumed to be a proper initialized pointer.
This permit to provide a fake pointer to some of the methods and hijack the
control flow of the application by redirecting it to a malicious code.

 The vulnerability can be abused by preparing the heap area with predictable
memory addresses before the bug is triggered.


COMMON WEAKNESS ENUMERATION

 In accordance to MITRE:

 The Common Weakness Enumeration is a formal list of software
weakness types created to:

• Serve as a common language for describing software security weaknesses in
architecture, design or code.

• Serve as a standard measuring stick for software security tools targeting these
weaknesses.

• Provide a common baseline standard for weakness identification, mitigation and
prevention efforts.

 On the of 20th August 2012 High-Tech Bridge Security Research Lab obtained
CWE-Compatible Status by MITRE.

 This vulnerability was categorized by the weakness ID Untrusted Pointer
Dereference [CWE-822].


UNTRUSTED POINTER DEREFERENCE

 According to MITRE, an untrusted pointer dereference vulnerability is present
when:

 An attacker can inject a pointer for memory locations that the
program is not expecting.

 If the pointer is dereferenced for a write operation, the attack might
allow modification of critical program state variables, cause a crash or
execute code.

 If the dereferencing operation is for a read, then the attack might allow
reading of sensitive data, cause a crash or set a program variable to an
unexpected value since it will be read from an unexpected memory
location.


MORE DETAILS ABOUT THE ISSUE

 Novell GroupWise crashes at three different methods within two modules.

 The involved modules are gwabdlg.dll and gwmim1.ocx.

 The faulty methods names are InvokeContact, GenerateSummaryPage and
SecManageRecipientCertificates.

 We will only analyse the issues in the SecManageRecipientCertificates and
InvokeContact methods.

 This is because the InvokeContact and GenerateSummary methods crash at
the same area. Moreover, the exploitation technique used to leverage the
vulnerability is the same.

 The configuration lab we used is an English Windows XP SP3 operating
system (DEP disabled) with Internet Explorer 8.


PROOF OF CONCEPT CRASH (1)

 Here is a working proof of concept in order to crash Internet Explorer by passing
a custom pointer to the InvokeContact method.


PROOF OF CONCEPT CRASH (2)

 The following proof of concept crashes Internet Explorer by passing a fake
pointer to the SecManageRecipientCertificates method.


SecManageRecipientCertificates case (1)

 Let’s first analyze the SecManageRecipientCertificates case as this is the
simpler one.

 In the following screenshot we can observe the crash from WinDBG after
executing the proof of concept on one of the previous slides:

 We can clearly spot that the crash took place at the address 0x10014805 when
the code attempts to move the value of the uninitialized pointer into the EDX
register.

 This one was provided as a long data type (202116108), therefore (0xc0c0c0c)
in hexadecimal format.


SecManageRecipientCertificates case (2)

 So far we have a function that crashes when reading a memory address of our
choice.

 All that we need in order to turn the odds in our favor and maximize the
chances of exploitation is that the code instructions that follow permit us in
someway to take control of code execution.

 In this particular instance, after dissasembling the faulty function, we can
observe at the memory address 0x10014807 that the value hold by our pointer
is moved into the EAX register.

 Eventually, a CALL EAX instruction at the address 0x10014809 will terminate
the game.


HEAP SPRAYING

 In order to exploit this particular vulnerability we need to spray the heap area on
Internet Explorer in a reliable and precise way.

 Before the bug is triggered the heap must be already prepared in order to
contain the or al,0x0C sled which leads to arbitrary code execution.

 The or al,0x0C instruction does not affects any critical data which could stop
code execution.

 The goal is to "slide" the flow of code to its final destination.

 Since the shellcode is sitting in multiple chunks in the heap right after the or
al,0x0C sled the probability of arbitrary code execution is very high.

 Please check the Microsoft XML issue video for more information on this
exploitation technique.


WINDBG AFTER THE HEAP SPRAYING EXPLOIT (1)

 Here is a screenshot of the most important part of the exploit:


WINDBG AFTER THE HEAP SPRAYING EXPLOIT (2)

 The following screenshot shows the state of registers under Windbg after the
exploit is executed:

 We can clearly observe that instruction pointer register was successfully
hijacked.


THE INVOKECONTACT METHOD CASE (1)

 As we said on slide 10, finding the way to exploit the
SecManageRecipientCertificates method was les complex than the
InvokeContact one.

 When we run the InvokeContact proof of concept, one would be tempted to
conclude that this is just a local denial of service.

 However, since the attacker can control the EAX register he could influence
the code logic and to enter what seems to be a switch structure.

 This means that it would be possible to coerce the code to enter into one of the
six available cases, so as to potentially increase our chances of successful
exploitation.



 Here is the switch structure containing the six different cases:

 In order to go beyond this crash, we need to provide a memory address as a pointer,
and from this address plus 4 bytes we supply a dword value who will be the case
number in which we would like to enter.

 In order to accomplish this task one would need to rely over a previously known
address in memory.

 If we use a precise heap spraying technique, we can count on the 0xc0c0c0c
address.



 After studying the exploitation opportunities that are available to us, we found
that at least one of the six cases permits arbitrary code execution.

 The following screenshot shows the code instructions when the third case is
executed:

 Let’s summarize the entire process starting from the injected pointer until code
execution is reached.



 We place a breakpoint at the Oleaut32!DispCallFunc function and a second
one at the first CALL ECX instruction situated some bytes farther. The second
breakpoint is the instruction who calls the method in which we are interested.

 After the second break, the code points to the memory address 0x572146b7.



 The code pushes into the stack the improper pointer. At this moment we can
observe the reference to the XisDOMAttributeList function.

 After the CALL instruction at the address 0x5722D83E, the code continues and
pushes again the uninitialized value at the address 0x5722d861 who enters in
one more nested function.



 When the code comes into this function the uninitialized pointer is compared to
0. As the pointer’s value is equal to c0c0c0c the conditional jump at address
0x5722D2E8 is not taken.

 Later, the untrusted pointer is moved into the EAX register at the address
0x5722D2FE.

 At 0x5722D301 address we reach the instruction where the code reads the
value of the EAX register plus four bytes. This corresponds to the case in
which it will enter.



 In order to push the code to enter into the case three, we sprayed the heap
so as to allocate perfect sized and consecutive chunks.

 If we take care of the chunks size and the blocks size, we can be pretty sure
that the begin of each spray block will be positioned at a predictable address.

 Here is the sprayed data starting at the address 0xc0c0c0c:

 Consult the document Heap Spraying Demystified under the section Precision
Heap Spraying from Corelan for more information.



 Because the heap spray was very precise, the code reads and stores our
desired value into the stack at the address 0x5722D304.

 This permits us to go beyond the previous crash and enter into the function at
the address 0x5722d4b4.



 The untrusted pointer is stored in the stack and will be reused later in order
to call another private method from the vftable.



 Later the code dereferences twice the EAX register at the addresses
0x5722D4CA and 0x5722D4D3.

 So as to successfully slide the code up to the shellcode, the exploit needs to
spray accurately the heap with three pointers:

 The shellcode sits right after the 0xc0c0c48 pointer.



 This is therefore the final payload for the exploit:



 Code execution is reached:


References & Links

 http://www.youtube.com/watch?v=hNDjRLoN8ug (Exploitation Video)

 https://www.htbridge.com/publication/Novell-GroupWise-exploit.rar (password:
htbridge)

 https://www.corelan.be/index.php/2011/12/31/exploit-writing-tutorial-part-11-
heap-spraying demystified/#Heap_Spraying_on_Internet_Explorer_9

 http://cwe.mitre.org/data/definitions/822.html

 https://www.htbridge.com/vulnerability/

 http://en.wikipedia.org/wiki/Novell_GroupWise


Thank you for reading

Your questions are always welcome:

brian.mariani [at] htbridge.com
frederic.bourla [at] htbridge.com


Novell GroupWise Multiple Untrusted Pointer Dereferences Exploitation

More Related Content

Viewers also liked (20)

Similar to Novell GroupWise Multiple Untrusted Pointer Dereferences Exploitation (20)

More from High-Tech Bridge SA (HTBridge) (12)

Recently uploaded (20)

Novell GroupWise Multiple Untrusted Pointer Dereferences Exploitation