regsvr32.exe commandline overflow

1.What is it ?

The windows regsvr32.exe, used for registering ActiveX,COM etc
components has a commandline stack overflow.On passing a large string
on the commandline the program causes an access viation.For ex. on
issuing the command

c:\>regsvr32.exe (About 1200 A's).dll

A messagebox pops up saying LoadLibrary("AAAAAAAAAAAAAA......AAA") failed
after which an access violation occcurs on a Windows 2000 Pro SP0.

2.Systems Affected

The problem is confirmed on the follwing systems:
1.Windows 2000 Professional SP0
2.Windows XP Professional SP0
3.Windows XP Professional SP1

3. The problem

The problem is in a routine in regsvr32.exe which displays the
MessageBox saying "LoadLibrary failed for (THE INPUT FILE NAME) File
name or extension is too long".The buffer with the file name overwrites
the stack completely.

4. Expoitable ?

The problem is completely exploitable in Windows 2000 Professional but is
difficult on Windows XP due to unicode storage of the string,the instruction
pointer is compelety overwritten.The only problem would be the annoying
message box which first pops up before an access violation occurs.

This would only be a remote exploit insofar as command line access would be a pre-requisite on the target machine for this to even be possible.... right? Or is there a devious way of issuing a regsvr32 command that I am having a brain dump on? ;)

Somehow this looks vaguely familiar but I cannot seem to find the old post.

Have the same question though (never got answered):

What will I gain if I overflow regsvr32?

If you could manage to get netcat installed on a tgt machine, connect to it that way, FTP a peice of code succeptable to a buffer overflow, get a cmd prompt up via nc, run the regsvr32 exploit , that overflows and your code is ran instead! Voilla!

Its not quite a simple as that i know, but in a nut shell that is what you could gain from it!

Why? If you can ftp a piece of susceptible code you might aswell ftp your malware.

There's no privilege elevation involved here.
Buffer overflows are "A Bad Thing(tm)" but there's no security risk from this overflow.

There's a security risk from ANY overflow.

If you can cause something to execute a peice of code, surley thats a security risk?

Quote:

---

There's no privilege elevation involved here.

---

What says the code you ftp'd cant make an account with admin privilages??

If you have the code you can use any buffer overflow to execute it, providing you know where it is in memory- thats the security risk.

Quote:

---

Originally posted here by Nokia
If you can cause something to execute a peice of code, surley thats a security risk?

---

Not really. It depends alot on other things.

1st: As said there's no privilege elevation involved here. Everything that gets executed would have the same privileges as the user executing it. So why not execute your code directly?

2nd: If you've restricted what kind of executables a user can run you may have something to execute code of your choice. BUT no (regular) user should have a need for regsvr32 so why permit it?

Quote:

---

What says the code you ftp'd cant make an account with admin privilages??

---

Because the (regular) user running the exploit doesn't gain any extra privileges (i.e. isn't allowed to create accounts) this would be impossible. Unless the code contains something to elevate the privileges but then again you could run that directly so why overflow?

Quote:

---

Not really. It depends alot on other things.

1st: As said there's no privilege elevation involved here. Everything that gets executed would have the same privileges as the user executing it. So why not execute your code directly?

---

No, it depends on the privilage of the application running that overflowed to execute the code. The code executed will have the same privilage. Thats the whole idea of a buffer overflow.

If you executed your code directly, then you would have the same privilage as the user logged on


regsvr32 = a Command line application that is used to register dynamic-link libraries and ActiveX controls in the registry.


When this System Process executes if you make it execute a peice of code you have stored on the tgt machine instead, at that specific moment in time windows will think it is executing a system task- therefore you wouldnt need to elevate your privilages as what ever code you have executed will have the same rights a regsvr32.

But hey look, it changes the registry, so any security measures in place will notice something changing the registry but will then see its a system process called regsvr32, even if it throws a warning up to who ever is at the console(which it more than likley wont) they will see the name of it and if they dont know it, they would more than likley google it, find it is a system process and proberbly allow it!

And whaddya ya know, you could have installed anything, changed anything in the registry even though the machine in question has got firewalls, ids's etc etc.

Maybe reading this could explain it better?

regsvr32 runs in the context of the account that initiated the command.. It does not run as localsystem, which is what you are implying by saying it is a system process.. It's not a system process... lsass.exe, svchost.exe, winlogin.exe those are system processes... One of the main reasons you need administrative access to install many different types of applications is because a regular user invoking regsvr32 does not have the proper permissions to make changes to all registry keys.. so regsvr32 would fail, which is why the install bombs when it checks permissions.

In order to use a buffer overflow to do something that you otherwise would not have permissions to do, you must overflow a process that is running at a higher level of permissions... regsvr32 isn't a process that runs at an administrative level if invoked by a normal user, so no, there is no privilege elevation possible here... regsvr32 itself doesn't have any permissions, it's just an application.. Even though it is a system application, it doesn't run as the localsystem account..

Quote:

---

But hey look, it changes the registry, so any security measures in place will notice something changing the registry but will then see its a system process called regsvr32, even if it throws a warning up to who ever is at the console(which it more than likley wont) they will see the name of it and if they dont know it, they would more than likley google it, find it is a system process and proberbly allow it!

---

It's not a system process.. It is a system application.. And regsvr32 would only be running if something is being installed. If the people watching your security monitoring know that nothing should be installed because there are no change controls at that time, red flags should be set off.. However, if they were to investigate the security context under which regsvr32 was running, they would find which user account is running that process, because, as I said regsvr32 does not run under the context of localsystem(which is equivalent to administrative access...)

Quote:

---

What says the code you ftp'd cant make an account with admin privilages??

If you have the code you can use any buffer overflow to execute it, providing you know where it is in memory- thats the security risk.

---

If you can just run any piece of code and get administrative access why do you even need a buffer overflow? You are already logged into the system, and you can run any command, so just run it.. In order to create an administrative account with a buffer overflow you need to overflow a process that is running with administrative or localsystem privileges. Buffer overflows are only a security risk if they can be overflowed remotely, or if you are overflowing an administrative process. If you have to login to the system to be able to overflow the application, and the application is running as the account that you logged in as, what good did that overflow do?

No, i do not no that much about what am talking about here but:

Quote:

---

There's a security risk from ANY overflow.

---

The above has got to be true from a logical stand point. Perhaps a system crash could be caused to unexpected results.

Even if you can not execute some shell code.

I can see what your trying to say Mohaughn and everything youve said would be correct if regsrv32 was not a system process but it is.

http://www.liutilities.com/products/...rary/regsvr32/

I dont really understand what you are saying here:

Quote:

---

One of the main reasons you need administrative access to install many different types of applications is because a regular user invoking regsvr32 does not have the proper permissions to make changes to all registry keys.. so regsvr32 would fail, which is why the install bombs when it checks permissions.

---

I may just be miss reading this but the way I understand what you have said is someone invoking regsvr32 would need to have administrator rights?

So there you go, if regsvr32 overflows and executes something you have stored in memory, you will be piggybacking a program with administrator rights. Voilla!

And as it is a system process some security programs will allow it, as you said regsvr32 is invoked when you install something (admin rights there), how many firewalls, AV's etc go off when you install something?

Quote:

---

So there you go, if regsvr32 overflows and executes something you have stored in memory, you will be piggybacking a program with administrator rights. Voilla!

---

No he is saying regsrv32 only runs with the privalages of the user. IE if the user is restricted regsvr will run as restricted. Not as admin.

O right , i see what he ment now.

However it is a system process so the rights level of the user is irrelevant. The main reason some programs wont install if you dont have rights, has nothing to do with regsvr32, it is to do with creating/reading/writting/modifying files and folders in places you dont have access to.

Hence if you had a restricted/limited account you would'nt be allowed to even start installing something, that is long before regsvr will be invoked.

Quote:

---

Hence if you had a restricted/limited account you would'nt be allowed to even start installing something, that is long before regsvr will be invoked.

---

So SirDice is correct there is no privalige escalation here then??

It was always my understanding, correct me if I'm worng.. that a system process is a process that the system needs to run, and it is started at system startup and is not tied to a user login.. meaning it runs as localsystem.. This is not the case for regsvr32.. You can delete regsvr32 from the harddrive and the system will still run.. I'm not sure why that webpage you listed says it is a system process, but I really don't think it is. It is in the system32 directory, but once you have the system installed and running, you can safely remove regsvr32 to prevent additional applications from being installed.

Here is another way to look at it.. If you have the resource kit, and you run tlist -t you will see the process list tree..

The tree is broken down by who the parent process is, this is also the security context under which the process is running..

if you run regsvr32 from a cmd prompt, cmd shows up as the parent.. if you run it from explorer, explorer shows up as the parent.. CMD and Explorer both run under the security context of the user that invokes the process. The regsvr32 process does not get pushed up to the top under system where you find winlogin, services, svchost and lsass...

Here is another thing to keep in mind.. When I was talking about installing software I was talking about installing on a locked down system. In this type of system a regular user does not have access to the registry to make changes. If regsvr32 ran in the localsystem(administrator) context then regsvr32 would still work as it would be using administrative permissions to change the registry and not normal user permissions. Also, one of the most common errors with regsvr32 is that the .dll file doesn't exist, or the user doesn't have access to the file. If you regsvr32 was running with administrator privileges file permissions would not be an issue, unless deny all was the effective permission, which is hardly ever the case.

This article gives the specifics of what regsvr32 is doing. It is just an application. They even give you source code so that you can register dlls without using regsvr32.

http://support.microsoft.com/default...b;en-us;207132


edit- That website also says cmd is a system process. So their definition of a system process does not mean that it runs as the system account. because we all know that cmd runs under the context of the user that initiated the command- http://www.liutilities.com/products/...sslibrary/cmd/

I thought that aswell at first that it was just an app especially with it being a .exe but then I went to the web page I linked to and it said it was a system process and when I checked, it is in the system32 folder, that convinced me it was a system process

Which is what makes me think it is exploitable to escelate privilages.

I dont have the resource kit at home but could you tell me if it shows up as parent if you just run it from the run prompt, if not what is? Thanks.

My way of thinking is that if regsvr is invoked it will have to either temporarily run with admin rights or be invoked by someone with admin rights, either way it can be exploited (providing that it is indeed a system process) to elevate any account that is made by the BO.

But then I suppose the argument is, if someone already has admin rights and you have remotely logged in then you have all the privilages you need.

However if a normal user can invoke it and the process (not the user) does temporarily gain admin rights (or the system process quivalent) then thats the security risk.

Im going to have a scour around and see if I can get a definate answer somewhere about if its a system process or not as you are starting to make me think its not!

Thanks

Well I couldnt find anyhting about if it was a system proccess or not but I did find this:

http://www.securityfocus.com/archive/82/316073

Notice the date - thanks for this hot of the press peice of news warl0ck7!

So anyway, i'll shut up, dish out your AP's and go and finish my bottle of morgan spiced now!

I enjoyed discussing it with you though mohaughn, makes a nice change not seeing a thread like this ending up in a flame war of some kind!

**Nokia bows and retreats very humbily**

regsvr32.exe does not run as system and I would conssider very low risk unless it can be invoked remotely or is called by something like IE, however it may be possible to escalate privileges if one were to abuse the SeLoadDriver privilege (rootkit?). You coud least shut down services and annoy someone.



-Maestr0

Nokia,
This is from my personal experience. Once I have run install of some shareware with user priviledges. It was runing fine untill it was time to register ActiveX controls. Tham msg window poped up saying that I don't have rights to change registry. I beleive that it was when regsrv32 was called to do its job.

Also, following your logic are the following system proceses:
net, ping, tracert, cmd, explorer, route print, arp, netstat, nbtstat, ipconfig, start, any win screensaver etc?
They are all in system32 folder. Got my point.
On the other hand any overflaw is security risk because at least it can be used to anoy user.
Attacker will pick overflaw that he/she knows best, and that is not patched on target system.

Quote:

---

Also, following your logic are the following system proceses:
net, ping, tracert, cmd, explorer, route print, arp, netstat, nbtstat, ipconfig, start, any win screensaver etc?
They are all in system32 folder. Got my point.

---

Ermmm, no they are not sytem processes but lsass and svchost are and they are stored in the system32 directory also, get my point?

Nice response people, but you too less imaginative pictures this anyone heard of .LNK files, a simple LNK file could create a bind shell through this,a bat file too.

AN OVERFLOW IS AN OVERFLOW AND IT NEEDS TO BE ACKNOWLEDGED AND FIXED.

Go here http://www.securityfocus.com/archive/82/316073 warlock7 and you will see that when this overflow was first found in MARCH 2003!, it was reported to microsoft and they have deemed it is not a security threat.

Maybe post a little more upto date info next time instead of a 500day exploit?

I could swear I'd seen a post similar to this one right here on AO.
I had the same kind of discussion then as we do now.
Unfortunatly I couldn't find the first post anymore :(

Nokia: I think you're confusing a system process in windows with something like a SUID program on *nix. If the overflow existed in an SUID program you can abuse it to get more privileges. But regsvr32 doesn't raise it's privileges so there's nothing to gain. It uses the same privileges as the user invoking the command. If the user has admin privileges the program, and as a consequence the payload of the overflow, has admin privileges. But if the user already has admin rights why the hassle of an overflow, that user already has all the power s/he needs to completely nuke the system.

Quote:

---

Nice response people, but you too less imaginative pictures this anyone heard of .LNK files, a simple LNK file could create a bind shell through this,a bat file too.

---

Yes, you could. But isn't it alot simpler to just bind that shell directly? Why the hassle of an overflow which can and will misfire (BOs tend to depend on OS version, patchlevel, language etc.)? Just look at some of the viruses floating around. Alot of them don't even abuse a bug in the system. People will click on anything. Even if you mark your executable with a huge warning label "Running this program will install a backdoor!", people will still click on it to see what will happen.