RadAsm <=2.2.1.5 Local Command Execution
------------------------------------------------------------------
vulnerability discovered by DATA_SNIPER.
bug discovred in 25/11/2008.
infected version:All Version
greetz go to:www.at4re.com(Arab Team 4 Reverse Engineering),arab4services.net
Critical: Highly critical
Impact:Command Execution
------------------------------------------------------------------
this is litel POC that can execute arabitrary command in victime machine.
in unexpected way the attacker can put in the project file ".rap file" command
instead of the linker path or Macro Assembler "ML.exe" path.
project file look like this.
" some data has been cuted for making it readable"
-------------------------------------
project file structure
[Project]
Assembler=masm
Type=Win32 App
......datat
[Files]
1=file.Asm
.....data
[MakeFiles]
5=CRC Check.exe
[MakeDef]
Menu=1,1,1,1,1,1,1,1,0,0,0,0,0,0,0,0
1=4,O,$B\RC.EXE /v,1 <==Command Execution by replacing the original file path
with the command
2=3,O,$B\ML.EXE /c /coff /Cp /nologo /I"$I",2 <==Command Execution by
replacing the original file path with the command
3=5,O,$B\LINK.EXE /SUBSYSTEM:WINDOWS /RELEASE /VERSION:4.0 /LIBPATH:"$L"
/OUT:"$5",3,4 <==Command Execution by replacing the original file path with the
command
4=0,0,,5
5=rsrc.obj,O,$B\CVTRES.EXE,rsrc.res <==Command Execution by replacing the
original file path with the command
7=0,0,"$E\OllyDbg",5
6=*.obj,O,$B\ML.EXE /c /coff /Cp /nologo /I"$I",*.asm
11=4,O,$B\RC.EXE /v,1 <==Command Execution by replacing the original file
path with the command
12=3,O,$B\ML.EXE /c /coff /Cp /Zi /nologo /I"$I",2 <==Command Execution by
replacing the original file path with the command
13=5,O,$B\LINK.EXE /SUBSYSTEM:WINDOWS /DEBUG /VERSION:4.0 /LIBPATH:"$L"
/OUT:"$5",3,4 <==Command Execution by replacing the original file path with the
command
data.....
[Resource]
data.....and more data.
----------------------------------------------------------------------
as you see " <==Command Execution breplacing the original file name with the
command" this mean, that type of data in the project it's exploited as command
execution by malicious people.
and when the user try to compile the project will face the issue of executing
bad command in his operating system.