Microsoft word crashes when opening a document 2015

MICROSOFT WORD CRASHES WHEN OPENING A DOCUMENT 2015 ZIP FILE
MICROSOFT WORD CRASHES WHEN OPENING A DOCUMENT 2015 CODE

The disassembly of the first 46 (0x2E) bytes shows that the second stage shellcode decrypts itself by XORing each of the next 0x3CC bytes with 0xFCДЄfter decrypting itself, it searches for an encryptedВ payload (an exe file) preceded by a marker 0xBABABABA in memory and then decodes it by XORing every DWORD with 0xCAFEBABE. You can disassemble the first stage shellcode (with immunity debugger or online) and learn that it looks for a second stage shellcode in memory preceded by markers 0xFEFEFEFE, 0xFEFEFEFE and 0xFFFFFFFF (you can search for these markers in the document), copies it to a previously allocated executable buffer and then jumps to it.ДЄt this point, you can replace the shellcode with your own, repack (zip) the file, replace the original data of OLE1вЂ™s DOCX with Structured Storage eXplorer, copy itвЂ™s content to a text editor in ASCII and youвЂ™ll have your own reconstructed CVE-2015-1641 exploit. When you extract the contents of OLE1ExtractedDocument.docx, youвЂ™ll notice that the file contains an ActiveX object This is usually an address in the heap memory area, which doesnвЂ™t exist in this case. It crashed when itвЂ™s trying to execute instruction at address 0x08080808.

This time it didnвЂ™t crash because it couldnвЂ™t read data located at an address pointed by ECX (0x7C38BD50). LetвЂ™s put Object #1 along with Object #3 (the document that caused the crash) inside an RTF file as itвЂ™s in the original exploit document.ДЄttach word to a debugger and open this file. YouвЂ™re probably saying вЂњOk, this is getting interesting, whatвЂ™s next?вЂќ. If you try to search that address, youвЂ™ll know that it doesnвЂ™t exist. It is beyond the scope of this post.ДЄn access violation occured when itвЂ™s trying to read from a memory location pointed by ECX (0x7C38BD50).

MICROSOFT WORD CRASHES WHEN OPENING A DOCUMENT 2015 CODE

You can disassemble the module and find out the code that causes this memory corruption by yourself. This is the document that actually triggers the vulnerability. Attach Microsoft Office Word 2007 or 2010 with your favorite debugger and open вЂњOLE2ExtractedDocument.docxвЂќ.ДЇrom the above crash we can tell that some code in the вЂњWWLibвЂќ module of Microsoft Office is vulnerable (see EIP value). So, you can rename it to вЂњOLE1ExtractedDocument.docxвЂќ.

MICROSOFT WORD CRASHES WHEN OPENING A DOCUMENT 2015 ZIP FILE

By now itвЂ™s very obvious that the zip file is actually a DOCX (Word 2007 file). Export the data to вЂњOLE1ExtractedFile.zipвЂќ and then extract it. The stream named вЂњpackageвЂќ inside the вЂњRootвЂќ storage contains a zip file, as you can see the header. In order to understand what this document is all about, youвЂ™ll need to open it with a program that understands the Compound File Binary File Format Specification. Object #2, with a ProgID of вЂњWord.Document.12вЂќ, contains an embedded OLE document. This object loads a non-ASLR module MSVCR71.dll for bypassing ASLR. RTFScan tells us that there are four objects in this document and dumps the objects as separate files.ДЄs you can see, Object #1 does not have any embedded object but it has a reference to вЂњotkloadr.WRAssembly.1вЂќ (ProgID). However, I think itвЂ™s best if you scan it with RTFScan.exe than read the whole document yourself. If you previously studied the Rich Text Format Specification document, you can easily identify the control words and data in the document. When you open the document with a text editor, you will see that it is an RTF file despite what the file extension says it is. It exploits a Microsoft Office Memory Corruption Vulnerability ( CVE-2015-1641, MS15-033) with one of its embedded objects in the document. The document file goes by the name вЂњammendment.docвЂќ (MD5:В ae6b65ca7cbd4ca0ba86c6278c834547). This blog post is a detailed analysis and reconstruction of a document exploit that has been around for about a year now.

Microsoft word crashes when opening a document 2015