OllyDbg "INT3 AT" Format String Vulnerability
by Piotr Bania <bania.piotr@gmail.com>
c19K9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8Y4m8T1i4K6u0W2M7%4m8W2j5$3W2S2L8r3W2K6k6h3c8Q4x3X3g2A6L8X3k6G2
Original location: 9feK9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8Y4m8T1i4K6u0W2M7%4m8W2j5$3W2S2L8r3W2K6k6h3c8Q4x3X3g2A6L8X3k6G2i4K6u0r3j5h3I4D9i4K6u0r3j5h3c8$3i4K6u0r3L8$3I4D9P5g2)9J5k6r3W2F1N6o6y4Q4x3X3c8S2k6s2k6Q4x3X3g2@1P5s2b7`.
Severity: High / Medium - code execution.
Version affected: Probably all versions, tested on
v1.10.
I. BACKGROUND
"OllyDbg is a 32-bit assembler level analysing debugger for Microsoft Windows.
Emphasis on binary code analysis makes it particularly useful in cases where
source is unavailable."
II. DESCRIPTION
Vulnerability takes place when module (with special crafted file name) executes
int 3 instruction (trap to debugger).
Where format is an ascii string like: "INT3 command at <module_name>.addr".
Attacker can place a format string chars inside "<module_name>" (part of format
buffor) and cause Olly to overwrite arbitary data.
NOTE: Even with "IGNORE INT3 BREAKS" option checked, OllyDbg is still vulnerable.
Attacker can also load some special crafted module (with special crafted
name) while debugging, to make the attack more stealthy.
III. IMPACT
This vulnerability after successful exploitation can allow the
attacker to run arbitrary code in context of current user.
Of course if the exploitation was not successful OllyDbg will fault
and loose all debugged data.
