themalwareguardian/cve-2018-18912SEH-based buffer overflow in Easy File Sharing Web Server 7.2 demonstrating how an authenticated HTTP POST parameter can corrupt the exception handler chain.
SEH-based buffer overflow in Easy File Sharing Web Server 7.2 demonstrating how an authenticated HTTP POST parameter can corrupt the exception handler chain.
This repository is part of the material I use when teaching memory corruption exploitation (in addition to my regular work, I also teach in different cybersecurity courses where I help train the next generation of reverse engineers).
CVE-2018-18912 is the case I use to make the jump from vanilla EIP overwrites to SEH-based exploitation. Once students understand how a direct return address overwrite works, the next step is understanding what happens when the stack is so corrupted that the program triggers an exception before returning, and how that exception handler chain becomes the attack surface instead. This CVE demonstrates that transition cleanly: the overflow is deep enough to reach the SEH chain, and the exploitation path follows the classic POP POP RETN technique that every exploit developer needs to understand. The optional DEP bypass via ROP is left as an extension for students who want to go further, the same overflow, a different gadget strategy, a much harder problem.
This vulnerability affects Easy File Sharing Web Server 7.2, a lightweight Windows web server application that was widely used for simple file sharing. The software was written without modern security mitigations in mind. What makes this case particularly interesting from a teaching perspective is the combination of factors involved:
This combination makes CVE-2018-18912 an excellent case for teaching exploit development techniques beyond the basics.
Easy File Sharing Web Server 7.2 is a Windows application that allows users to share files over HTTP. It includes functionality such as file browsing, user authentication, and a built-in forum system.
The forum functionality accepts POST requests to create new topics. One of the form fields handled by this endpoint is the author parameter. Internally, the application copies this user-controlled value into a fixed-size stack buffer without validating the length.
The vulnerability was discovered and reported in 2018. The original PoC was published shortly after, demonstrating both the crash and a working exploit chain including ROP gadgets from the bundled ImageLoad.dll module.
Key technical details:
Easy File Sharing Web Server processes HTTP POST requests directed to /forum.ghp when a user creates a new forum topic. One of the accepted parameters is author, which is copied into a local stack buffer without any length check.
When reversing the binary, it can be observed that the handler for this form field uses a fixed-size buffer and an unsafe copy operation. A simplified version of the vulnerable logic looks like this:
char author_buffer[64];
strcpy(author_buffer, user_input);
Since the destination buffer has a fixed size and the input length is not validated, sending a sufficiently long string in the author field causes the copy to write past the end of the buffer.
As more data is written, the stack layout becomes corrupted. Unlike a simple return address overwrite, the overflow reaches the Structured Exception Handler (SEH) chain stored on the stack. When an exception is triggered as a result of the corrupted stack, the OS walks the SEH chain and transfers control to the attacker-controlled handler address.
The exploitation flow therefore follows the SEH overwrite technique:
This makes the vulnerability more complex to exploit than a basic EIP overwrite, but also more representative of real-world scenarios.
The crash can be reproduced by sending a long string in the author parameter of a POST request to /forum.ghp after authenticating with valid credentials. Example using Python:
import socket
HOST = '127.0.0.1'
PORT = 80
payload = b"A" * 500
request = (
b"POST /forum.ghp?forumid=1 HTTP/1.1\r\n"
b"Host: 127.0.0.1\r\n"
b"Content-Type: application/x-www-form-urlencoded\r\n"
b"Cookie: UserID=test; PassWD=test; SESSIONID=1234\r\n"
b"Connection: close\r\n"
b"\r\n"
b"author=" + payload + b"&passwd=test&title=test&content=test&Submit=Submit\r\n"
)
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.connect((HOST, PORT))
s.send(request)
s.close()
When executed under a debugger, the crash shows a corrupted SEH chain and an access violation, confirming that user-controlled data has overwritten the exception handler pointer.
The goal of this repository is not only to demonstrate the crash, but also to walk through the complete exploitation process step by step, following the methodology used when developing real SEH-based exploits.
To keep the main README clean, the detailed exploitation notes, scripts, and debugger steps are placed inside the Vulnerability 📂 folder of this repository.
There you will find the complete workflow used to exploit this CVE, including: