0neb1n/cve-2020-16947# CVE-2020-16947 개념 증명 익스플로잇 CVE-2020-16947에 대한 개념 증명 익스플로잇으로, 잘못된 형식의 HTML 콘텐츠로 인해 힙 버퍼 오버플로우와 원격 코드 실행이 발생하는 Microsoft Outlook RCE 취약점입니다.
이 취약점은 Windows 10 1909 x64에 설치된 Outlook 2019(16.0.13231.20262)에서 발생합니다.
winafl 퍼저를 사용하여 이 버그를 발견했습니다. 이 버그는 html 콘텐츠를 파싱할 때 발생합니다. 공격자가 이 익스플로잇을 성공적으로 실행하면 원격 코드 실행으로 이어질 수 있습니다.
0:000> r
rax=0000000000000000 rbx=0000021c99ce9eb0 rcx=0000021c99ce9eb0
rdx=00000046c07f8a30 rsi=0000021cc85ac000 rdi=00000000ffffe000
rip=00007ffe69012f5b rsp=00000046c07f89f0 rbp=00000046c07f8a69
r8=00000046c07f8a28 r9=0000000000000041 r10=00007de1cf5e3124
r11=0000000000000000 r12=00000046c07f8b00 r13=0000021c99ce9f1c
r14=0000000000000041 r15=00000000000003b5
iopl=0 nv up ei pl zr na po nc
cs=0033 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00010246
OLMAPI32!HrGetMessageClassFromContentClassW+0xf80b:
00007ffe`69012f5b 448836 mov byte ptr [rsi],r14b ds:0000021c`c85ac000=??
0:000> d rsi - 10
0000021c`c85abff0 ff fd ff fd ff fd ff fd-ff fd ff fd ff fd ff 41 ...............A
0000021c`c85ac000 ?? ?? ?? ?? ?? ?? ?? ??-?? ?? ?? ?? ?? ?? ?? ?? ????????????????
0000021c`c85ac010 ?? ?? ?? ?? ?? ?? ?? ??-?? ?? ?? ?? ?? ?? ?? ?? ????????????????
0000021c`c85ac020 ?? ?? ?? ?? ?? ?? ?? ??-?? ?? ?? ?? ?? ?? ?? ?? ????????????????
0000021c`c85ac030 ?? ?? ?? ?? ?? ?? ?? ??-?? ?? ?? ?? ?? ?? ?? ?? ????????????????
0000021c`c85ac040 ?? ?? ?? ?? ?? ?? ?? ??-?? ?? ?? ?? ?? ?? ?? ?? ????????????????
0000021c`c85ac050 ?? ?? ?? ?? ?? ?? ?? ??-?? ?? ?? ?? ?? ?? ?? ?? ????????????????
0000021c`c85ac060 ?? ?? ?? ?? ?? ?? ?? ??-?? ?? ?? ?? ?? ?? ?? ?? ????????????????
0:000> !heap -p -a rsi
address 0000021cc85ac000 found in
_DPH_HEAP_ROOT @ 21ce0331000
in busy allocation ( DPH_HEAP_BLOCK: UserAddr UserSize - VirtAddr VirtSize)
21ccb3eb000: 21cc85a7ff0 4010 - 21cc85a7000 6000
00007ffea238825b ntdll!RtlDebugAllocateHeap+0x000000000000003b
00007ffea22a9745 ntdll!RtlpAllocateHeap+0x00000000000000f5
00007ffea22a73d4 ntdll!RtlpAllocateHeapInternal+0x00000000000006d4
00007ffe68c8777d OLMAPI32!MAPIAllocateBuffer+0x00000000000000cd
00007ffe69012a35 OLMAPI32!HrGetMessageClassFromContentClassW+0x000000000000f2e5
00007ffe69015d34 OLMAPI32!HrTextFromCompressedRTFStreamEx+0x00000000000023d4
00007ffe68dcc776 OLMAPI32!RTFSyncCpid+0x0000000000000156
00007ffe7c3eb532 exsec32!HrExsec32Initialize+0x0000000000005372
00007ffe7c3e5631 exsec32+0x0000000000005631
00007ffe68dccc76 OLMAPI32!RTFSyncCpid+0x0000000000000656
00007ffe68de2ab4 OLMAPI32!HrCreateMHTMLConverter+0x0000000000002634
00007ffe68dd21a7 OLMAPI32!MlangIsConvertible+0x0000000000004a07
00007ffe68de299d OLMAPI32!HrCreateMHTMLConverter+0x000000000000251d
00007ffe7c42748f exsec32!DllUnregisterServer+0x00000000000002bf
00007ffe7c3eb418 exsec32!HrExsec32Initialize+0x0000000000005258
00007ffe7c3e5631 exsec32+0x0000000000005631
00007ffe551703d9 OUTLMIME!MimeOleInetDateToFileTime+0x0000000000025539
00007ffe551709f9 OUTLMIME!MimeOleInetDateToFileTime+0x0000000000025b59
00007ffe55174dec OUTLMIME!MimeOleInetDateToFileTime+0x0000000000029f4c
00007ffe55175279 OUTLMIME!MimeOleInetDateToFileTime+0x000000000002a3d9
00007ffe55174ebe OUTLMIME!MimeOleInetDateToFileTime+0x000000000002a01e
00007ffe7c41a8fc exsec32!HrMaxAlgStrength+0x0000000000004cac
00007ffe7c3eb017 exsec32!HrExsec32Initialize+0x0000000000004e57
00007ffe7c3ebf23 exsec32!HrExsec32Initialize+0x0000000000005d63
00007ffe49ac9f47 mso98win32client!Ordinal3621+0x00000000000000e7
00007ffe49ac9ecd mso98win32client!Ordinal3621+0x000000000000006d
00007ff7afc43f79 outlook!FEnableAMapProgress+0x000000000002f099
00007ff7afdb638d outlook!UpdateSharingAccounts+0x000000000007031d
00007ff7afdc3d85 outlook!IsOutlookOutsideWinMain+0x0000000000003af5
00007ff7afcf7727 outlook!HrGetDelegatorInfoSync+0x00000000000016e7
00007ff7afd2a2b0 outlook!GetOutlookSafeModeState+0x000000000000bd00
00007ff7afd2a14b outlook!GetOutlookSafeModeState+0x000000000000bb9b
html 콘텐츠에서 ascii 범위를 벗어난 문자열을 복사할 때 해당 문자열은 0xfffd로 대체됩니다. 그 결과 복사된 문자열의 크기가 두 배가 되므로, src 버퍼와 dst 버퍼의 크기가 동일함에도 불구하고 버퍼 오버플로가 발생합니다.