MOAUB #8 – Microsoft Office Visio DXF File stack overflow

Drawing Exchange Format (DXF) is a kind of data file format for CAD which is designed by Autodesk for cooperation between Autocad and other software. Varius software supports dxf file and Microsoft Visio is one of them.

Dxf file contain some section which every section contain some records. Every record consist of a pair of code and its value. The mentioned code called group code specify type of data follow it.

Every section starts with code zero that “SECTION” strings follow it. Then after each SECTION code 2 and after that a string representing name of the SECTION ( for example HEADER ). Every section is finished by zero and the “ENDSEC” string.

Here is the general structure of the DXF file:

It contains general information of our drawing design. This section contains a version of AutoCAD data base section and some system variables. Every variable contain a name and value pair.

This section holds information about instanced class in the utility application which its instances are represented in other sections.

It contains description of the following tables:
APPID (application identification table)
BLOCK_RECORD (block reference table)
DIMSTYLE (dimension style table)
LAYER (layer table)
LTYPE (linetype table)
LTYPE (linetype table)
UCS (user coordinate system table)
VIEW (view table)
VPORT (viewport configuration table)

This section contains block description and entities of our drawing design which create block reference in the design.

It contains graphic objects (Entity) in our drawing design which add block references.

This chapter presents the group codes that apply to nongraphical objects. These codes are found in the OBJECTS section of a DXF™ file and are used by AutoLISP® and ObjectARX® applications in entity definition lists.

For further information about DXF file format refer to the following link: http://images.autodesk.com/adsk/files/acad_dxf0.pdf

This vulnerability is a stack overflow exists in the processing of dxf files. The vulnerable module is VISIODWG.DLL and the module is loaded to when opening a dxf file. This vulnerable version is Microsoft Visio 2002 sp2.

sub_667D74C0 function process HEADER in the DXF files. In the beginning of the function there is a 92bytes of buffer are allocated for the function.

Then a little farther the vulnerable strcpy function is used that its second parameter is specified by some value in the file. In fact, in the beginning of sub_667D74C0 strcpy function copies name of the parameter in HEADER section to a fixed length buffer. Now if name of the parameters are greater than size of this buffer and because of no bound checking a stack overflow can occur.

If length of the parameter name string in Header section is greater than 81bytes the return address will be overwritten.
Here are the contents of dxf file in hex format that one of the parameter names in the HEADER section is greater than 81bytes:

Explotation of this stack overflow is simple because we don’t have GS or DEP protection in Microsoft Visio 2002.
As we discussed we know how to take control of the program so it is just needed to transfer the control to our shellcode. Also we can put our shellcode in the beginning of the file in header section without corruption the file. If you look at the EBP register before overflow and execution of RET instruction, you will notice that this register point to some memory that is in our input data.

At address 0x61C92866, the following instructions are exists:

By executing these instructions, value of esp and ebp are swapped and esp is incremented. In this situation esp points to our data. Now if we direct the RET instruction to some address containing JMP ESP instruction the execution flow will be transferred to our shellcode.

The important point is that our shellcode should be akphanumeric and does not contain bad characters (for example 5E). Check out the Microsoft Office Visio DXF File Stack based Overflow exploit.