[0day Exploits] Allah , Alwatan , Almali .[0day Exploits] HIGH RISK EXPLOIT .

USE THIS EXPLOIT AT YOUR OWN RISK I'M NOT RESPONSIBLE OF ANY HARM . USE THIS EXPLOIT AT YOUR OWN RISK I'M NOT RESPONSIBLE OF ANY HARM . USE THIS EXPLOIT AT YOUR OWN RISK I'M NOT RESPONSIBLE OF ANY HARM . #Exploit name : Internet Mobile - Maroc Telecom (HUAWEI Technologies) Exception handling vulnerability #Author : Dar -Puzzle ($0uH@iL) #Type : Remote . #Ris : High #Vulnerable Version : 11.302.09.05.162 (Other Versions [If Available] May Also B e Vulnerable) #Software Vendor : HUAWEI Technologies & Maroc Telecom . #Software Lin : Software is Installed Via The 3G connection modem. #Date : 28 June 2012 . ------------------------------------------------------------------------------------------------------Exploit : The Program Was Enabled To process the Exception . The Exception is an access Violation to EAX by Flooding the CX in the ECX Regist er. [Imp Registers] : EAX 00190000 ASCII "Actx" ECX 00000041 [Exception Handling In Main Thread] Disassembly : TEST ECX,ECX JE SHORT COMCTL32.720AB00B MOVZX ECX,WORD PTR DS:[EDX+EAX] TEST CX,CX JE SHORT COMCTL32.720AB00B MOV WORD PTR DS:[EAX],CX <<----- Access Violation = Exception Handling Vulnerabi lity . INC EAX INC EAX DEC ESI JNZ SHORT COMCTL32.720AAFF3 -------------------------------------------------------------------------------------------------------Ris s : HIGH The program is crashed when Executing it . ( Double clic , the interface is sho wn up, charging boutton is up then Boom Crash ) . This exploit in the HUAWEI Modem is concidered a high one beacause the Attac er can edit the XML and lang files reffering to direct DLLs . Which can cause in most of the times an edit of sensitive Lines. So , the attac er can have the privileges to bypass the program Authetification or to use the e xception handling to DoS the users program until it's reinstalled (Not Restarded ) . A normal user can't now the source of the crash problem which is related to the XML files . Nobody search or read in these files most of the times .

Then he will stay without Internet connection for a no short period of time , un til reinstalling the program or contacting the vendor . --------------------------------------------------------------------------------------------------------How To Exploit : (USE IT AT YOUR OWN RISK , Je ne suis pas responsable de ce qui est fait par cette vulnerabilit) I'm not responsible of any harm . Go to ----> C:\Progam Files\Internet Mobile\plugins\SMSUIPlugin (FOR Example) Now open the lang files ---> French And English . SMSUIPlugin_fr-fr and SMSUIPlu gin_en-us Replace the line : <item name="IDS_PLUGIN_NAME">Texte</item> and <item name="IDS_PLUGIN_MENUITEM">Message &amp;Texte</item> and this one <item name="IDS_TREE_DINBOX">Boite de rception</item> Same Names just in english instead french ------------------------------------------Replace them with that (for example) : This : <item name="IDS_PLUGIN_NAME">Texte</item> Will become This : <item name="IDS_PLUGIN_NAME"> Very Very Very Huge Number Of A AA or whatever </item> and the same thing for the other lines shown before . This will ma e the program Crash when it's opened . The victim will be not able to run the software again until it's reinstalled . A script will be soon available to replace automatically the Lang files . ( PoC ) ---------------------------------------------------------------------------------------------------Dar -Puzzle (Souhail) . \x90 Follow me : fb.me/dar .puzzle \x90 Follow Moroccan Cyber Army : https://www.faceboo .com/MAR.Cyber.Army \x90 Greetz to : M.C.A , Team-Hunter , Jigs@w , All Inj3ct0r team Members , Pac etstr omsecurity.org , Ar-Devlopers.... \x90 Pentesting is my LIFE . \x90 GREY HAT Mercy From M0rocC0 . # 1337day.com [2012-06-29]