Attack Chain

1. Attacker gains local access to the target system.
2. Attacker identifies that SysGauge Pro 4.6.12 is installed.
3. Attacker launches SysGauge Pro.
4. Attacker initiates the registration process within SysGauge Pro.
5. Attacker provides a crafted “Unlock Key” containing shellcode designed to overwrite the Structured Exception Handler (SEH).
6. The application attempts to process the overly long “Unlock Key” without proper bounds checking.
7. The buffer overflow occurs, overwriting the SEH with the attacker’s shellcode address.
8. When an exception occurs within the application, the overwritten SEH is invoked, redirecting execution to the attacker’s shellcode, leading to arbitrary code execution with application privileges.

Impact

Successful exploitation of this vulnerability allows a local attacker to execute arbitrary code with the privileges of the SysGauge Pro application. This could lead to complete system compromise if the application is running with elevated privileges. The impact includes potential data theft, modification of system settings, or installation of malware. Given that this is a local exploit, the primary risk is to systems where untrusted users have local access.

Recommendation

• Monitor process creations for SysGauge Pro (SysGauge.exe) spawning unusual child processes to detect potential exploitation attempts, using a process_creation Sigma rule.
• Consider deploying application control or whitelisting to prevent execution of unsigned or untrusted executables within the SysGauge Pro process.
• Since no patch is available, consider uninstalling SysGauge Pro 4.6.12 from systems where the risk outweighs the benefit of the software.