Attack Chain

1. Attacker crafts a malicious ping.txt file containing shellcode designed for exploitation.
2. The crafted ping.txt file includes jump instructions specifically designed to overwrite the SEH handler pointer.
3. The attacker opens AgataSoft Auto PingMaster 1.5.
4. The attacker pastes the contents of the malicious ping.txt file into the Trace Route host name field within the application.
5. The application attempts to process the oversized input within the Trace Route host name field.
6. The stack-based buffer overflow occurs, overwriting the SEH handler pointer with the address specified in the malicious ping.txt file.
7. An exception is triggered within the application due to the overflow.
8. The overwritten SEH handler is invoked, redirecting execution flow to the attacker-controlled shellcode, resulting in arbitrary code execution.

Impact

Successful exploitation of this vulnerability allows a local attacker to execute arbitrary code on the affected system. This could lead to complete system compromise, including data theft, modification, or destruction. Since the attack requires local access, it is most likely to be exploited by malicious insiders or attackers who have already gained a foothold on the system. The vulnerability can lead to privilege escalation, enabling the attacker to perform actions with elevated permissions.

Recommendation

• Apply available patches or upgrade to a secure version of AgataSoft Auto PingMaster if available.
• Implement input validation and sanitization measures to prevent buffer overflows within applications, specifically targeting the Trace Route host name field to mitigate CVE-2018-25360.
• Deploy the Sigma rule Detect PingMaster SEH Overwrite to identify potential exploitation attempts by detecting processes being called from unusual locations due to SEH overwrite.
• Monitor process creation events for suspicious processes spawned by Auto PingMaster as a result of successful exploitation, using the Sigma rule Detect PingMaster Suspicious Child Process.
• Disable or restrict the use of AgataSoft Auto PingMaster 1.5 if patching or upgrading is not immediately feasible.