AgataSoft Auto PingMaster 1.5 Buffer Overflow SEH

Vulnerability

AgataSoft Auto PingMaster 1.5 contains a stack-based buffer overflow vulnerability (CWE-121) in the Trace Route host name field. The application fails to properly validate the length of input pasted into the "Host name:" field, allowing a local attacker to overwrite the structured exception handling (SEH) handler pointer. The official exploit generates a malicious ping.txt file with shellcode and jump instructions; when the file contents are copied to the clipboard and pasted into the field, the overflow triggers arbitrary code execution. This affects Auto PingMaster version 1.5 [1][2].

Exploitation

An attacker must have local access to the target Windows machine (tested on Windows 7 SP1 x86). The exploit involves the following steps: (1) generate a crafted ping.txt file containing a 100-byte junk buffer, a 448-byte shellcode payload (e.g., calc.exe), and SEH overwrite instructions; (2) copy the entire content of the file to the clipboard; (3) open the Auto PingMaster application; (4) select the Trace Route option; (5) paste the clipboard contents into the "Host name:" field; (6) click the "Get IP from host name" button. This sequence causes the overflow, overwrites the SEH handler, and executes the shellcode [1].

Impact

Successful exploitation allows a local attacker to execute arbitrary code with the privileges of the user running Auto PingMaster. In the published proof of concept, the shellcode launches calc.exe, but an attacker could substitute any command or payload, potentially leading to full system compromise, data exfiltration, or further lateral movement. The impact is high for confidentiality, integrity, and availability (CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H) [2].

Mitigation

No official patch has been released by AgataSoft; the vendor website [3] is no longer active, suggesting the product may be abandoned. Users should immediately discontinue use of Auto PingMaster 1.5, restrict local access to the application to trusted users only, and consider migrating to an alternative, actively maintained network diagnostic tool. The vulnerability is not known to be listed in CISA’s Known Exploited Vulnerabilities (KEV) catalog as of the publication date [1][2].