bpmcdevitt/exploit-db-mirror
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
exploit-db-mirror/exploits/windows/dos/22215.txt
Offensive Security ed0e1e4d44 DB: 2018-09-25 
1979 changes to exploits/shellcodes

Couchdb 1.5.0 - 'uuids' Denial of Service
Apache CouchDB 1.5.0 - 'uuids' Denial of Service

Beyond Remote 2.2.5.3 - Denial of Service (PoC)
udisks2 2.8.0 - Denial of Service (PoC)
Termite 3.4 - Denial of Service (PoC)
SoftX FTP Client 3.3 - Denial of Service (PoC)

Silverstripe 2.3.5 - Cross-Site Request Forgery / Open redirection
SilverStripe CMS 2.3.5 - Cross-Site Request Forgery / Open Redirection

Silverstripe CMS 3.0.2 - Multiple Vulnerabilities
SilverStripe CMS 3.0.2 - Multiple Vulnerabilities

Silverstripe CMS 2.4 - File Renaming Security Bypass
SilverStripe CMS 2.4 - File Renaming Security Bypass

Silverstripe CMS 2.4.5 - Multiple Cross-Site Scripting Vulnerabilities
SilverStripe CMS 2.4.5 - Multiple Cross-Site Scripting Vulnerabilities

Silverstripe CMS 2.4.7 - 'install.php' PHP Code Injection
SilverStripe CMS 2.4.7 - 'install.php' PHP Code Injection

Silverstripe Pixlr Image Editor - 'upload.php' Arbitrary File Upload
SilverStripe CMS Pixlr Image Editor - 'upload.php' Arbitrary File Upload

Silverstripe CMS 2.4.x - 'BackURL' Open Redirection
SilverStripe CMS 2.4.x - 'BackURL' Open Redirection

Silverstripe CMS - 'MemberLoginForm.php' Information Disclosure
SilverStripe CMS - 'MemberLoginForm.php' Information Disclosure

Silverstripe CMS - Multiple HTML Injection Vulnerabilities
SilverStripe CMS - Multiple HTML Injection Vulnerabilities

Apache CouchDB 1.7.0 and 2.x before 2.1.1 - Remote Privilege Escalation
Apache CouchDB 1.7.0 / 2.x < 2.1.1 - Remote Privilege Escalation

Monstra CMS before 3.0.4 - Cross-Site Scripting
Monstra CMS < 3.0.4 - Cross-Site Scripting (2)

Monstra CMS < 3.0.4 - Cross-Site Scripting
Monstra CMS < 3.0.4 - Cross-Site Scripting (1)
Navigate CMS 2.8 - Cross-Site Scripting
Collectric CMU 1.0 - 'lang' SQL injection
Joomla! Component CW Article Attachments 1.0.6 - 'id' SQL Injection
LG SuperSign EZ CMS 2.5 - Remote Code Execution
MyBB Visual Editor 1.8.18 - Cross-Site Scripting
Joomla! Component AMGallery 1.2.3 - 'filter_category_id' SQL Injection
Joomla! Component Micro Deal Factory 2.4.0 - 'id' SQL Injection
RICOH Aficio MP 301 Printer - Cross-Site Scripting
Joomla! Component Auction Factory 4.5.5 - 'filter_order' SQL Injection
RICOH MP C6003 Printer - Cross-Site Scripting

Linux/ARM - Egghunter (PWN!) + execve(_/bin/sh__ NULL_ NULL) Shellcode (28 Bytes)
Linux/ARM - sigaction() Based Egghunter (PWN!) + execve(_/bin/sh__ NULL_ NULL) Shellcode (52 Bytes)
2018-09-25 05:01:51 +00:00

130 lines
No EOL
4.6 KiB
Text
Raw Blame History

Title : Microsoft Office Word 2010 Stack Overflow
Version : Microsoft Office professional Plus 2010
Date : 2012-10-23
Vendor : http://office.microsoft.com
Impact : Med/High
Contact : coolkaveh [at] rocketmail.com
Twitter : @coolkaveh
tested : XP SP3 ENG
###############################################################################
Bug :
----
StackOverflow during the handling of the doc files a context-dependent attacker
can execute arbitrary code.
----
################################################################################
(be0.59c): Stack overflow - code c00000fd (first chance)
First chance exceptions are reported before any exception handling.
This exception may be expected and handled.
eax=00032000
ebx=00000000
ecx=00032fe4
edx=000024bc
esi=008b8974
edi=0753e000
eip=316d458e
esp=000380f0
ebp=000380f8 iopl=0 nv up ei pl nz na pe nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00010206
*** ERROR: Symbol file could not be found. Defaulted to export symbols for C:\Program Files\Microsoft Office\Office14\wwlib.dll -
wwlib+0x458e:
316d458e 8500 test dword ptr [eax],eax ds:0023:00032000=00000000
0:000>!exploitable -v
eax=00032000 ebx=00000000 ecx=00032fe4 edx=000024bc esi=008b8974 edi=0753e000
eip=316d458e esp=000380f0 ebp=000380f8 iopl=0 nv up ei pl nz na pe nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00010206
wwlib+0x458e:
316d458e 8500 test dword ptr [eax],eax ds:0023:00032000=00000000
HostMachine\HostUser
Executing Processor Architecture is x86
Debuggee is in User Mode
Debuggee is a live user mode debugging session on the local machine
Event Type: Exception
*** ERROR: Symbol file could not be found. Defaulted to export symbols for ntdll.dll -
*** ERROR: Symbol file could not be found. Defaulted to export symbols for C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSPTLS.DLL -
Exception Faulting Address: 0x316d458e
First Chance Exception Type: STATUS_STACK_OVERFLOW (0xC00000FD)
Faulting Instruction:316d458e test dword ptr [eax],eax
Basic Block:
316d458e test dword ptr [eax],eax
Tainted Input Operands: eax
316d4590 jmp wwlib+0x4585 (316d4585)
Exception Hash (Major/Minor): 0x7513030e.0x2d6c2e72
Stack Trace:
wwlib+0x458e
wwlib!GetAllocCounters+0x78520
wwlib!GetAllocCounters+0x90f89
wwlib!GetAllocCounters+0x134cf
wwlib!DllGetLCID+0x6451eb
wwlib!DllGetLCID+0x645c74
wwlib!DllGetLCID+0x29b461
wwlib!DllGetLCID+0x531d6
wwlib!DllGetLCID+0x2c1272
wwlib!DllGetLCID+0x141bf9
wwlib!DllGetLCID+0x1d1144
wwlib!DllGetLCID+0x1d05ae
MSPTLS!LsLwMultDivR+0x101e7
MSPTLS!LsLwMultDivR+0x10afb
MSPTLS!LsLwMultDivR+0x10c5e
MSPTLS!LsLwMultDivR+0x10ec8
MSPTLS!FsTransformBbox+0xe137
MSPTLS!LsLwMultDivR+0x24ac6
MSPTLS!LsLwMultDivR+0x27d0
MSPTLS!LsLwMultDivR+0x25470
MSPTLS!LsLwMultDivR+0x25642
MSPTLS!LsLwMultDivR+0x259ad
MSPTLS!LsLwMultDivR+0x2a64
MSPTLS!LsLwMultDivR+0x3201
MSPTLS!FsTransformBbox+0x74ae
MSPTLS!FsTransformBbox+0x7e28
MSPTLS!FsCreateSubpageFinite+0xad
wwlib!DllGetLCID+0x541fc
wwlib!DllGetLCID+0x54037
MSPTLS!LsLwMultDivR+0x4e92
MSPTLS!LsLwMultDivR+0x29070
MSPTLS!LsLwMultDivR+0x285b0
MSPTLS!LsLwMultDivR+0x5fa3
MSPTLS!LsLwMultDivR+0x6816
MSPTLS!FsTransformBbox+0xb8c1
MSPTLS!FsQueryTableObjFigureListWord+0x2a0
MSPTLS!LsLwMultDivR+0x101e7
MSPTLS!LsLwMultDivR+0x10afb
MSPTLS!LsLwMultDivR+0x10c5e
MSPTLS!LsLwMultDivR+0x10ec8
MSPTLS!FsTransformBbox+0xe137
MSPTLS!LsLwMultDivR+0x24ac6
MSPTLS!LsLwMultDivR+0x27d0
MSPTLS!LsLwMultDivR+0x25470
MSPTLS!LsLwMultDivR+0x25642
MSPTLS!LsLwMultDivR+0x259ad
MSPTLS!LsLwMultDivR+0x2a64
MSPTLS!LsLwMultDivR+0x3201
MSPTLS!FsTransformBbox+0x74ae
MSPTLS!FsTransformBbox+0x7e28
MSPTLS!FsCreateSubpageFinite+0xad
wwlib!DllGetLCID+0x1d07f0
MSPTLS!LsLwMultDivR+0x101e7
MSPTLS!LsLwMultDivR+0x10afb
MSPTLS!LsLwMultDivR+0x10c5e
MSPTLS!LsLwMultDivR+0x10ec8
MSPTLS!FsTransformBbox+0xe137
MSPTLS!LsLwMultDivR+0x24ac6
MSPTLS!LsLwMultDivR+0x27d0
MSPTLS!LsLwMultDivR+0x25470
MSPTLS!LsLwMultDivR+0x25642
MSPTLS!LsLwMultDivR+0x259ad
MSPTLS!LsLwMultDivR+0x2a64
MSPTLS!LsLwMultDivR+0x3201
Instruction Address: 0x00000000316d458e
Description: Stack Overflow
Short Description: StackOverflow
Recommended Bug Title: Stack Overflow starting at wwlib+0x000000000000458e (Hash=0x7513030e.0x2d6c2e72)
##############################################################################################################
Proof of concept poc.doc included.
Exploit-DB Note: This also works on Word 2007
PoC: https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/22215.tar.gz
Reference in a new issue View git blame Copy permalink