2007/05/14

MoAxB #14: Clever Database Comparer ActiveX version 2.2 Remote Buffer Overflow Exploit

Questo ActiveX serve a comparare due database e il metodo "ConnectToDatabase" è vulnerabile a Buffer Overflow che consente l'esecuzione di codice arbitrario sul pc di un utente.

Dimostrazione online

Contenuto dei registri al momento del crash:

12:58:35.492  pid=0570 tid=07FC  EXCEPTION (first-chance)
----------------------------------------------------------------
Exception C0000005 (ACCESS_VIOLATION reading [41414141])
----------------------------------------------------------------
EAX=01D04141: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00
EBX=41418282: ?? ?? ?? ?? ?? ?? ?? ??-?? ?? ?? ?? ?? ?? ?? ??
ECX=01D0EA01: 41 41 41 41 41 41 41 41-41 41 41 41 41 41 41 41
EDX=00000001: ?? ?? ?? ?? ?? ?? ?? ??-?? ?? ?? ?? ?? ?? ?? ??
ESP=01D0E510: 58 DD 0A 03 41 41 41 41-41 41 41 41 00 00 14 00
EBP=01D0E540: E0 EA D0 01 28 6F 93 03-41 41 41 41 58 DD 0A 03
ESI=41414141: ?? ?? ?? ?? ?? ?? ?? ??-?? ?? ?? ?? ?? ?? ?? ??
EDI=030ADD58: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00
EIP=039316BC: 38 0E 74 1F 66 85 D2 6A-00 74 07 68 C8 32 95 03
--> CMP [ESI],CL
----------------------------------------------------------------

12:58:35.492 pid=0570 tid=07FC EXCEPTION (first-chance)
----------------------------------------------------------------
Exception C0000005 (ACCESS_VIOLATION reading [41414141])
----------------------------------------------------------------
EAX=00000000: ?? ?? ?? ?? ?? ?? ?? ??-?? ?? ?? ?? ?? ?? ?? ??
EBX=00000000: ?? ?? ?? ?? ?? ?? ?? ??-?? ?? ?? ?? ?? ?? ?? ??
ECX=41414141: ?? ?? ?? ?? ?? ?? ?? ??-?? ?? ?? ?? ?? ?? ?? ??
EDX=7C9137D8: 8B 4C 24 04 F7 41 04 06-00 00 00 B8 01 00 00 00
ESP=01D0E140: BF 37 91 7C 28 E2 D0 01-28 EC D0 01 44 E2 D0 01
EBP=01D0E160: 10 E2 D0 01 8B 37 91 7C-28 E2 D0 01 28 EC D0 01
ESI=00000000: ?? ?? ?? ?? ?? ?? ?? ??-?? ?? ?? ?? ?? ?? ?? ??
EDI=00000000: ?? ?? ?? ?? ?? ?? ?? ??-?? ?? ?? ?? ?? ?? ?? ??
EIP=41414141: ?? ?? ?? ?? ?? ?? ?? ??-?? ?? ?? ?? ?? ?? ?? ??
--> N/A
----------------------------------------------------------------

11 comments:

Anonymous said...

good work!!thanks!happy new year!!

Anonymous said...

On account of I have latale online gold , I am not afraid of the lonely. At that time I do not know the meaning of it. Later I buy latale gold . I have no latale money , I will feel very anxious. Why I buy latale online gold , because it gives me such a warm place. I have cheap latale gold .

Anonymous said...

You know ,I have some shaiya gold,and my friend also has some
shaiya money,do you kouw they have the same meaning,Both of them can be called shaiya gold,I just want to
buy shaiya online gold,because there are many
cheap shaiya goldYou know ,I have some runescape gold,and my friend also has some rs gold,do you kouw they have the same meaning,Both of them can be called runescape money
I just want to buy runescape,because there are many
cheap rs gold

Anonymous said...

I can get Pirates of the Burning Sea Gold cheaply,
Yesterday i want to buy potbs goldfor my brother.
i hope him like it. i will buy potbs Doubloon for him
as birthday present. i like the potbs money very much.
I usuallybuy potbs Doubloon and keep it in my store.

Anonymous said...

wow power levelingpower levelingwow power levelpowerlevelingpower levelwow powerlevelingwow goldbuy wow goldcheap wow gold

Anonymous said...

Replica Watches
Replica rolex Watches
replica omega watches
replica tag heuer watches
replica gucci watches
replica chopard watches
Replica A.Lange&Sohne Watches
Replica Alain Silberstein Watches
Replica Audemars Piguet Watches
Replica B.R.M Watches
Replica Baume & Mercier Watches
Replica Bell & Ross Watches
Replica bmw Watches
Replica breguet Watches
Replica breitling Watches
Replica bvlgari Watches
Replica cartier Watches
Replica chanel Watches
Replica dior Watches
Replica concord Watches

Anonymous said...

Dofus Kamas|Prix Moins Cher Dofus Kamas|Kamas par allopass|Dofus kamas audiotel|Dofus kamas par telephone sur Virstock.com

Meilleur prix dofus kamas stock de dofus kamas

Prix moins cher dofus kamas
vente dofus kamas sur www.virstock.com

Kamas par allopass sur dofus kamas

Dofus kamas par telephone sur dofus kamas

Dofus kamas audiotel sur dofus kamas

http://www.virstock.com/jsp/comments.jsp dofus kamas vente

http://www.virstock.com

Anonymous said...

ed hardy outlet The Ghd hair straightener has cheap vibram 5 fingers been created to meet the demands of any woman no matter what the length of their hair. discount vibram five fingerBeing female may have many perks but there are also the downsides too and that contains keeping your hair looking and feeling great whilst still
vibram running shoes keeping up with the latest fashion trends. For this season that means luster straight looking hair and the use of a ceramic flat hair iron. The GHD GHD hair straightener is one of the best ghd straighteners for this.
vibram five fingers outlet Not only does the GHD GHD hair straightener allow you to achieve excellent hairstyles but it also helps to protect your hair too. Whether your hair is long or short the GHD GHD hair straightener can meet all your demands. Applying state of the art technology this ceramic flat hair iron really is every woman's number one option and is also the favorite among celebrities including Jennifer Aniston.
vibram five fingers outlet How the GHD GHD Hair Straightener Works moncler jackets For any women out there who has Sexy Lingerie ever purchased or applied a ceramic hair straightening iron you will be amazing at how easy the ghd hair straighteners sexy Underwear make styling your hair. women's underwear This ceramic flat hair iron comes with so excellent features and also guarantees to minimize hair damage.Nike Shox R4
Unlike the ordinary ceramic hair straightening iron the GHD flat iron comes with ultra smooth plates Shox shoes that straighten your hair without pulling or breaking your hair in the process.
ugg boots The GHD flat iron applies GHD on its plates to generate negative ions that straighten the hair and eliminate frizz in the process. ed hardy wholesale Applying negative ions also helps to add more shine to your hair and speeds up the straightening process.discount ed hardy wholesale The use of infra red heat technology in this cheap ed hardy wholesale ceramic ghd hair straighteners help to seal in the hairs moisture almost eliminating any possible hair damage.
wholesale ed hardy

Anonymous said...

Watch company replica IWC Schaffhausen celebrates the man known as Saint-Ex with a special edition.
watches replica
replica watches
replica watch
Fake watches
Men’s watcheshes
IWC
replica IWC
IWC replica
replica IWC watch
replica IWC watches
IWC Aquatimer
iwc big pilot
IWC Da Vinci
IWC Vintage collection
IWC Portofino
IWC Portuguese
replica IWC Aquatimer
replica IWC Da Vinci
replica IWC Portofino

combattery84 said...

ACER aspire 5560 battery
ACER BATBL50L6 battery
ACER TravelMate 240 Battery
ACER BT.00803.004 Battery
ACER Travelmate 4002lmi battery
Acer travelmate 800 battery
Acer aspire 3613wlmi battery
Travelmate 2414wlmi battery
Acer batcl50l battery
Acer Travelmate 2300 battery
ACER aspire 3610 battery
ACER travelmate 4600 battery
Dell Latitude D800 battery
Dell Inspiron 600m battery
Dell Inspiron 8100 Battery
Dell Y9943 battery
Dell Inspiron 1521 battery
Dell Inspiron 510m battery
Dell Latitude D500 battery
Dell Latitude D520 battery
Dell GD761 battery
Dell NF343 battery
Dell D5318 battery
Dell G5260 battery
Dell Inspiron 9200 battery
Dell Latitude C500 battery
Dell HD438 Battery
Dell GK479 battery
Dell PC764 battery

Anonymous said...

Along with the superior uggs classic cardy outlet chronograph, the design ensures complete comfort and durability for its wearer. The bracelet sets it apart from regular watches making it a star performer amongst all the ugg clearance luxurious watches of Rolex. Its precision and beauty have become stuff of legends like Jack Nicklaus’s golfing style. nice and cheap ugg boots “Life”, Edward Norton famously quotes “shouldn’t be avoided, it should be faced”. Who else can deliver a punch line like that but a man who is known for his humility and his perseverance in the eye of a storm?