OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
Exploit-Dev Archives: WordPad exploit development: executing ar

WordPad exploit development: executing arbitary code on Win98 (fin)

Subject: WordPad exploit development: executing arbitary code on Win98 (fin)
From: Pauli Ojanpera (pauli_ojanperaHOTMAIL.COM)
Date: Tue Nov 30 1999 - 13:17:59 CST

So I did further investigation as no one came up with ideas.

If the crashing tag is of type

\dummy-5342 (where -5342 is a numeric parameter for the tag)

and there is EOF immediately after the last number (2), we have
ECX = --5342 when the faulty function reaches its RET. I didn't
check if it works without negation.

So I supplied ECX with suitable value and jumped to location
4800525A which has this code:
MOV EAX, [ECX]
CALL [EAX+68]

I'm bad at explaining things. If somebody wants to do it be my guest.
Single step through the exploit... You can start at third occurence
of 48030D65 (RET from the faulty function).

The attached example file has extension .WRI even it is a .RTF file
so that on machines who have MSOffice installed still open the file
in WordPad.

The file has binary characters in it so you must edit it using a
hex editor..

I'm not responsible for the behavior or misbehavior of the attached
file.

______________________________________________________
Get Your Private, Free Email at http://www.hotmail.com

This archive was generated by hypermail 2b27 : Tue Nov 30 1999 - 23:30:04 CST