[+] Object Safety Report :
Report for Clsid: {7E864D3E-3E6A-48F0-88AF-CEAEE322F9FD}
RegKey Safe for Script: Faux
RegKey Safe for Init: Faux
Implements IObjectSafety: Vrai
IDisp Safe: Safe for untrusted: caller,data
IPStorage Safe: Safe for untrusted: caller,data
RegKey Safe for Script: Faux
RegkeySafe for Init: Faux
KillBitSet: Faux
The Proprieties (RemoteAddress,ProxyPrefix,ProxyName,Password,ProxyBypassList,LoginName,CurrentDirectory) suffers from Buffer Overflow when we pass long strings in fact :
1- RemoteAddress suffers from a BoF when we pass a string over 2068
2- ProxyPrefix suffers from a BoF when we pass a string over 1044
3- ProxyName suffers from a BoF when we pass a string over 1044
4- Password suffers from a BoF when we pass a string over 1044
5- ProxyBypassList suffers from a BoF when we pass a string over 1044
6- LoginName suffers from a BoF when we pass a string over 1044
7- CurrentDirectory suffers from a BoF when we pass a string over 1044
DisASM RemoteAddress Crash :
7C809EEC MOV AL,[EDX] (KERNEL32.dll)
7C809ED4 TEST EDX,EDX
7C809ED6 JE 7C80C858
7C809EDC LEA EDI,[EDX+EAX-1]
7C809EE0 CMP EDI,EDX
7C809EE2 JB 7C80C858
7C809EE8 AND DWORD PTR [EBP-4],0
7C809EEC MOV AL,[EDX] <--- CRASH
EBP+8 FEEEFEEE
Stack Dump:
13FC18 A7 F3 01 66 EE FE EE FE 04 00 00 00 02 00 00 00