IncrediMail (ImShExtU.dll) ActiveX Memory Corruption

Download

Exploit Code : 


| __ __
|
| _________ ________ / /___ _____ / /____ ____ _____ ___
|
| / ___/ __ \/ ___/ _ \/ / __ `/ __ \ / __/ _ \/ __ `/ __ `__ \
|
| / /__/ /_/ / / / __/ / /_/ / / / / / /_/ __/ /_/ / / / / / /
|
| \___/\____/_/ \___/_/\__,_/_/ /_/ \__/\___/\__,_/_/ /_/ /_/
|
|
|
| http://www.corelan.be:8800
|
| security@corelan.be
|
|
|
|-------------------------------------------------[ EIP Hunters
]--|

# Software : Incredimail (ImShExtU.dll)
# Reference :
http://www.corelan.be:8800/advisories.php?id=CORELAN-10-038
# Author : Lincoln
# OS : Windows
# Tested on : XP SP3 En (VirtualBox)
# Type of vuln : SEH
# Greetz to : Corelan Security Team
# http://www.corelan.be:8800/index.php/security/corelan-team-members/
#
# Script provided 'as is', without any warranty.
# Use for educational purposes only.
# Do not use this code to do anything illegal !
#
# Note : you are not allowed to edit/modify this code.
# If you do, Corelan cannot be held responsible for any damages this may
cause.
#
#0013F1A4 41414141 AAAA
#0013F1A8 41414141 AAAA
#0013F1AC 41414141 AAAA Pointer to next SEH record
#0013F1B0 41414141 AAAA SE handler
#0013F1B4 41414141 AAAA
#0013F1B8 41414141 AAAA
#
-->



IncrediMail ImShExtU.dll ActiveX Memory Corruption