Microsoft Word Document Code Execution Proof of Concept

两阶段漏洞利用示例

最新推荐文章于 2025-12-13 09:35:05 发布

原创最新推荐文章于 2025-12-13 09:35:05 发布 · 967 阅读

0 ·

CC 4.0 BY-SA版权

文章标签：

#microsoft #crash #basic #file

本文提供了一个两阶段漏洞利用的实例，第一阶段模块迫使代码走向错误路径，第二阶段模块与第一阶段结合使用时会导致部分代码被覆盖。通过特定标记简化了观察过程，并使Word Viewer崩溃以更明显地展示效果。

=====
The file I have attached is a very basic two stage bug. stage 1 (the
first mod) forces the code down a wrong path. the second mod by
itsself is harmless, however when used with the first it will be the
first and part of the second overwrite.

I have use 41414141 as a marker to make it easier for you to see.

I have made it crash the wordviewer again to make it more obvious

Weight,
location: 00000274
value : 00000022 - just so it crashes, values 00000001 -> 00000006
are probably the most useful for trying to overwrite a pointer. notice
that neighbouring areas can be weighted the same.

marker,
location: 000027e4
value : 41414141

the weight destination address == ((weight * 4[this is EDI]) + 4 [ECX*4]) + source memory offest[ESI].

[also the meta data is microsofts, not mine]
======

bug hugs,

disco.