CVE-2006-0564
Microsoft HTML Help Workshop 4.74.8702.0 - Stack-based Buffer Overflow via Long Contents File Field
Title source: llmExploitation Summary
EIP tracks 10 public exploits for CVE-2006-0564.
PoCs published by Metasploit, darkeagle, bratax, jduck, including Metasploit module exploits/windows/fileformat/hhw_hhp_contentfile_bof.
AI-analyzed exploit summary This Metasploit module exploits a stack buffer overflow in HTML Help Workshop 4.74 by crafting a malicious .hhp project file. It uses an egghunter technique to locate and execute the payload, achieving remote code execution.
Description
Stack-based buffer overflow in Microsoft HTML Help Workshop 4.74.8702.0, and possibly earlier versions, and as included in the Microsoft HTML Help 1.4 SDK, allows context-dependent attackers to execute arbitrary code via a .hhp file with a long Contents file field.
Exploits (10)
This Metasploit module exploits a stack buffer overflow in HTML Help Workshop 4.74 by crafting a malicious .hhp project file. It uses an egghunter technique to locate and execute the payload, achieving remote code execution.
This is a functional exploit for CVE-2006-0564, targeting a stack buffer overflow in HTML Help Workshop 4.74 via a crafted .hhp project file. It uses an egghunter technique to achieve remote code execution on Windows XP SP3.
This exploit leverages a stack overflow vulnerability in Windows HTML Help Workshop by crafting a malicious .hhp file with an oversized 'Index File' field. The payload includes shellcode and a hardcoded return address (0x77E859BA) to achieve arbitrary code execution.
This exploit leverages a buffer overflow vulnerability in the handling of compiled help files (.chm) to achieve remote code execution. The long string of 'a' characters followed by a Unicode 'UUUUr0x' sequence suggests a crafted payload to trigger the overflow.
This Perl script exploits a buffer overflow vulnerability in Microsoft HTML Workshop <= 4.74. It uses a custom shellhunter technique to locate and execute shellcode, demonstrating a reliable remote code execution (RCE) exploit.
This exploit targets a buffer overflow vulnerability in HTML Help Workshop 4.74 by crafting a malicious .hhp project file. It uses an egg-hunting technique to locate and execute shellcode, achieving remote code execution (RCE) by launching calc.exe.
This exploit demonstrates a buffer overflow in Microsoft HTML Help Workshop by crafting a malicious .hhp file with an oversized 'Compiled file' field. The payload includes NOP sleds, shellcode (spawning calc.exe), and a jump instruction to trigger arbitrary code execution.
This exploit leverages a buffer overflow in Microsoft HTML Help Workshop by crafting a malicious .hhp file with an oversized 'Contents file' field, overwriting EIP with a 'jmp esp' address and executing a bind shell payload on port 13579.
This Metasploit module exploits a stack buffer overflow in HTML Help Workshop 4.74 via a crafted .hhp file, using an egghunter to locate and execute the payload. It targets Windows XP SP3 with a specific return address to achieve remote code execution.
This Metasploit module exploits a stack buffer overflow in HTML Help Workshop 4.74 via a crafted .hhp file, allowing arbitrary code execution. It uses an egghunter technique to locate and execute the payload in memory.