📄 serv-u "mdtm"命令远程溢出分析.mht
字号:
=
src=3D"http://25.20.176.12/bbs/images/medal/piaoliang8.gif">=20
<BR></TD></TR>
<TR>
<TD class=3Drow><IMG height=3D11=20
=
src=3D"http://25.20.176.12/bbs/images/default/ball.gif"=20
width=3D10> =D0=D4=B1=F0: <FONT =
color=3Dred>=C4=D0<IMG title=3D=D0=D4=B1=F0=A3=BA=C4=D0=20
=
src=3D"http://25.20.176.12/bbs/images/default/male.gif">=20
</FONT><!--(=B7=A2=CC=F9:<font =
color=3D"red">704</font>=C6=AA)--></TD></TR>
<TR>
<TD class=3Drow title=3D"=BB=FD=B7=D6:0 =
=B7=D6<br>=B7=A2=CC=F9:704 =C6=AA"><IMG height=3D11=20
=
src=3D"http://25.20.176.12/bbs/images/default/ball.gif"=20
width=3D10> =BB=FD=B7=D6: <FONT =
color=3Dred>0</FONT>=B7=D6<!--(=B7=A2=CC=F9:<font =
color=3D"red">704</font>=C6=AA)--></TD></TR>
<TR>
<TD class=3Drow =
title=3D"=BE=AB=BB=AA=D6=B8=CA=FD:0 =B7=D6<br>=B7=A2=CC=F9:704 =
=C6=AA"><IMG=20
height=3D11=20
=
src=3D"http://25.20.176.12/bbs/images/default/ball.gif"=20
width=3D10> =B7=A2=CC=F9: <FONT =
color=3Dred>704</FONT>=C6=AA</TD></TR>
<TR>
<TD class=3Drow=20
=
title=3D"=B2=C6=B8=BB:8135+0<br>=CF=D6=BD=F0:8135<br>=B4=E6=BF=EE:0<br>=D3=
=F1=C2=A5=D2=F8=BA=A3"><IMG=20
height=3D11=20
=
src=3D"http://25.20.176.12/bbs/images/default/ball.gif"=20
width=3D10> =B2=C6=B8=BB: <FONT =
color=3Dred>8135</FONT> =BD=F0=B1=D2</TD></TR>
<TR>
<TD class=3Drow=20
title=3D"=B1=E0=BA=C5: =
<b>717</b></br>=C0=B4=D7=D4:<br>=D7=A2=B2=E1: 2003-12-22"><IMG=20
height=3D11=20
=
src=3D"http://25.20.176.12/bbs/images/default/ball.gif"=20
width=3D10> =B1=E0=BA=C5: =A1=ED717<IMG =
title=3D"=D7=B4=CC=AC =C0=EB=CF=DF"=20
=
src=3D"http://25.20.176.12/bbs/images/default/offline_user.gif"=20
align=3DabsMiddle> =
</TD></TR></TBODY></TABLE></TD>
<TD height=3D"100%">
<TABLE style=3D"TABLE-LAYOUT: fixed; WORD-WRAP: =
break-word"=20
height=3D"100%" cellSpacing=3D0 cellPadding=3D0 =
width=3D"100%"=20
border=3D0>
<TBODY>
<TR>
<TD vAlign=3Dtop><SPAN class=3Dbold><SPAN=20
class=3Dsmalltxt>Serv-U=20
=
&quot;MDTM&quot;=C3=FC=C1=EE=D4=B6=B3=CC=D2=E7=B3=F6=B7=D6=CE=F6<=
BR><BR></SPAN></SPAN><BR>Serv-U=20
=
"MDTM"=C3=FC=C1=EE=D4=B6=B3=CC=D2=E7=B3=F6=B7=D6=CE=F6<BR> =
=20
=
=20
=
=20
czy =D3=DA =
04.02.29<BR> =20
=
2=D4=C227=BA=C5=D2=BB=D4=E7=D4=DAsecurityfocus=BF=B4=B5=BD=C1=CB=D5=E2=B8=
=F6=C2=A9=B6=B4=B5=C4=B9=AB=B8=E6=A3=AC=C9=CF=C3=E6=C7=E5=B3=FE=B5=C4=CB=B5=
=C3=F7=C1=CBYou must=20
have a <BR>valid user account and password to =
exploit=20
it, and you are not need WRITE or any other=20
=
privilege.<BR>=D5=E2=B2=BB=CA=C7=B1=C8=C9=CF=B4=CEServ-U=C4=C7=B8=F6site =
=
chmod=B5=C4=B6=B4=B6=B4=BB=B9=C0=FB=BA=A6=A3=AC=D2=BB=CF=EB=B5=BD=B2=BB=C9=
=D9=B5=E7=D3=B0=CD=F8=D5=BE=B6=BC=CA=C7=D3=C3=B5=C4Serv-U....<BR> =
=20
=
=BA=C3=B2=BB=D4=DA=D5=E2=B6=F9=B7=CF=BB=B0=C1=CB=D2=D4=CF=C2=B7=D6=CE=F6=BB=
=F9=D3=DAServ-U Server=20
=
4.0.0=B0=E6=A3=AC=D6=BB=B7=D6=CE=F6"MDTM"=C3=FC=C1=EE=D2=E7=B3=F6=B5=C4=C7=
=E9=BF=F6=A1=A3<BR> =20
=
=CA=C2=CA=B5=C9=CF=A3=ACServ-U=D4=DA=B4=A6=C0=EDMDTM=C3=FC=C1=EE=CA=B1=A3=
=AC=BA=DC=B6=E0=B5=D8=B7=BD=B6=BC=D3=D0=B3=A4=B6=C8=C5=D0=B6=CF=A3=AC=B5=AB=
=CA=C7=A3=AC=D3=D0=D2=BB=B8=F6=B5=D8=B7=BD=CB=FB=D2=C5=C2=A9=C1=CB=A3=AC=C4=
=C7=C3=B4=A3=AC=CE=D2=C3=C7=B5=C4=BB=FA=BB=E1=BE=CD=C0=B4=C1=CB:-)<BR><BR=
>=C2=A9=B6=B4=BA=AF=CA=FD=D2=FD=D3=C3=B9=D8=CF=B5=C8=E7=CF=C2=A3=BA<BR><B=
R>loc_434748=20
[0]<BR>|<BR>call loc_41FAE8=20
[1]<BR>|<BR>|__call =20
sub_59BFB8(strncpy)<BR>|__call =20
sub_4422A4<BR> =20
|<BR> =
=20
|__ jmp =
sub_41FBB6=20
[2]<BR> =
=20
|<BR> =
=20
=20
|__call =20
sub_59BEB1<BR> =20
=20
|__call =20
sub_59BDA4(strlen) =
=20
<BR> =
=20
|__call =
=20
=
sub_59BFB8(strncpy)\__=B7=D6=B1=F0=B5=F7=D3=C3=C1=CB=C1=F9=B4=CE,=D3=C3=C0=
=B4=B0=D1=C4=EA=D4=C2=C8=D5=CA=B1=B7=D6=C3=EB=B7=C5=B5=BD=B1=E4=C1=BF=D6=D0=
<BR> =20
=
=20
|__call =
sub_5A4008 =20
/<BR> =
=20
=
=20
...........<BR> =
=20
=
=20
|__loc_41FD99[3]<BR> =20
=
=20
=20
|__loc_41FDC3(strcpy) [4] =
=B6=B4=B6=B4=B3=F6=C0=B4=C0=B2,=B8=B2=B8=C7=B3=CC=D0=F2=D7=D4=C9=ED=D2=EC=
=B3=A3=B4=A6=C0=ED=BA=AF=CA=FD=B5=D8=D6=B7<BR> =20
=
=20
=
=20
|__loc_41FE16<BR> =
=20
=
=20
=
=20
|__loc_41FE30 [5]<BR> =20
=
=20
=
=20
=
|<BR> =20
=
=20
=
=20
=20
|__call =
sub_59BDA4(strlen) =20
<BR> =
=20
=
=20
=
=20
|__call =20
sub_59BC1C(strncpy)=20
=
=B4=A5=B7=A2=B3=CC=D0=F2=D2=EC=B3=A3=B4=A6=C0=ED<BR><BR><BR>[0]=C5=D0=B6=CF=
=CA=C7=B7=F1=CA=C7"MDTM"=C3=FC=C1=EE<BR><BR>loc_434748: =20
=
=20
=
=20
; CODE XREF:=20
.text:0043473A<BR>.text:00434748 =
=20
=20
push 4 =
=20
=
=20
=
//=B1=C8=BD=CF=CB=C4=B8=F6=D7=D6=BD=DA<BR>.text:0043474=
A =20
=
=20
push edi =20
=
=20
=20
=
//edi=B4=E6=B7=C5=C3=FC=C1=EE=D7=D6=B4=AE=B5=C4=CA=D7=B5=D8=D6=B7<B=
R>.text:0043474B =20
=
=20
lea =
eax,=20
[esi+354h]<BR>.text:00434751 =20
=20
push eax =20
=
=20
// =
=B5=C3=B5=BD=C3=FC=C1=EE=C1=D0=B1=ED<BR>.text:00434752 =20
=
=20
call near ptr=20
unk_59C008 //=20
=
=CF=E0=B5=B1=D3=DAStrncmp<BR>.text:00434757 =20
=20
add =
esp,=20
0Ch<BR>.text:0043475A =
=20
=
test =20
eax, eax<BR>.text:0043475C =
=20
=20
jnz =
short=20
loc_43476D =20
=
//=B2=BB=CA=C7MDTM=B5=C4=BB=B0=B1=C8=BD=CF=CF=C2=D2=BB=B8=
=F6=C3=FC=C1=EESITE<BR>.text:0043475E =20
=
=20
push edi =20
=
=20
=20
=
//=B5=DA=B6=FE=B8=F6=B2=CE=CA=FD=CA=C7=C3=FC=C1=EE=D7=D6=B4=AE=B5=C4=
=CA=D7=B5=D8=D6=B7<BR>.text:0043475F =20
=
=20
push =20
ebx<BR>.text:00434760 =
=20
=
call =20
loc_41FAE8 =
=20
=
//=CF=E0=CD=AC=B5=C4=BB=B0=CC=F8=B5=BDMDTM=C3=FC=C1=EE=B4=
=A6=C0=ED=BA=AF=CA=FD<BR>.text:00434765 =20
=
=20
add =
esp,=20
8<BR>.text:00434768 =
=20
=
jmp =20
loc_434AC7 =20
<BR><BR><BR>[1]=20
=
=BE=DF=CC=E5=B4=A6=C0=EDMDTM=C3=FC=C1=EE=BA=AF=CA=FD<BR><BR>.text:0041FAE=
8 sub_41FAE8 =20
proc near =20
; =
CODE=20
XREF: sub_434244+51C=19p<BR>.text:0041FAE8 =
=
=20
push =20
ebp<BR>.text:0041FAE9 =
=20
=
mov =20
ebp, =
esp<BR>.text:0041FAEB =20
=
=20
add =
⌨️ 快捷键说明
复制代码
Ctrl + C
搜索代码
Ctrl + F
全屏模式
F11
切换主题
Ctrl + Shift + D
显示快捷键
?
增大字号
Ctrl + =
减小字号
Ctrl + -