e-mail: Sam#vsecurity.com.cn, Sam#0x557.org
作者单位: 启明星辰积极防御实验室
http://vsecurity.com.cn
http://0x557.org

分析工具:
windbg 6.3
IDA adv 4.6 sp1

测试环境:

Windows Server SP4 cn + iis 5.0

废话:
自从上周微软安全公告发布了4个补丁以来, 我们就一直关注着这几个漏洞, 从fd的讨论上说, 这4个补丁一共补了将近20个漏洞, 而且光
MS04-11就补了14个漏洞,　其中有2个非常严重的漏洞, 看来M$还是很会打如意算盘. pct这个漏洞算是其中一个, 对于这个漏洞, M$几乎
是只字未提, 所以只好对照补丁来进行分析. 今天下午才看出一些dd, 没想到这么快就有人按捺不住, 往fd上面发exp了. :) ok言归正传.

分析:
PCT协议是Microsoft SSL库实现的, 在处理客户端请求的时候存在一个远程缓冲区溢出漏洞, 漏洞函数是 Pct1SrvHandleUniHello.

.text:78178601 ; __stdcall Pct1SrvHandleUniHello(x,x,x,x)
.text:78178601 _Pct1SrvHandleUniHello@16 proc near ; CODE XREF: Pct1ServerProtocolHandler(x,x,x)+188p
.text:78178601
.text:78178601 var_11C = dword ptr -11Ch
.text:78178601 var_DC = dword ptr -0DCh
.text:78178601 var_9C = dword ptr -9Ch
.text:78178601 var_88 = dword ptr -88h
.text:78178601 var_74 = dword ptr -74h
.text:78178601 var_70 = dword ptr -70h
.text:78178601 var_6C = dword ptr -6Ch
.text:78178601 var_68 = dword ptr -68h
.text:78178601 var_64 = dword ptr -64h
.text:78178601 var_60 = dword ptr -60h
.text:78178601 var_5C = dword ptr -5Ch
.text:78178601 var_54 = dword ptr -54h
.text:78178601 var_50 = dword ptr -50h
.text:78178601 var_4C = dword ptr -4Ch
.text:78178601 var_48 = dword ptr -48h
.text:78178601 var_24 = dword ptr -24h
.text:78178601 var_4 = dword ptr -4
.text:78178601 arg_0 = dword ptr 8
.text:78178601 arg_4 = dword ptr 0Ch
.text:78178601 arg_8 = dword ptr 10h
.text:78178601 arg_C = dword ptr 14h
.text:78178601
.text:78178601 push ebp
.text:78178602 mov ebp, esp
.text:78178604 sub esp, 11Ch
.text:7817860A xor eax, eax
.text:7817860C cmp [ebp+arg_0], eax
.text:7817860F jnz short loc_78178618
.text:78178611 or eax, 0FFFFFFFFh
.text:78178614
.text:78178614 locret_78178614: ; CODE XREF: Pct1SrvHandleUniHello(x,x,x,x)+119j
.text:78178614 leave //这里函数返回, 跳转到我们控制的区域
.text:78178615 retn 10h
.text:78178618 ; ???????????????????????????????????????????????????????????????????????????
.text:78178618
.text:78178618 loc_78178618: ; CODE XREF: Pct1SrvHandleUniHello(x,x,x,x)+Ej
.text:78178618 lea ecx, [ebp+var_11C]
.text:7817861E push edi
.text:7817861F mov [ebp+var_54], ecx
.text:78178622 lea ecx, [ebp+var_DC]
.text:78178628 push esi
.text:78178629 mov esi, [ebp+arg_8] //传入的数据, 第三个参数
.text:7817862C mov [ebp+var_50], ecx
.text:7817862F lea ecx, [ebp+var_9C]
.text:78178635 mov edx, [esi+4]
.text:78178638 mov [ebp+var_4C], ecx
.text:7817863B lea ecx, [ebp+var_88]
.text:78178641 cmp edx, eax
.text:78178643 push ebx
.text:78178644 mov [ebp+var_48], ecx
.text:78178647 mov [ebp+var_74], eax
.text:7817864A mov [ebp+var_70], eax
.text:7817864D mov [ebp+var_6C], eax
.text:78178650 mov [ebp+var_68], eax
.text:78178653 mov [ebp+var_4], eax
.text:78178656 jbe short loc_781786C8 //跳转
.text:78178658 lea ebx, [esi+54h]
.text:7817865B mov edi, 0FFFFh

//类似memcpy (buffer, src, 我们控制的大小);
所产生溢出.
.text:781786C8 loc_781786C8: ; CODE XREF: Pct1SrvHandleUniHello(x,x,x,x)+55j
.text:781786C8 ; Pct1SrvHandleUniHello(x,x,x,x)+63j
.text:781786C8 mov [ebp+var_60], eax
.text:781786CB mov eax, [esi+0Ch] //从传入的数据中取拷贝数值的大小
.text:781786CE mov ecx, eax
.text:781786D0 add esi, 30h //源地址
.text:781786D3 mov edx, ecx
.text:781786D5 lea edi, [ebp+var_24] //目标地址
.text:781786D8 shr ecx, 2
.text:781786DB rep movsd //4字节拷贝
.text:781786DD mov ecx, edx
.text:781786DF and ecx, 3
.text:781786E2 rep movsb //1字节拷贝
.text:781786E4 xor esi, esi
.text:781786E6 test eax, eax
.text:781786E8 jbe short loc_781786FC
.text:781786EA
.text:781786EA loc_781786EA: ; CODE XREF: Pct1SrvHandleUniHello(x,x,x,x)+F9j
.text:781786EA mov dl, byte ptr [ebp+esi+var_24] //取ebp+esi-0x24地址中内容的一个字节到dl
.text:781786EE lea ecx, [ebp+esi+var_24] //取ebp+esi-0x24的地址
.text:781786F2 inc esi //计数器加一
.text:781786F3 not dl // dl ^=0xff
.text:781786F5 cmp esi, eax //这里继续使用eax的值
.text:781786F7 mov [ecx+eax], dl //ecx + eax其实指向前面那次拷贝的末尾了, 然后继续做1字节的拷贝,

.text:781786FA jb short loc_781786EA

.text:781786FC loc_781786FC: ; CODE XREF: Pct1SrvHandleUniHello(x,x,x,x)+E7j
.text:781786FC push [ebp+arg_C]
.text:781786FF add eax, eax
.text:78178701 mov [ebp+var_5C], eax
.text:78178704 lea eax, [ebp+var_74]
.text:78178707 and [ebp+var_64], 0
.text:7817870B push eax
.text:7817870C push [ebp+arg_4]
.text:7817870F push [ebp+arg_0]
.text:78178712 call _Pct1SrvHandleClientHello@16 ; Pct1SrvHandleClientHello(x,x,x,x)
.text:78178717 pop ebx
.text:78178718 pop esi
.text:78178719 pop edi
.text:7817871A jmp locret_78178614 //跳转返回

不仔细看还真的很难发现这个漏洞, 实在佩服这个漏洞发现者的水平.