2008年7月20日星期日

[Tips]暴风影音2008Beta1 最新远程溢出 0day 分析

by dummy
http://2008-07-20
http://www.ph4nt0m.org

已近将此漏洞报给暴风.

声明:纯技术研究,禁止将本文相关代码非法用途!后果自负!

下载地址: http://dl.baofeng.com/storm3/storm2008-beta1.exe

一、漏洞分析

今天下午帮同事查找一个软件和新版本暴风兼容性的问题,发现其新增了新的模块,回来就试了一下,运气真好被我到一个远程溢出。

问题模块是暴风的视频加速程序,暴风的视频加速功能是通过设置浏览器代理实现的,这个代理服务器(HttpServer.dll)会在本机开 8089 端口监听处理请求,因为此端口绑定的地址不是localhost, 从而导致此溢出可以被远程利用。

使用 od 打开暴风安装目录下的 box/Stline.exe,这个程序记视频加速模块的主程序文件,按下 F9 让 Stline.exe 跑起来,然后打开 IE 在地址栏中输入 http://baidu.com/111...11.flv (长度必须大于1000) 回车。Od 在 stormtra.dll因为异常暂停下来,如下图:


Ebx = 堆栈的栈顶,dx 是我们输入的 1, 把堆栈窗口拉到最高处,看到堆栈中填满了我们的输入的 URL 拷贝。使用 ida 打开这个 stormtra.dll 进行上下文分析,如下图:



发生异常的函数是在 unknown_libname_98 里,而 unknown_libname_98是 _vscan_fn 的回调,通过sub_1003AE2C 参数判断这个是正则表达式 search 函数,溢出正是在这个函数里面发生,具体为什么这个 search 过程发生溢出暂时可以不用管。

然后在 od 中 shift+f8 忽略异常,接着od 再次断下,如下图,这时eip = 0x00310031, 这是因为溢出后,操作系统从堆栈取异常处理函数,但是堆栈中被填满了我们的输入。



到这里已近可以看到我们的输入成功控制了 eip,那我们离成功也更进了一步了。

二、编写 shellcode

在 od 中注意我们的输入显示的 unicode 串,以前没有搞过此类的溢出,只知道比 ascii 麻烦很多,请教了123 大牛,他给我了一个同类溢出程序的 webdav (参考四),试着改了一下,但是不打算继续放相关代码了,有兴趣自己调吧:)。

四、参考资料

Webdav 远程溢出漏洞分析http://www.xfocus.net/articles/200303/500.html

56 条评论:

Donald Trump 说...

Maxatron Plus Being a post graduate in management and having an affinity towards the English language has made him a content writer who is particular about delivering quality contents to his readers.

keven peterson 说...

Bionatrol Pro Enhance Viagra, Cialis and Levitra, and surgery like implantation of devices, neurosurgery and vacuum constriction.

Donald Trump 说...

Ryzex Male Enhancement Since they also do not have any prescription requirements, the question on side effects may not also be satisfactorily addressed in the views of certain individuals.

Jhon wick 说...

Keto Gedeon If that is the case then you might be a little heavy around the waist. The easy thing to do is to blame it on those who were in charge of your upbringing, however, you ALWAYS have a choice to change.

Donald Trump 说...

Super Fast Keto Boost keeping a note of your targets, changes in weight and achievements to help you keep on track. Whilst you may not see any immediate changes, stick with it. Don't let any weight gain put you off,

Maxwell 说...

Keto Trim 800 keeping a note of your targets, changes in weight and achievements to help you keep on track. Whilst you may not see any immediate changes, stick with it. Don't let any weight gain put you off,

Donald Trump 说...

Ultragenik Keto A lot of people want to lose weight in the quickest way possible and are often fascinated when they use a weight loss product or service that produces a rapid weight loss in the first few days or weeks. While it

Jhon wick 说...

Evianne Cream Most of these revolutionary creams include antioxidants and other breakthrough ingredients that combat these undesirable visible signs of skin aging.

Donald Trump 说...

Spartan Keto your food well. By chewing your food well, you eat slowly. This is because, once you have take in some food, it takes 20 minutes to signal your brain of the feelings of fullness. Thus, if you eat

Donald Trump 说...

Ultimate Keto Boost Remember that muscles are heavier than fats, thus, weight gain does not necessary follow that you are getting fatter - it could be that you are getting leaner. Above all, always be honest to yourself if you really have gained some pounds due to fats or due to muscles.

Donald Trump 说...

Fusion Rise Keto The second issue that triggers oral cravings and appetite is the fact that eating food provides temporary relaxation and pleasure.

Donald Trump 说...

Optimal Rock
The subject of male enhancement isn't something which many males are more comfortable talking about

keven peterson 说...

Zydenafil Just as there are a wide variety of male enhancement options there are equally diverse opinions on whether male enhancement is useful. Regardless of opinion it is indisputable that society is increasingly consuming products that

Enna Williams 说...

Botanica Pure Keto , the bathroom scale tends to be much slower than when glycogen was being burnt for energy at the beginning of the diet.

Maxwell 说...

Boost Xtra number of males showing their curiosity about male enhancement products is growing daily. Many males are even coming forward and test out the various penile enhancement items and methods. Every one of them has his own reasons behind opting for penile enhancement methods

Enna Williams 说...

EverStrong XT CBD will find numerous male enhancement items available for sale. The manufacturers of these items make ample offers to

Wiktor Wilkins 说...

SlimPhoria Keto on what you are realistically willing and able to commit to with regard to each of these factors. Let's face it, purchasing a weight

Wiktor Wilkins 说...

Viaxxl Male Enhancement scale clinical trials performed in men have shown that maca extracts can heighten libido and improve semen quality

Donald Trump 说...

BioRexin Male Enhancement enhancement pills, penis enlargement pills and pills targeted to increase libido. Most of these products share several common traits including: made from natural ingredients, available without a prescription, improve sexual desire and require regular use for maximum effect.

Enna Williams 说...

Bluoxyn The best male enhancement forum must provide you with the information that every man must know- from the price to the effectiveness of the male enhancement treatments.

Enna Williams 说...

Trubodx Keto Male enhancement videos are found scattered all over the internet. However, there are only a number that really demonstrate the right and effective ways to achieve male enhancement. Some show how to

Glain Crous 说...

Bluoxyn Have you ever thought about taking male enhancers to liven up your sex life. Many men ask themselves, should I take male enhancement pills? There is no short answer to that question, but most men have reason to say yes.

Glain Crous 说...

Celaxryn RX Erectile Dysfunction sufferers. What makes male enhancement pills and products so effective? The specially formulated ingredients of male enhancers and their consistent effects

Danny Moreson 说...

Flash Keto not only lose fat tissue, we also lose muscle tissue. If we are not exercising, and we severely limit our food intake in order to lose weight quickly, the amount of muscle tissue that is destroyed increases dramatically. Using a fad fast weight loss diet, or one of the many weight loss pills often bring on this effect.

Danny Moreson 说...

CountDown Keto to improve bowel function. The main advantages of the use of Triphala tea: tea with Triphala helps cleanse the digestive tract, nourishes and rejuvenates the tissues of the body, ensures good digestion, improves blood circulation, and helps to cleanse the whole

Danny Moreson 说...

New You Keto in is one you will participate in, be challenged by and finish. I can name at least a hundred weight loss programs off the top of my head that have produced amazing results for their participants.

Danny Moreson 说...

weight loss, breast size and shape often change significantly in both men and women. Everyone worries about sagging breasts as we age but few know that massive weight loss greatly accelerates the process. As women advance from girls to teens to twenties and into their later years, the glandular portion of breasts is replaced by fat. The original glandular tissue is significantly more firm than fat and consequently the skin becomes unable to retract Keto Crush

Glain Crous 说...

Keto Boost weight loss.

When choosing the program or the trainer, make sure the staff consists of qualified fitness professionals and health professionals

Glain Crous 说...

Luxe Trim 1 Just about everyone experiences weight loss plateaus. If you have no idea what I'm talking about and are able to reach single-digit body fat percentages with complete ease, count yourself lucky. It's very common for people to hit several plateaus on their journeys to a six pack because, well, the human body is just stubborn when it comes to shedding fat.

Glain Crous 说...

Prime X Factor The fat present in the lower body, for example in the thighs, buttocks and hips, is different than in the abdomen. Females tend to put on weight in their lower part of the body while males tend

Ben Stokes 说...

Viril XL AlphaMAX Pro Sexual Arousal & Release With Natural Male Enhancement

One of the key amenities of any natural male enhancement product is that they enhance sex in men; which also means that they make sex better for both parties involved. The powerful sexual nutrients go to work to increase your pleasure, sex drive and sexual appetite.

Danny Moreson 说...

Slimphoria Keto If your goal is to lose some weight quickly, then pick one and follow it. I guarantee you will lose some weight.

Glain Crous 说...

BioNatrol Keto Burn I of your health. It could be with making money, looking for a new job, or in your relationships. Creating a new habit takes time because our brain's do not like change. Change to the brain is "

Danny Moreson 说...

Nutriverse Keto put into you body are extremely important when it comes to the success of your healthy weight loss and quick weight loss journey. In fact, fluid intake is critical upon the success or failure of your healthy weight loss and quick weight loss endeavor.

Glain Crous 说...

Al Roker Weight Loss if that's what you want - great. But if you really want an entire hour long personal training session with a trainer to cover nutrition, diet and stretching, for example, be sure that what you are being sold is a full hour; not just a half hour session.

Glain Crous 说...

Bluoxyn The penis stretcher is known as one of the best male enhancer as it will increase the length and girth of your penis in a certain time period if used as instructed.

Danny Moreson 说...

Free Cell Keto
Be it going for a walk, running, swimming, biking, hiking, or any other physical activity you like to do start

Danny Moreson 说...

KGX Keto wedding I went to for 200 people there were 5 large tables of all-you-can-eat food and all-you-can-drink free alcohol. Way over the handfuls of food we should be eating. Christmas time is always a gutbuster, and Easter and Halloween are candy-based foods. Gluttony is en vogue

Danny Moreson 说...

Viaxin
Because of the exaggerated claims, many men feel inferior and opt for male enhancement and they go on to check out too many male enhancement items and methods.

Peterson Martin 说...

Meta Keto Boost Equally, be it a conventional diet, a fad diet, or a diet pill, the early rapid bodyweight reduction effect mostly likely

Jhony Sanger 说...

True Keto Boost A few specialists trust health food nuts have better control on the off chance that they eat a few smaller than expected suppers for the duration of the day. Exercise and an adjusted eating regimen are the key considers fat misfortune and weight decrease.

Keven Robert 说...

Nutriverse Keto Therefore, since fat contains only about 10-40% water, when the body moves into the fat burning phase of a weight loss program, the bathroom scale tends

Jhony Sanger 说...

Viacen Male Enhancement users upload male enhancement pills ads and demos. The content of these videos are usually based on popular pills and sexual enhancement supplements, or exercises to help enlarge or enhance the penis. There are penis pumps, homemade extenders, doctor-made extenders, and penis enlargement reviews from men who have tried using or applying them.

Keven Robert 说...

Trainee Keto that they are board certified you must RUN! For everyone who has heard horror plastic surgery stories, this is probably where it started, having a surgical procedure done without a board certified surgeon. Use ASPS (The American Society of Plastic Surgery) to find a board certified surgeon near you.

Glain Crous 说...

Empowered Boost The best male enhancement forum must provide you with the information that every man must know- from the price to the effectiveness of the male enhancement treatments.

Charlie Louis 说...

Eclipse Keto shows that people who skip breakfast actually have increased body weight. The reason is that skipping breakfast typically leads to higher calorie and fat intake with the evening meal. Therefore, to burn fat and get your body off to a good start, eat a breakfast of egg whites, whole grain toast, oatmeal, and/or fresh fruit.

Shane Ronky 说...

Thunder Testosterone If one is not keen on painful and expensive penis surgery (Phalloplasty), fear not as there is a far easier way to enhance your penis and performance. The best natural male enhancers come in the form of

Chriss Lain 说...

Most women will tell you it doesn't matter and that they enjoy lovemaking whether you use the male enhancement products or not, but think about it, what would you say to her if the roles were reversed? Instahard

Peterson Martin 说...

Thin Zone Ketodiet and fat burning exercises. For each pound that you want to lose, you'll need to have a net loss of 3,500 calories. The most effective method is to use a diet and exercise regimen that maximizes the number

Michale Clark 说...

Ultra X Prime To date there are NO male enhancement pills whether prescription, non-prescription, or natural herbal male enhancement pills that work 100% of the time for everyone

Danny Moreson 说...

Raging Leo That question is what you must ask yourself, as a man and a sexual being. Often, there are other things to try before taking any natural male sex enhancement pills. Be sure that your diet is not in conflict with your sexual activities

Danny Moreson 说...

Cylophin RX controversies, naturally, is regarding whether or not the products designed for male enhancement work. sexual hormones like

Danny Moreson 说...

Number One Keto Do you feel like everyone is noticing that "KEG" instead of a 6-Pack abs wherever you go? You are not alone in this struggle. Millions of people throughout the world are struggling with the same issue but only a few knows what to do to burn the fat and feed the muscles.

Charlie Louis 说...

Keto Shred Biotic Immunity Booster While sweet potato isn't a grain, it is healthier for you as opposed to white potatoes. Add some butter and cinnamon for a flavorful fat burning food.

Shane Ronky 说...

PuriGlow Cream Words like moisturizes, lanolin and collagen, or the clinchers, "reduces wrinkles" and "prevents aging", are tossed about - easily mistaken for promises - without the consumer really having the slightest clue what any of it means. The people who

Keven Robert 说...

Fresh Prime Keto Two handful of nuts a day (about 24 of them) is a great way to eat to keep you full, a good source of Vitamin E, helps keep your heart healthy, and also packed with protein and magnesium to help build muscle