Full Disclosure mailing list archives
Re: MS06-0[0]6 Windows Media Player Exploitation [CODE]
From: Matthew Murphy <mattmurphy () kc rr com>
Date: Fri, 17 Feb 2006 02:05:58 -0600
-----BEGIN PGP SIGNED MESSAGE----- Hash: RIPEMD160 H D Moore wrote:
Got it working finally :-) The alpha shellcode stuff is actually Skylined's (ported to perl), the non-alpha prefix is only used if you dont pass GETPCTYPE=win32 for PexAlphaNum or GETPCTYPE=seh for Alpha2. I am using an address in wmp.dll (v9) and tested it successfully on Firefox and Opera. Time to start porting to v10 and have it auto-detect the WMP version. Keep your SRC path less than 4K or you end up smashing the PEB's module list pointers (at least with Firefox)...
Interesting issue with regards to the module-list pointers. Because I didn't have any tools for the alpha-numeric shellcode generation part of this at my disposal, I went about it a different way, also stealing, er... borrowing one of Skylined's techniques. I set out to use the heap spray technique that has been perfected with Internet Exploiter. If I'd known it would require *_16 megabytes of nops_* to get a stable address, I would probably have done it a *little* differently. The heap spray technique works very effectively -- you end up with a *sizable* pad in the 0x04a00000 region which you can use as a direct jump point for the payload, without any of the fancy frame manipulation tricks that I am too tired to try at this hour of the night/morning. On my laptop (with 1.25GB of RAM) this works in a flash. Literally. You view the page, get your admin account added and FF dies. Given that, I'm seriously questioning the "Important" rating here. FF installs with WMP support by default, and this vulnerability is a classic "click and you're screwed" scenario. For a supposedly non-critical vulnerability, the ease with which I developed such an exploit is absolutely shocking -- it took about two hours work. This should also be (theoretically) version-independent. Thanks to the similarities of the heap management APIs and the fact that most DLLs from MS use high bases, I'd bet money that this works across WMP versions on anything from NT 4.0 to 2003. It's likely, as well, that this one technique works on any script-enabled browser that supports the plugin with the same results. Anyway... the payload is to create a new administrative account. You'll see the command prompt flicker on screen. If this owns you, log in as wmp0wn3d/password. Yeah, it's cheesy... but I'm tired and this is a lousy sploit anyway by my standards. 'Nuff teasing. Code attached. It is important to note that you should read the inline disclaimer *BEFORE* using the code. - -- "Social Darwinism: Try to make something idiot-proof, nature will provide you with a better idiot." -- Michael Holstein -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.2 (MingW32) Comment: http://pgp.mit.edu:11371/pks/lookup?op=get&search=0xB5444D38 iD8DBQFD9YPmfp4vUrVETTgRA4ktAKClyUpgw+OEH/nsef1ftPL7zgQc7QCeNNQf fw588yDx223uAkoyCwtINDM= =6VUm -----END PGP SIGNATURE-----
-----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.2 (MingW32) iD8DBQBD9YLofp4vUrVETTgRAtfnAKCB6pVYTau8xAF7CPJOZ3auJZCDEACfWMca yOEXYiLeH58W27M90tqqWXU= =NMQo -----END PGP SIGNATURE-----
Attachment:
smime.p7s
Description: S/MIME Cryptographic Signature
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- MS06-06 Windows Media Player Exploitation c0ntex (Feb 16)
- Re: MS06-06 Windows Media Player Exploitation ad () heapoverflow com (Feb 16)
- Re: MS06-06 Windows Media Player Exploitation ad () heapoverflow com (Feb 16)
- Re: MS06-06 Windows Media Player Exploitation H D Moore (Feb 16)
- Re: MS06-06 Windows Media Player Exploitation c0ntex (Feb 16)
- Re: MS06-06 Windows Media Player Exploitation H D Moore (Feb 16)
- Re: MS06-0[0]6 Windows Media Player Exploitation [CODE] Matthew Murphy (Feb 17)
- Re: MS06-0[0]6 Windows Media Player Exploitation [CODE] H D Moore (Feb 17)
- Re: MS06-0[0]6 Windows Media Player Exploitation [CODE] H D Moore (Feb 17)
- Re: MS06-06 Windows Media Player Exploitation c0ntex (Feb 17)
- Re: MS06-06 Windows Media Player Exploitation c0ntex (Feb 17)
- Re: MS06-06 Windows Media Player Exploitation c0ntex (Feb 16)
- Re: MS06-06 Windows Media Player Exploitation ad () heapoverflow com (Feb 16)