securityfirst_jo

CVE-2011-0222_WinXP_Exploit.7z

해외 블로그에서 구한 CVE이다. 아직 MSE, V3, 카스퍼스키 미진단이며 해당압축파일에는 두개의 파일로 되어있었으며

동작 구조는

ROP to bypass permanent DEP, Change spray range if not work on your machine.

이 특징이라고 한다.

MD5: 808333A719960F9369203EEAD8120513

Datarescue
Interactive Disassembler (IDA) Pro
Quick Reference Sheet
(http://www.datarescue.com)
Open Subviews

IDA_Pro_Shortcuts.pdf

--------------------------------------------------------------------------------------------------------
Names ___________________________________ Shift+F4
Functions ________________________________ Shift+F3
Strings __________________________________ Shift+F12
Segments _________________________________ Shift+F7
Segment registers ___________________________ Shift+F8
Signatures ________________________________ Shift+F5
Type libraries _____________________________ Shift+F11
Structures _________________________________ Shift+F9
Enumerations ____________________________ Shift+F10
Data Format Options
ASCII strings style ____________________________ Alt+A
Setup data types ______________________________ Alt+D
File Operations
Parse C header file ___________________________ Ctrl+F9
Create ASM file ____________________________ Alt+F10
Save database _______________________________ Ctrl+W
Navigation
Jump to operand ______________________________ Enter
Jump in new window _______________________ Alt+Enter
Jump to previous position ________________________ Esc
Jump to next position ______________________ Ctrl+Enter
Jump to address _________________________________ G
Jump by name _______________________________ Ctrl+L
Jump to function _____________________________ Ctrl+P
Jump to segment _____________________________ Ctrl+S
Jump to segment register ______________________ Ctrl+G
Jump to problem ____________________________ Ctrl+Q
Jump to cross reference _______________________ Ctrl+X
Jump to xref to operand ___________________________ X
Jump to entry point __________________________ Ctrl+E
Mark Position _______________________________ Alt+M
Jump to marked position ______________________ Ctrl+M
Debugger
Star process ____________________________________ F9
Terminate process ___________________________ Ctrl+F2
Step into ______________________________________ F7
Step over ______________________________________ F8
Run until return _____________________________ Ctrl+F7
Run to cursor ___________________________________ F4
Breakpoints
Breakpoint list ___________________________ Ctrl+Alt+B
Watches
Delete watch __________________________________ Del
Tracing
Stack trace ______________________________ Ctrl+Alt+S
Search
Next code __________________________________ Alt+C
Next data __________________________________ Ctrl+D
Next explored _______________________________Ctrl+A
Next unexplored ____________________________ Ctrl+U
Immediate value ______________________________ Alt+I
Next immediate value _________________________ Ctrl+I
Text ______________________________________ Alt+T
Next text __________________________________ Ctrl+T
Sequence of bytes ____________________________ Alt+B
Next sequence of bytes _______________________ Ctrl+B
Not function ________________________________ Alt+U
Next void __________________________________ Ctrl+V
Error operand ______________________________ Ctrl+F
Graphing
Flow chart ____________________________________ F12
Function calls _____________________________ Ctrl+F12
Miscellaneous
Calculator _____________________________ Shift+/
Cycle through open views ________________ Ctrl+Tab
Select tab _________________________ Alt + [1…N]
Close current view ______________________ Ctrl+F4
Exit ___________________________________ Alt+X
IDC Command ________________________ Shift+F2
Edit (Data Types – etc)
Copy ____________________________________ Ctrl+Ins
Begin selection _______________________________ Alt+L
Manual instruction __________________________ Alt+F2
Code __________________________________________ C
Data __________________________________________ D
Struct variable _______________________________ Alt+Q
ASCII string ____________________________________ A
Array ______________________________________ Num *
Undefine ______________________________________ U
Rename _______________________________________ N
Operand Type
Offset (data segment) _____________________________ O
Offset (current segment) ______________________ Ctrl+O
Offset by (any segment) ________________________ Alt+R
Offset (user-defined) __________________________ Ctrl+R
Offset (struct) ___________________________________ T
Number (default) ____________________________ Shift+3
Hexadecimal ____________________________________ Q
Decimal _______________________________________ H
Binary _________________________________________ B
Character ______________________________________ R
Segment _______________________________________ S
Enum member __________________________________ M
Stack variable ___________________________________ K
Change sign ________________________________ Shift+-
Bitwise negate ______________________________ Shift+`
Manual ____________________________________ Alt+F1
Comments
Enter comment ______________________________ Shift+;
Enter repeatable comment __________________________ ;
Enter anterior lines ______________________________ Ins
Enter posterior lines ________________________ Shift+Ins
Insert predefined comment ___________________ Shift+F1
Segments
Edit segment ________________________________ Alt+S
Change segment register value __________________ Alt+G
Structs
Struct var __________________________________ Alt+Q
Force zero offset field ________________________ Ctrl+Z
Select union member __________________________ Alt+Y
Functions
Create function __________________________________ P
Edit function ________________________________ Alt+P
Set function end _________________________________ E
Stack variables ______________________________ Ctrl+K
Change stack pointer __________________________ Alt+K
Rename register _________________________________ V
Set function type _________________________________ Y

http://ezbeat.tistory.com/229

1. pe 구조에서 IMAGE_NT_HEADERS -> IMAGE_FILE_HEADER-> characteristics 부분을 수정시켜주어야 합니다. 해당 부분은 2byte로 이루어져 있는데 여기서 파일이 dll로 인식되게 할 것인지 exe 로 인식되게 할 것인지를 결정짓게 됩니다. 보통 dll인 경우 해당 값이 0x2102이고 exe인 경우 0x010F 값을 지니게 됩니다.

 2. 1번을 수행했다면 해당파일의 확장자를 DLL에서 EXE로 바꿔줍니다.

 3. DLL MAIN을 보시면 fdwReason 값이 DLL_PROCESS_ATTACH(1) 일 경우 동작을 하게 됩니다. 그렇기 때문에 강제적으로 fdwReason값을 무조건 1이 되도록 설정해버리면 됩니다.

위 3가지 과정이 전부입니다.

http://gogil.tistory.com/13

http://dual5651.hacktizen.com/tc/entry/PE-%ED%98%95%ED%83%9C%EC%9D%98-%ED%8C%8C%EC%9D%BC%EC%97%90-%EC%84%B9%EC%85%98-%EC%B6%94%EA%B0%80%ED%95%98%EA%B8%B0?category=6

</br>

http://www.reversecore.com/tag/%EC%84%B9%EC%85%98%20%EC%A0%9C%EA%B1%B0

pe는 백날 보는것보다 미친듯이 해보고 깨지는게 더 이해가 쉽다고 한다..ㅡㅡ 그래서 머리 아퍼지네;

실습.zip

쓰면서 처음에 받았는데 유용한것들이 많다. 물론 몇가지 더 채워서 써야겠지만 기본적으로 괜찮음. 출처는 기억안나네요 ㅎㅎ