MS08-011 Microsoft Works 文件转换器中的漏洞学习
2008-03-12 23:28
call 61091b10的返回地址被覆盖
61091B10 55 push ebp
61091B11 8BEC mov ebp,esp
61091B13 83EC 1C sub esp,1C
61091B16 56 push esi
61091B17 8D45 E4 lea eax,dword ptr ss:[ebp-1C]
61091B1A FF75 08 push dword ptr ss:[ebp+8]
61091B1D 8BF1 mov esi,ecx ；
61091B1F 50 push eax
61091B20 E8 4A0F0000 call wkcvqd01.61092A6F ; 这个call里溢出
61091B25 59 pop ecx
61091B26 8D45 E4 lea eax,dword ptr ss:[ebp-1C]
61091B29 59 pop ecx
61091B2A 50 push eax
61091B2B 8BCE mov ecx,esi
61091B2D E8 6AFFFFFF call wkcvqd01.61091A9C
61091B32 5E pop esi
61091B33 C9 leave
61091B34 C2 0400 retn 4
跟进后：
61092A6F 53 push ebx
61092A70 8B5C24 08 mov ebx,dword ptr ss:[esp+8]
61092A74 56 push esi
61092A75 8B7424 10 mov esi,dword ptr ss:[esp+10]
61092A79 66:8B06 mov ax,word ptr ds:[esi]
61092A7C 66:8903 mov word ptr ds:[ebx],ax
61092A7F 8D46 02 lea eax,dword ptr ds:[esi+2]
61092A82 50 push eax
61092A83 8D43 02 lea eax,dword ptr ds:[ebx+2]
61092A86 50 push eax
61092A87 E8 42FFFFFF call wkcvqd01.610929CE
61092A8C 66:8B46 08 mov ax,word ptr ds:[esi+8]
61092A90 59 pop ecx
61092A91 59 pop ecx
61092A92 66:8943 0A mov word ptr ds:[ebx+A],ax
61092A96 66:8B4B 0C mov cx,word ptr ds:[ebx+C]
61092A9A 8A46 0A mov al,byte ptr ds:[esi+A]
61092A9D 32C1 xor al,cl
61092A9F 33D2 xor edx,edx
61092AA1 83E0 03 and eax,3
61092AA4 33C1 xor eax,ecx
61092AA6 66:8943 0C mov word ptr ds:[ebx+C],ax
61092AAA 8A4E 0A mov cl,byte ptr ds:[esi+A]
61092AAD 32C8 xor cl,al
61092AAF 83E1 04 and ecx,4
61092AB2 33C8 xor ecx,eax
61092AB4 66:894B 0C mov word ptr ds:[ebx+C],cx
61092AB8 8A46 0A mov al,byte ptr ds:[esi+A]
61092ABB 32C1 xor al,cl
61092ABD 83E0 08 and eax,8
61092AC0 33C1 xor eax,ecx
61092AC2 66:8943 0C mov word ptr ds:[ebx+C],ax
61092AC6 66:8B4E 0A mov cx,word ptr ds:[esi+A]
61092ACA 32C1 xor al,cl
61092ACC 83E0 0F and eax,0F
61092ACF 33C1 xor eax,ecx
61092AD1 66:3953 0A cmp word ptr ds:[ebx+A],dx
61092AD5 66:8943 0C mov word ptr ds:[ebx+C],ax
61092AD9 7E 1E jle short wkcvqd01.61092AF9
61092ADB 57 push edi
61092ADC 8D4B 0E lea ecx,dword ptr ds:[ebx+E]
61092ADF 8D46 0C lea eax,dword ptr ds:[esi+C]
61092AE2 8BF0 mov esi,eax
61092AE4 8BF9 mov edi,ecx
61092AE6 A5 movs dword ptr es:[edi],dword ptr ds:[esi] ；在这进行字符串复制，进行溢出返回地址
61092AE7 A5 movs dword ptr es:[edi],dword ptr ds:[esi]
61092AE8 A5 movs dword ptr es:[edi],dword ptr ds:[esi]
61092AE9 0FBF73 0A movsx esi,word ptr ds:[ebx+A]
61092AED 42 inc edx
61092AEE 83C0 0C add eax,0C
61092AF1 83C1 0C add ecx,0C
61092AF4 3BD6 cmp edx,esi
61092AF6 ^ 7C EA jl short wkcvqd01.61092AE2
61092AF8 5F pop edi
61092AF9 5E pop esi
61092AFA 5B pop ebx
61092AFB C3 retn