某个xx行的控件中的一个不能利用的堆栈溢出

最新推荐文章于 2022-07-05 10:06:16 发布

原创最新推荐文章于 2022-07-05 10:06:16 发布 · 752 阅读

0 ·

CC 4.0 BY-SA版权

文章标签：

#byte #c

漏洞分析专栏收录该内容

39 篇文章

订阅专栏

本文深入分析asminPowerEnterCABANK.ocx中的代码注入漏洞，通过解读相关代码段，揭示其如何利用堆栈溢出来实现数据污染并覆盖返回地址，最终导致安全风险。重点探讨了关键代码逻辑、内存操作和数据溢出原理，为开发者提供深入理解此类攻击手段的视角。

摘要生成于 C知道，由 DeepSeek-R1 满血版支持，前往体验 >

asm in PowerEnterCABANK.ocx 
.text:10001500 bugfunc_retaddress_onebyte_write proc near ; CODE XREF: sub_100015A0+3Ep
.text:10001500
.text:10001500 var_94          = dword ptr -94h
.text:10001500 var_90          = dword ptr -90h
.text:10001500 var_8C          = byte ptr -8Ch
.text:10001500 arg_0           = dword ptr  4
.text:10001500 arg_4           = dword ptr  8
.text:10001500
.text:10001500                 sub     esp, 94h
.text:10001506                 push    ebx
.text:10001507                 push    ebp
.text:10001508                 push    esi
.text:10001509                 mov     esi, ecx
.text:1000150B                 xor     ebx, ebx
.text:1000150D                 push    edi
.text:1000150E                 lea     ecx, [esp+0A4h+var_90]
.text:10001512                 mov     [esp+0A4h+var_94], ebx
.text:10001516                 call    sub_100013B0
.text:1000151B                 push    esi
.text:1000151C                 lea     ecx, [esp+0A8h+var_90]
.text:10001520                 call    sub_100013E0
.text:10001525                 mov     ebp, [esi]
.text:10001527                 cmp     ebp, ebx
.text:10001529                 jbe     short loc_1000156B
.text:1000152B                 lea     edi, [esp+0A4h+var_8C]
.text:1000152F                 add     esi, 4
.text:10001532
.text:10001532 loc_10001532:                           ; CODE XREF: bugfunc_retaddress_onebyte_write+58j
.text:10001532                 mov     ecx, [esi]
.text:10001534                 xor     eax, eax
.text:10001536                 push    eax             ; 0
.text:10001537                 mov     eax, [esp+0A8h+arg_4] ; 10
.text:1000153E                 push    eax
.text:1000153F                 push    0               ; 0
.text:10001541                 push    ecx             ; 污染数据
.text:10001542                 call    __allmul
.text:10001547                 xor     ecx, ecx
.text:10001549                 add     eax, ebx
.text:1000154B                 adc     edx, ecx        ; edx是AAAAAAAA*10 取高位HIDWORD函数
.text:1000154D                 mov     [edi], eax
.text:1000154F                 add     esi, 4
.text:10001552                 add     edi, 4
.text:10001555                 dec     ebp
.text:10001556                 mov     ebx, edx
.text:10001558                 jnz     short loc_10001532
.text:1000155A                 test    ebx, ebx
.text:1000155C                 jz      short loc_1000156B ; 污染数据*10后 edx为0 就不写入
.text:1000155E                 mov     eax, [esp+0A4h+var_90] ; ==0x23
.text:10001562                 inc     eax             ; eax多加了1
.text:10001563                 mov     [esp+0A4h+var_90], eax
.text:10001567                 mov     [esp+eax*4+0A4h+var_90], ebx ; ee写到堆栈返回地址去了..
.text:1000156B
.text:1000156B loc_1000156B:                           ; CODE XREF: bugfunc_retaddress_onebyte_write+29j
.text:1000156B                                         ; bugfunc_retaddress_onebyte_write+5Cj
.text:1000156B                 mov     ebx, [esp+0A4h+arg_0] ; 堆栈空间是0x94大小
.text:1000156B                                         ; 由于开始3个push，现在堆栈空间为c+0x94
.text:1000156B                                         ; 而 0x24*4+14=0x98 堆栈返回被覆盖..
.text:10001572                 mov     ecx, 24h
.text:10001577                 lea     esi, [esp+0A4h+var_90]
.text:1000157B                 mov     edi, ebx
.text:1000157D                 rep movsd
.text:1000157F                 lea     ecx, [esp+0A4h+var_90]
.text:10001583                 call    nullsub_2
.text:10001588                 pop     edi
.text:10001589                 pop     esi
.text:1000158A                 mov     eax, ebx
.text:1000158C                 pop     ebp
.text:1000158D                 pop     ebx
.text:1000158E                 add     esp, 94h
.text:10001594                 retn    8               ; 污染数据为DWORD，乘以10h后，edx只可能为一个BYTE  堆栈返回地址变成0x0000000a类似
.text:10001594 bugfunc_retaddress_onebyte_write endp

.text:10020CE0 __allmul        proc near               ; CODE XREF: bugfunc_retaddress_onebyte_write+42p
.text:10020CE0
.text:10020CE0 arg_0           = dword ptr  4
.text:10020CE0 arg_4           = dword ptr  8
.text:10020CE0 arg_8           = dword ptr  0Ch
.text:10020CE0 arg_C           = dword ptr  10h
.text:10020CE0
.text:10020CE0                 mov     eax, [esp+arg_4]
.text:10020CE4                 mov     ecx, [esp+arg_C]
.text:10020CE8                 or      ecx, eax
.text:10020CEA                 mov     ecx, [esp+arg_8]
.text:10020CEE                 jnz     short loc_10020CF9
.text:10020CF0                 mov     eax, [esp+arg_0]
.text:10020CF4                 mul     ecx
.text:10020CF6                 retn    10h
.text:10020CF9 ; ---------------------------------------------------------------------------
.text:10020CF9
.text:10020CF9 loc_10020CF9:                           ; CODE XREF: __allmul+Ej
.text:10020CF9                 push    ebx
.text:10020CFA                 mul     ecx
.text:10020CFC                 mov     ebx, eax
.text:10020CFE                 mov     eax, [esp+4+arg_0]
.text:10020D02                 mul     [esp+4+arg_C]
.text:10020D06                 add     ebx, eax
.text:10020D08                 mov     eax, [esp+4+arg_0]
.text:10020D0C                 mul     ecx
.text:10020D0E                 add     edx, ebx
.text:10020D10                 pop     ebx
.text:10020D11                 retn    10h
.text:10020D11 __allmul        endp

c in PowerEnterCABANK

void *__thiscall bugfunc_retaddress_onebyte_write(void *this, void *a2, int a3)
{
  unsigned int v3; // ebx@1
  int v4; // ebp@1
  void *v5; // esi@1
  char *v6; // edi@2
  int v7; // esi@2
  __int64 v8; // qax@3
  int v10; // [sp+14h] [bp-90h]@1
  char v11; // [sp+18h] [bp-8Ch]@2

  v5 = this;
  v3 = 0;
  sub_100013B0(&v10);
  sub_100013E0(v5);
  v4 = *(_DWORD *)v5;
  if ( *(_DWORD *)v5 > 0u )
  {
    v6 = &v11;
    v7 = (int)((char *)v5 + 4);
    do
    {
      v8 = v3 + *(_DWORD *)v7 * a3;
      *(_DWORD *)v6 = v8;
      v7 += 4;
      v6 += 4;
      --v4;
      v3 = HIDWORD(v8);
    }
    while ( v4 );
    if ( HIDWORD(v8) )
    {
      ++v10;
      *(&v10 + v10) = HIDWORD(v8);
    }
  }
  memcpy(a2, &v10, 0x90u);
  nullsub_2(&v10);
  return a2;
}

哎不能利用...