详解cve-2010-2553

最新推荐文章于 2023-09-28 15:04:50 发布

原创

最新推荐文章于 2023-09-28 15:04:50 发布 · 1.3k 阅读

0 ·

CC 4.0 BY-SA版权

文章标签：

#cve-2010-2553 堆溢出

  我的调试环境是win7旗舰版32位+wmpalyer+windbg+IDA。 

  poc见: https://www.exploit-db.com/exploits/15112/ 

  wmpalyer设置页堆： 

C:\Program Files\Debugging Tools for Windows (x86)>gflags.exe -i wmplayer.exe +h
pa +htc
Current Registry Settings for wmplayer.exe executable are: 02000010
    htc - Enable heap tail checking
    hpa - Enable page heap

C:\Program Files\Debugging Tools for Windows (x86)>gflags.exe -i wmplayer.exe
Current Registry Settings for wmplayer.exe executable are: 02000010
    htc - Enable heap tail checking
    hpa - Enable page heap

  打开wmplayer，windbg附加进程，wmplayer中打开poc，windbg成功断下： 

0:015> g
(f14.efc): Access violation - code c0000005 (first chance)
First chance exceptions are reported before any exception handling.
This exception may be expected and handled.
eax=113f1000 ebx=113ef000 ecx=00000040 edx=00000000 esi=113ef000 edi=113f1000
eip=76faa05b esp=1163f510 ebp=1163f518 iopl=0         nv up ei pl nz na po nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00010202
msvcrt!__ascii_strnicmp+0x99:
76faa05b 660f7f07        movdqa  xmmword ptr [edi],xmm0 ds:0023:113f1000=????????????????????????????????

  此时查看栈回溯及113f1000所在堆的信息： 

0:027> kvn
 # ChildEBP RetAddr  Args to Child              
00 1163f518 76faa00b 113f1000 113ef000 00002000 msvcrt!__ascii_strnicmp+0x99 (FPO: [3,0,0])
01 1163f548 70ae3ba2 113f1000 113ef000 00002000 msvcrt!_VEC_memcpy+0x52 (FPO: [3,0,0])
02 1163f588 70aeeeda 00000004 00000000 00000068 iccvid!CVDecompress+0x141 (FPO: [Non-Fpo])
03 1163f5b8 70ae80f8 0ddd0f60 00000000 10ed2fd8 iccvid!Decompress+0x128 (FPO: [Non-Fpo])
04 1163f604 71f01759 0ddd0f60 00000001 0000400d iccvid!DriverProc+0x1bf (FPO: [Non-Fpo])
05 1163f628 6ce78639 71f1c7c0 0000400d 1163f640 MSVFW32!ICSendMessage+0x31 (FPO: [Non-Fpo])
06 1163f658 6ce789c4 71f1c7c0 00000000 10ed2fd8 quartz!CVFWDynLink::ICDecompress+0x3e (FPO: [Non-Fpo])
07 1163f710 6cf26cbe 1107cfa8 111bafb8 00000000 quartz!CAVIDec::Transform+0x2b0 (FPO: [Non-Fpo])
08 1163f73c 6cf26910 1107cfa8 00000000 0e956ee0 quartz!CVideoTransformFilter::Receive+0x120 (FPO: [Non-Fpo])
09 1163f750 6ce60472 0e9aef44 1107cfa8 1163f790 quartz!CTransformInputPin::Receive+0x33 (FPO: [Non-Fpo])
0a 1163f760 6cf2d61e 1107cfa8 00040103 0e956ee0 quartz!CBaseOutputPin::Deliver+0x22 (FPO: [Non-Fpo])
0b 1163f790 6cf2d830 1163f7c0 1163f7bc 00000000 quartz!CBaseMSRWorker::TryDeliverSample+0x102 (FPO: [Non-Fpo])
0c 1163f7d4 6cf2deba 00000000 0e956ee0 0e956ee0 quartz!CBaseMSRWorker::PushLoop+0x15b (FPO: [Non-Fpo])
0d 1163f7ec 6cf2e46a 00000000 6ce35735 00000000 quartz!CBaseMSRWorker::DoRunLoop+0x44 (FPO: [Non-Fpo])
0e 1163f7f4 6ce35735 00000000 00000000 1163f810 quartz!CBaseMSRWorker::ThreadProc+0x39 (FPO: [0,0,4])
0f 1163f804 76811174 0e956ee0 1163f850 7720b3f5 quartz!CAMThread::InitialThreadProc+0x15 (FPO: [Non-Fpo])
10 1163f810 7720b3f5 0e956ee0 6779fde2 00000000 kernel32!BaseThreadInitThunk+0xe (FPO: [Non-Fpo])
11 1163f850 7720b3c8 6ce35720 0e956ee0 00000000 ntdll!__RtlUserThreadStart+0x70 (FPO: [Non-Fpo])
12 1163f868 00000000 6ce35720 0e956ee0 00000000 ntdll!_RtlUserThreadStart+0x1b (FPO: [Non-Fpo])
0:027> !heap -p -a 113f1000
    address 113f1000 found in
    _DPH_HEAP_ROOT @ b1000
    in busy allocation (  DPH_HEAP_BLOCK:         UserAddr         UserSize -         VirtAddr         VirtSize)
                                10e53c64:         113eb000             6000 -         113ea000             8000
    6fe58e89 verifier!AVrfDebugPageHeapAllocate+0x00000229
    77274ea6 ntdll!RtlDebugAllocateHeap+0x00000030
    77237d96 ntdll!RtlpAllocateHeap+0x000000c4
    772034ca ntdll!RtlAllocateHeap+0x0000023a
    754a7589 KERNELBASE!LocalAlloc+0x0000005f
    70ae3d93 iccvid!CVDecompressBegin+0x00000092
    70aee2a2 iccvid!DecompressBegin+0x000002cf
    70ae80d1 iccvid!DriverProc+0x00000198
    71f01759 MSVFW32!ICSendMessage+0x00000031
    6ce79925 quartz!CAVIDec::StartStreaming+0x0000027a
    6cf266fb quartz!CTransformFilter::Pause+0x00000060
    6ce782a4 quartz!CAVIDec::Pause+0x0000002f
    6ce29e03 quartz!CFilterGraph::Pause+0x00000223
    6ce2c8b1 quartz!CFGControl::Cue+0x00000032
    6ce35c40