软件漏洞分析的八大技巧汇总.pdf

《软件漏洞分析的八大技巧汇总.pdf》由会员上传分享，免费在线阅读，更多相关内容在工程资料-天天文库。

1、൘ᰕᑨ࠶᷀䖟Ԧ┿⍎ᰦˈ㓿ᑨ䴰㾱㙇䍩∄䖳䮯Ⲵ࠶᷀ᰦ䰤ˈቁࡉࠐሿᰦˈཊࡉᮠཙˈ⭊㠣ᴤѵDŽഐ↔ˈ㓿ᑨᙫ㔃аӋ࠶᷀ᢰᐗᱟ䶎ᑨᴹᗵ㾱Ⲵˈ䪸ሩн਼Ⲵ┿⍎㊫ර䟷ਆн਼Ⲵ࠶᷀ᙍ䐟઼ᢰᐗˈਟԕᴹ᭸ൠᨀ儈࠶᷀䙏ᓖDŽሩҾаӋ㻛ᴍࠪᶕⲴ✝䰘0dayˈ㖁ка㡜䜭Պᴹ࠶᷀᮷ㄐˈնа㡜䜭ᱟ¯㔃䇪ᙗ࠶᷀āˈҏቡᱟⴤ᧕ᑆ┿⍎ԓ⸱ˈᤷࠪଚ䟼ࠪ䭉ˈ㘼䶎¯ᙍ䐟ᙗ࠶᷀āDŽྲ᷌֐㓿ᑨ࠶᷀┿⍎Ⲵ䈍ˈՊਁ⧠ঐ⭘֐࠶᷀ᰦ䰤Ⲵᖰᖰнᱟ࠶᷀┿⍎ԓ⸱ˈ㘼ᱟᇊս┿⍎ԓ⸱DŽᡰԕ䈤ˈ䈳䈅࠶᷀┿⍎ᴹᰦቡᱟⴻлᯝ⛩лᗇ߶нˈ޽࣐каӋ㜑⥌ҡᜣᶕ᧘⍻ˈᴰਾ᡽ᱟ࠶᷀┿⍎ԓ⸱Ҷˈ

2、ྲ᷌⟏ᚹ≷㕆ᤷԔˈ䘉њቡнᱟ䰞仈ҶDŽл䶒ᱟㅄ㘵ቡԕᖰ࠶᷀䗷Ⲵ㤕ᒢᇎ┿⍎ˈᙫ㔃ࠪⲴаӋሿᢰᐗDŽн䗷ˈᢰᐗ⭊ཊˈㇷᑵᴹ䲀ˈ↔༴ӵࡇѮаӋ∄䖳њӪᑨ⭘Ⲵᯩ⌅ˈҏ⅒䗾਴ս࠶ӛ㠚ᐡⲴаӋ࠶᷀ᢰᐗˈབྷᇦޡ਼ᆖҐ᧒䇘DŽᢰᐗа˖ᘛ䙏ᇊսJSԓ⸱䈳⭘ⲴIE㊫ᡀઈ࠭ᮠCVE-2011-0027MicrosoftDataAccess㓴Ԧᮤᮠⓒࠪ┿⍎ᱟPwn2Own2010唁ᇒབྷ䎋ѝ㻛⭘ᶕ᭫⹤IE8⍿㿸ಘⲴ┿⍎ˈަѝޣ䭞Ⲵ┿⍎䀖ਁԓ⸱ྲл˖localxmlid1=document.getElementById('xmlid1').r

3、ecordset;//㧧ਆxml㍐xmlid1Ⲵrecordsetˈণᮠᦞᓃ㺘Ⲵ䇠ᖅ䳶localxmlid1.CacheSize=0x40000358;//䇮㖞㜭ཏ㻛؍ᆈⲴ䇠ᖅᶑᮠˈ↔٬ᴰ㓸䙐ᡀᮤᮠⓒࠪ⧠൘ᡁԜቡӻ㓽а⿽ᘛ䙏ᇊսк䘠є㹼ԓ⸱ሶሩᓄ䈳⭘ⲴIE㊫ᡀઈ࠭ᮠˈ俆⭘IDA࣐䖭┿⍎᮷Ԧmsado15.dllˈᒦ䇨࣐䖭ᗞ䖟ㅖਧ㺘ˈ❦ਾ䘹ѝ“Functionname”аḿˈ᤹“Alt+T”ᘛᦧ䭞ᕩࠪᩌ㍒Ṷˈ䗃ޕᩌ㍒ޣ䭞ᆇ“cachesize”˖䙊䗷᤹“Ctrl+T”ਟ㔗㔝ᩌ㍒лањˈᴰਾ᢮ࡠєњ⴨ޣ࠭ᮠ˖CR

4、ecordset::put_CacheSize(long*)CRocordset::get_CacheSize(long)ᡁԜሩCRecordset::put_CacheSizeлᯝ⛩傼䇱лࡽ䶒Ⲵ⥌⍻ˈ⭘Windbg䱴࣐IE䘋〻䘀㹼ਾᢃᔰpoc.htmlˈ⺞ᇎᯝ൘put_CacheSizeˈ䙊䗷ḕⴻ৲ᮠਟԕⴻࡠpoc.htmlѝ䇮㖞ⲴCacheSize٬0×40000358ˈ䈤᰾CRecordset::put_CacheSize⺞ᇎᱟ䇮㖞CacheSize٬Ⲵ࠭ᮠ˖0:005>gBreakpoint1hite

5、ax=40000358ebx=04bdcfd8ecx=6e61d340edx=00000000esi=01fbf144edi=00000000eip=6e6ac957esp=01fbeb58ebp=01fbf040iopl=0nvupeiplzrnapenccs=001bss=0023ds=0023es=0023fs=003bgs=0000efl=00000246msado15!CRecordset::put_CacheSize:6e6ac9578bffmovedi,edi0:005>ddesp01fbeb5

6、86e62f3ec04bdcfd8400003580000000001fbeb6801fbf07404bdcfd8110000110000000001fbeb7803570ae8004ad07000538a300000008801fbeb8800470000000000020357076001fbec8401fbeb9876fc31930047013876fc316f764736b801fbeba800000000004700000357076800518a7801fbebb8004767b8004768e4

7、0055925800476db801fbebc876f8d74d0051d96800472a9801fbedc0ᡁԜሩCRecordset::put_CacheSizeлᯝ⛩傼䇱лࡽ䶒Ⲵ⥌⍻ˈ⭘Windbg䱴࣐IE䘋〻䘀㹼ਾᢃᔰpoc.htmlˈ⺞ᇎᯝ൘put_CacheSizeˈ䙊䗷ḕⴻ৲ᮠਟԕⴻࡠpoc.htmlѝ䇮㖞ⲴCacheSize٬0×40000358ˈ䈤᰾CRecordset::put_CacheSize⺞ᇎᱟ䇮㖞CacheSize٬Ⲵ࠭ᮠDŽᢰᐗҼ˖䙊䗷亥ึᘛ䙏ᇊսึ┿⍎ԓ⸱亥ึᱟwindows

8、2000ᕅޕⲴ䈳䈅᭟ᤱ࣏㜭ˈㆰ〠DPH(DebugPageHeap)ˈ੟⭘䈕ᵪࡦਾˈึ㇑⨶ಘՊ൘ึඇਾ໎࣐у䰘⭘ҾỰ⍻ⓒࠪⲴḵḿ亥ˈᖃᮠᦞⓒࠪ䀖৺ḵḿ亥ׯՊ・࡫䀖ਁᔲᑨˈ↔ᰦᖰᖰቡᱟ䀖ਁ┿⍎Ⲵᴰ৺ᰦⲴս㖞ˈᆳнӵ䘲⭘ҾึⓒࠪˈሩҾަᆳ㊫රⲴึ┿⍎ҏᱟ䘲⭘ⲴDŽԕCVE-2013-0077ᗞ䖟DirectShowึⓒࠪ┿⍎Ѫˈ䙊䗷ԕлભԔᔰ੟亥ึ(gflags)˖gflags.exe–iplayer.e