WooYun.org

ImageMa2 ActiveX IDL文件如下：
[
uuid(D81C6073-919F-4F3A-B12C-7EAF0F6B1F90),
helpstring("ImageManager2 Class")
]
coclass ImageManager2 {
[default] interface IImageManager2;
[default, source] dispinterface _IImageManager2Events;
};
[
odl,
uuid(F068E587-4F89-4949-8FA5-82EF935F688A),
helpstring("IImageManager2 Interface"),
dual,
oleautomation
]
interface IImageManager2 : IDispatch {
[id(0x00000001), helpstring("method ManualPic")]
HRESULT ManualPic(BSTR szFileName);
[id(0x00000002), helpstring("method AutoPic")]
HRESULT AutoPic(
BSTR szFileName,
BSTR* szOut);
[id(0x00000003), propget, helpstring("property url")]
HRESULT url([out, retval] BSTR* pVal);
[id(0x00000003), propput, helpstring("property url")]
HRESULT url([in] BSTR pVal);
[id(0x00000004), propget, helpstring("property containerType")]
HRESULT containerType([out, retval] BSTR* pVal);
[id(0x00000004), propput, helpstring("property containerType")]
HRESULT containerType([in] BSTR pVal);
[id(0x00000005), propget, helpstring("property functionCallback")]
HRESULT functionCallback([out, retval] BSTR* pVal);
[id(0x00000005), propput, helpstring("property functionCallback")]
HRESULT functionCallback([in] BSTR pVal);
[id(0x00000006), propget, helpstring("property draw")]
HRESULT draw([out, retval] BSTR* pVal);
[id(0x00000006), propput, helpstring("property draw")]
HRESULT draw([in] BSTR pVal);
[id(0x00000007), propget, helpstring("property action")]
HRESULT action([out, retval] BSTR* pVal);
[id(0x00000007), propput, helpstring("property action")]
HRESULT action([in] BSTR pVal);
[id(0x00000008), propget, helpstring("property secureKey")]
HRESULT secureKey([out, retval] BSTR* pVal);
[id(0x00000008), propput, helpstring("property secureKey")]
HRESULT secureKey([in] BSTR pVal);
[id(0x00000009), propget, helpstring("property company")]
HRESULT company([out, retval] BSTR* pVal);
[id(0x00000009), propput, helpstring("property company")]
HRESULT company([in] BSTR pVal);
[id(0x0000000a), propget, helpstring("property loginId")]
HRESULT loginId([out, retval] BSTR* pVal);
[id(0x0000000a), propput, helpstring("property loginId")]
HRESULT loginId([in] BSTR pVal);
[id(0x0000000b), propget, helpstring("property picid")]
HRESULT picid([out, retval] BSTR* pVal);
[id(0x0000000b), propput, helpstring("property picid")]
HRESULT picid([in] BSTR pVal);
[id(0x0000000c), propget, helpstring("property Response")]
HRESULT Response([out, retval] BSTR* pVal);
[id(0x0000000c), propput, helpstring("property Response")]
HRESULT Response([in] BSTR pVal);
[id(0x0000000d), propget, helpstring("property PicFileName")]
HRESULT PicFileName([out, retval] BSTR* pVal);
[id(0x0000000d), propput, helpstring("property PicFileName")]
HRESULT PicFileName([in] BSTR pVal);
[id(0x0000000e), propget, helpstring("property xmlParam")]
HRESULT xmlParam([out, retval] BSTR* pVal);
[id(0x0000000e), propput, helpstring("property xmlParam")]
HRESULT xmlParam([in] BSTR pVal);
};
ImageMa2 ActiveX在处理AutoPic方法时存在一个off-by-one的栈溢出漏洞，我想这个应该是2月18日那个栈溢出漏洞修补后的遗留问题：
2月18的公告链接：
http://wooyun.org/bugs/wooyun-2010-01334
http://bbs.taobao.com/catalog/thread/508895-250539394.htm
因为我在修补过的版本AliIM2010_taobao 6.50.10C的ImageMa2.dll中看到程序员在AutoPic的处理函数中加入了2个返回值检查的地方：
1) 调用WideCharToMultiByte()转换unicode字符串时做了返回值检测，这样限制了传入的参数不超过260个字节。
WideCharToMultiByte(0, 0, lpWideCharStr, -1, &FullPath, 260, 0, 0)
2) 同样在调用strrchr查找'\'时也做了返回值检测，确保了返回值不为NULL。因为后面mbsnbcpy函数的第三个(size)的参数是strrchr的返回值减去FullPath的起始地址然后加一.
strrchr(&FullPath, "\\"))
但是显然程序员忽略了在sub_100105EB()调用的子函数存在一个off-by-one的栈溢出漏洞。
sub_100105EB() -> sub_100103FA() (建议用IDA分析ImageMa2的时候把dll的基地址rebase成0x10001000，这样就能方便定位到我描述的问题所在处了。)
sub_100103FA():
...
//首先调用splitpath分解传入的FullPath到本地变量
splitpath(FullPath, &Drive, &Dir, &Filename, &DestStr);
...
char *filesuffix= (char *)_mbsupr(&DestStr);
if ( _mbscmp(filesuffix, ".GIF") )
name = ".jpg";
else
name = ".gif";
strcpy(&DestStr, name);
DWORD count = 9999;
while ( 1 )
{
DWORD rd = rand();
sprintf((char *)&Dest, "%s%s%s_%04d%s", &Drive, &Dir, &Filename, rd % 10000, &DestStr);
if (!GetFileAttributesA(&Dest))
break;
count--;
if ( !count )
return 0;
}
当我们传入的路径不包含后缀名时，该函数会自动帮忙添加.jpg或者.gif的后缀，当我们传入的数据到达260字节后，sprintf打印的文件名为：
"[我们传入的路径]_1234.jpg"，然后这里程序员忽略了sprintf会自动在缓冲区末尾添加00做截断，从而也就导致了一个stack off-by-one的问题，导致了保存的
ebp最后一个字节被覆盖成0的字节，当函数返回时就会跳转至缓冲区内的内容处执行，而这个内容是我们可控的。