Exploit-DB #49863
Description: Microsoft Internet Explorer 11 and WPAD service 'Jscript.dll' - Use-After-Free
Type: local
Platform: windows_x86-64
Date: 2021-05-13
Author: Forrest Orr

Exploit:
# Exploit Title: Microsoft Internet Explorer 8/11 and WPAD service 'Jscript.dll' - Use-After-Free
# Date: 2021-05-04
# Exploit Author: deadlock (Forrest Orr)
# Vendor Homepage: https://www.microsoft.com/
# Software Link: https://www.microsoft.com/en-gb/download/internet-explorer.aspx
# Versions: IE 8-11 (64-bit) as well as the WPAD service (64-bit) on Windows 7 and 8.1 x64
# Tested on: Windows 7 x64, Windows 8.1 x64
# CVE: CVE-2020-0674
# Bypasses: DEP, ASLR, CFG
# Original (IE-only/Windows 7-only) exploit credits: maxpl0it
# Full explain chain writeup: https://github.com/forrest-orr/DoubleStar

/*
________                 ___.    .__                 _________  __
\______ \    ____   __ __\_ |__  |  |    ____       /   _____/_/  |_ _____  _______
 |    |  \  /  _ \ |  |  \| __ \ |  |  _/ __ \      \_____  \ \   __\\__  \ \_  __ \
 |    `   \(  <_> )|  |  /| \_\ \|  |__\  ___/      /        \ |  |   / __ \_|  | \/
/_______  / \____/ |____/ |___  /|____/ \___  >    /_______  / |__|  (____  /|__|
        \/                    \/            \/             \/             \/
Windows 8.1 IE/Firefox RCE -> Sandbox Escape -> SYSTEM EoP Exploit Chain

                            ______________
                            | Remote PAC | 
                            |____________|  
                                   ^
                                   | HTTPS
_______________  RPC/ALPC   _______________   RPC/ALPC   _______________
| firefox.exe | ----------> | svchost.exe | -----------> | spoolsv.exe |
|_____________|             |_____________| <----------- |_____________|
                                   |          RPC/Pipe
                                   |
               _______________     | 
               | malware.exe | <---| Execute impersonating NT AUTHORY\SYSTEM
               |_____________|

~

Component

JavaScript file containing CVE-2020-0674 UAF targetting IE8/11 and WPAD 64-bit
on Windows 7 and 8.1 x64. It may be used as an alternative RCE attack vector in
the exploit chain (in which case it should be used in conjunction with the
stage two WPAD sandbox escape shellcode), as a PAC file (see settings) or a
stand-alone IE8/11 64-bit exploit. Note that if used as the initial RCE in the
full exploit chain, Windows 7 is unsupported by the required stage two WPAD
sandbox escape shellcode.

________________  CVE-2020-0674 _______________________  RPC/ALPC   _______________
| iexplore.exe | -------------> | WPAD sandbox escape | ----------> | svchost.exe |
|______________|                | shellcode (heap)    |             |_____________|
                                |_____________________|              

~

Overview

This is a 64-bit adaptation of CVE-2020-0674 which can exploit both IE8/11
64-bit as well as the WPAD service on Windows 7 and 8.1 x64. It has bypasses
for DEP, ASLR, and CFG. It uses dynamic ROP chain creation for its RIP
hijack and stack pivot. Notably, this exploit does not contain bypasses for
Windows Exploit Guard or EMET 5.5 and does not work on IE11 or WPAD in
Windows 10.

~

Design

The UAF is a result of two untracked variables passed to a comparator for the
Array.sort method, which can then be used to reference VAR structs within
allocated GcBlock regions which can subsequently be freed via garbage
collection. Control of the memory of VAR structs with active JS var
references in the runtime script is then used for arbitrary read (via BSTR)
and addrof primitives.

Ultimately the exploit aims to use KERNEL32.DLL!VirtualProtect to disable DEP
on a user defined shellcode stored within a BSTR on the heap. This is achieved
through use of NTDLL.DLL!NtContinue, an artificial stack (built on the heap)
and a dynamically resolved stack pivot ROP gadget.

NTDLL.DLL!NtContinue --------------------> RIP = <MSVCRT.DLL!0x00019baf> | MOV RSP, R11; RET
                                           RCX = Shellcode address
                                           RDX = Shellcode size
                                           R8 = 0x40
                                           R9 = Leaked address of BSTR to hold out param    
                                           RSP = Real stack pointer             
                                           R11 = Artificial stack
|-----------------------------|            ^
| 2MB stack space (heap)      |            |
|-----------------------------|            |
| Heap header/BSTR len align  |            |
|-----------------------------|            |
| KERNEL32.DLL!VirtualProtect | <----------|
|-----------------------------|
| Shellcode return address    ]
|-----------------------------|   

The logic flow is:
1. A fake object with a fake vtable is constructed containing the address
   of NTDLL.DLL!NtContinue as its "typeof" method pointer. This primitive
   is used for RIP hijack in conjunction with a pointer to a specially
   crafted CONTEXT structure in RCX as its parameter. 
2. NtContinue changes RIP to a stack pivot gadget and sets up the parameters
   to KERNEL32.DLL!VirtualProtect.
3. The address of VirtualProtect is the first return address to be
   consumed on the new (artificial) stack after the stack pivot.
4. VirtualProtect disables DEP on the shellcode region and returns to that
   same (now +RWX) shellcode address stored as the second return address on
   the pivoted stack.
   
Notably, the stack pivot was needed here due to the presence of CFG on
Windows 8.1, which prevents NtContinue from being used to change RSP to an
address which falls outside the stack start/end addresses specified in the
TEB. On Windows 7 this is a non-issue. Furthermore, it required a leak of RSP
to be planted in the CONTEXT structure so that NtContinue would consider its
new RSP valid.

The exploit will not work on Windows 10 due to enhanced protection by CFG:
Windows 10 has blacklisted NTDLL.DLL!NtContinue to CFG by default.