rapid7/metasploit-framework — pull request #2442 by wchen-r7 (2013-10-01 06:46:23+00:00)
Title: Add ROP chains for Office 2007 and Office 2010 (hxds.dll)

This adds two ROP chains for Office 2007 and Office 2010 based on hxds.dll.

I don't really have a pretty way to test them, except for doing a real spray in memory, and then manually playing with it with a debugger.

First I start with this test script:
https://gist.github.com/wchen-r7/6774619

And then I do these:

- [ ] Start IE (in my case I run IE9 on Win 7 SP1)
- [ ] Attach debugger to IE (I use ImmDBG in this case)
- [ ] Start msfconsole and run the test module
- [ ] In the browser, go to the link provided by the module. This should spray the ROPs in memory.
- [ ] Pause the debugger.
- [ ] If you're using Office 2007, modify ESP to 0x20302020. If 2010, modify to 0x203020DC.
- [ ] Modify EIP to some RET instruction that's executable. The RET should point to the first gadget of the ROP.
- [ ] Step through the ROP chain. Make sure you're executing VirtualProtect with success (EAX=0), and that it returns to a bunch of 0x90s as the fake payload. The 0x90s should be executable too.

For your reference, in Office 2007, the VirtualProtect should have these arguments:

20302044 FFFFFFFF ÿÿÿÿ |hProcess = FFFFFFFF
20302048 20302074 t 0 |Address = 20302074
2030204C 00000201 .. |Size = 201 (513.)
20302050 00000040 @... |NewProtect = PAGE_EXECUTE_READWRITE

In Office 2010, the arguments would look like:

20302108 FFFFFFFF ÿÿÿÿ |hProcess = FFFFFFFF
2030210C 20302138 8!0 |Address = 20302138
20302110 00000201 .. |Size = 201 (513.)
20302114 00000040 @... |NewProtect = PAGE_EXECUTE_READWRITE
20302118 51C5C638 8ÆÅQ \pOldProtect = hxds.51C5C638