Microsoft vbscript vbserase memory corruption Vulnerability / Exploit
/
/
/
Exploits / Vulnerability Discovered : 2019-03-19 |
Type : dos |
Platform : windows
This exploit / vulnerability Microsoft vbscript vbserase memory corruption is for educational purposes only and if it is used you will do on your own risk!
[+] Code ...
<!--
There is an issue in VBScript in the VbsErase function. In some cases (see the attached PoC), VbsErase fails to clear the argument variable properly, which can trivially lead to crafting a variable with the array type, but with a pointer controlled controlled by an attacker. This issue was most likely introduced in an attempt to fix a previously reported issue in VbsErase (https://bugs.chromium.org/p/project-zero/issues/detail?id=1668).
Debug log (Note: this was tested on Windows 10 64-bit v1809 with the most recent patches applied):
(25b4.efc): Access violation - code c0000005 (first chance)
First chance exceptions are reported before any exception handling.
This exception may be expected and handled.
VBSCRIPT!VbsErase+0x5a:
6e0fc9fa 8b3e mov edi,dword ptr [esi] ds:002b:13371337=????????
0:009:x86> r
eax=0000600c ebx=05dc10dc ecx=00000000 edx=00000000 esi=13371337 edi=05c5ca44
eip=6e0fc9fa esp=05c5ca28 ebp=05c5ca48 iopl=0 nv up ei pl zr na pe nc
cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00010246
VBSCRIPT!VbsErase+0x5a:
6e0fc9fa 8b3e mov edi,dword ptr [esi] ds:002b:13371337=????????