Vbscript oleaut32!variantclear and scrrun!vbadictionary::put_item useafterfree Vulnerability / Exploit
/
/
/
Exploits / Vulnerability Discovered : 2018-11-30 |
Type : dos |
Platform : windows
This exploit / vulnerability Vbscript oleaut32!variantclear and scrrun!vbadictionary::put_item useafterfree is for educational purposes only and if it is used you will do on your own risk!
[+] Code ...
<!--
There is a use-after-free vulnerability (possibly two vulnerabilities triggerable by the same PoC, see below) in Microsoft VBScript. The vulnerability has been confirmed in Internet Explorer on Windows 7 with the latest patches applied.
PoC:
(Note that Page Heap might need to be enabled to observe the crash.)
1st issue: In OLEAUT32!VariantClear, if the Variant is an object, the object destructor is going to be called and immediately after that the variant type is going to be (un)set. However, the object destructor can call attacker-controlled VBScript and the memory holding the Variant could be freed, as demonstrated by the PoC. This is also visible in the following snippet of code taken from the 64-bit version of OLEAUT32!VariantClear:
2nd issue: Even if the 1st issue was fixed, the PoC would still trigger another issue, which is that VBADictionary::put_Item calls VariantCopy immediately after VariantClear in order to set the new value in the dictionary. If VariantClear deletes the memory containing the variant (as demonstrated earlier), VariantCopy is going to access the freed memory. This is visible in the following snippet of code from VBADictionary::put_Item:
(c08.4a4): Access violation - code c0000005 (first chance)
First chance exceptions are reported before any exception handling.
This exception may be expected and handled.
eax=00000000 ebx=00000009 ecx=0b93ffb8 edx=00a61078 esi=080e2fe8 edi=00000009
eip=759c3f3a esp=0a34b6bc ebp=0a34b6c8 iopl=0 nv up ei pl zr na pe nc
cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00010246
OLEAUT32!VariantClear+0xdb:
759c3f3a 668906 mov word ptr [esi],ax ds:002b:080e2fe8=????
0:008> r
eax=00000000 ebx=00000009 ecx=0b93ffb8 edx=00a61078 esi=080e2fe8 edi=00000009
eip=759c3f3a esp=0a34b6bc ebp=0a34b6c8 iopl=0 nv up ei pl zr na pe nc
cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00010246
OLEAUT32!VariantClear+0xdb:
759c3f3a 668906 mov word ptr [esi],ax ds:002b:080e2fe8=????