CVE-2014-0322 (MS14-012) Exploit

Recently, I have studied the heap spraying method for array objects such as intarray and int32array in JS. I have mentioned the method of array object heap spraying in the previous article. I will not repeat it here. Today, mainly to cve-2014-0322 this vulnerability as an example, let's take a look at the specific use of array object heap spraying, and how to convert the UAF type to any address read/write, at the same time, let's take a look at how to ensure that the IE vulnerability will not crash when used.

UAF can be converted to any address for read/write operations. It is nothing more than program flow control. It mainly refers to vulnerability-triggered point functions and subsequent processing processes. As long as there is a write operation on the released object memory, most of them can be used in the future. They can be combined with arrays to read and write arbitrary addresses.

The benefits of converting to any address read/write are easier process control and subsequent triggering of shellcode. In this example, the shellcode trigger draws on the shellcode trigger idea in the original sample. All of them modify pvftable and then call the corresponding Array Function to trigger shellcode.

For how to ensure that the IE vulnerability will not crash after being exploited, we can now think of using the temporary stack constructed by the drop operation to redirect to achieve the use of shellcode, restores ESP to the original stack space, restores the modified memory, and finally JMP to the correct Array Function. This method has its own limitations, but it also has its advantages. The limitation is that for different functions, there may be requirements for registers, and the EBP minus value is not fixed when its ESP is restored, and hard encoding is required as needed. The advantage is that the choice of a function is in our hands. Only one function can implement this method, which is universal, because the internal call process of the same function is certain, in this way, the recovery process is relatively simple. The Code is as follows: win7 + ie10.

　　
CVE-2014-0322 (MS14-012) Exploit