IE7 0day Exploit analysis

The exploit for this vulnerability has two parts:

A. JavaScript Heap Spray Code and x86 Shellcode

B. A short of special Xml/span tag elements

The the ' I ' of this exploit is a combination of the shellcode and heap spray technology, as it is running, it'll be allocating memory blocks until it reaches address 0x0fff0000, the size of each memory blocks is 1MB, the shellcode would be Put in the address near the "end of".

Heap Spray:

The second part is the trigger of this vulnerability. The issue occurred in Mshtml.dll, IE uses this DLL to handle the Xml/span tags. This exploit used the special character & #2570; (hex:0x0a0a) to construct the value of SRC in the ' I <Image> label, like below:

When Mshtml.dll is processing such special xml/span tags, it'll allocate a structural memory block to handle th ESE elements. During the process, it'll release the "Memory Block" contains these elements but continue referring the blocks in the Next process, with the leak of sanity checks, this vulnerability would be trigged. This is a common object point overwrite tricks.

Here's the working flow of this exploit:

<1> Overwrite Object Point-> call to 0x0a0a0a0a

<2> Execute the Shellcode

<3>download the malware