3

Use After Free bugs a getting more severe these days.

I'm planning to demonstrate Use After Free bug exploitation using VTable overwrite. So, I'm trying to create a ATL ActiveX Control which is vulnerable to Use After Free bug using Internet Explorer 9 or 10.

I'm having trouble to come up with a Use After Free vulnerable code that works. Does anyone has experience with this kind of bug and can anyone try to help me.

I'm trying too. If I'm able to get it working, I'll share it here:

class User
{
  public:
    virtual void SetUsername() { }
};

class NewUser:public User
{
  char username[20];
  public:
    virtual void SetUserName(char* strUsername) { strcpy(username, strUsername); }
    virtual char* GetUserName() { return username; }
};

STDMETHODIMP CATLActivexControl::CreateUser(BSTR sUserName, DOUBLE* retVal)
{
  USES_CONVERSION;
  char *tmp = W2A(sUserName);
  NewUser *nuser = new NewUser;
  nuser->SetUserName(tmp);

  free(nuser);

  char *xyz = nuser->GetUserNameW();
  return S_OK;
}

I worked on the above example and I have come up with a nicer solution which really triggers Use After Free.

C++ code

#include "stdafx.h"
#include "ATLStudentActiveXControl.h"

// Virtual Function defination
class User
{
public:
    virtual void Add(char* uName) = 0;
    virtual char* GetName() = 0;
};

class Student : public User
{
private:
    char s_name[30];

public:
    virtual void Add(char* uName) { strncpy(s_name, uName, sizeof(s_name)); }
    virtual char* GetName() { return s_name; }

};

Student *pStudent = new Student;

STDMETHODIMP CATLStudentActiveXControl::Add(BSTR sName)
{
    USES_CONVERSION;
    char *tStudent = W2A(sName);
    pStudent->Add(tStudent);
    return S_OK;
}

STDMETHODIMP CATLStudentActiveXControl::Delete()
{
    free(pStudent);
    return S_OK;
}

STDMETHODIMP CATLStudentActiveXControl::GetName(BSTR* sName)
{
    char *tStudent = pStudent->GetName();
    *sName = A2WBSTR(tStudent);
    return S_OK;
}

HTML Code

<HTML>
<HEAD>
<TITLE>Use After Free - Test Page</TITLE>
<script language="javascript" type="text/javascript">
    function UAF() {
        alert('Start');

        // Assign _studentActiveX variable to ATLStudentActiveXControl
        var _studentActiveX = document.getElementById("ATLStudentActiveXControl");

        // Add a student
        _studentActiveX.Add("StudentName");

        // Uncomment the below line to trigger Use After Free vulnerability
        // _studentActiveX.Delete();

        // Get the name of the added student
        var _studentName = _studentActiveX.GetName();
        alert(_studentName);

        // Delete the student
        _studentActiveX.Delete()

        alert('Done');
    }
</script>
</HEAD>
<BODY>
<OBJECT ID="ATLStudentActiveXControl" CLASSID="CLSID:9EACDFCF-1A2E-462E-9DF6-53E03936DB22"></OBJECT>
<div>
    <p>Demonstrating <b>Use After Free</b> vulnerability.</p>
    <input type="button" onclick="UAF();" value="Use After Free" />
</div>
</BODY>
</HTML>

Please share your views. Thanks.

2
  • You might have already found link, but here is it, in case you haven't. – Dominik Antal Jul 1 '14 at 8:45
  • 1
    Yeah, I saw that link. That link is for normal console program, but I'm trying to implement UAF in ATL ActiveX control. – john4tech Jul 1 '14 at 8:48
3

The first thing that comes to my mind is for you to create a class with a few virtual methods, which will be used as the test subject. Then from your ActiveX control you'd expose methods that manipulate the variable, say:

  • Method #1: Allocate the test object and keep the pointer in a static variable
  • Method #2: Call the virtual methods provided by the test object
  • Method #3: Free the test object instance, without setting the pointer to NULL
  • Some means to allocate other things that would reuse the memory freed in the previous method

Then whip up a basic script exercising the given methods: allocate, call the methods to make sure it works as designed, free the instance, allocate something else, call virtual methods again and crash the IE instance. ;-) Should do the trick.

5
  • That is what I'm trying to achieve. But I'm planning to implement in such a way that it's easy for exploitation. Here is a small example, that I have created. But still wondering if that wold do the trick. – john4tech Jul 1 '14 at 11:12
  • 1
    This is what I have created. Use After Free - Rubbish Example – john4tech Jul 1 '14 at 11:12
  • 1
    You should have included this code in your question... It would have been way easier to answer from this. – perror Jul 1 '14 at 11:38
  • 1
    The main point is, the attacker has to get some control between the object being freed (the free(nuser); part in your example) and the dereference of the dangling pointer (I assume, the nuser->GetUserNameW(); call is supposed to be the "use" part). In your example, there is no chance for that. It would be better to expose an ActiveX method to solely do the nuser->GetUserNameW(); call, thus splitting the CATLActivexControl::CreateUser method in two. This way, you actually get a chance to overwrite freed memory. – Dmitry Janushkevich Jul 2 '14 at 7:09
  • I've edited the answer to reflect that those have to be separate methods. – Dmitry Janushkevich Jul 2 '14 at 7:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.