Microsoft Internet Explorer 11 - WeakMap Integer Divide-by-Zero

Recently i was playing wit the WeakMap implementation in IE11. The following code caused the browser crash:

(1c58.20c0): Integer divide-by-zero - code c0000094 (!!! second chance !!!)
eax=00aee241 ebx=059f8cc0 ecx=059f8cc8 edx=00000000 esi=059f8cc8 edi=05171aa0
eip=668756f0 esp=06a6bcbc ebp=06a6bccc iopl=0         nv up ei pl nz na pe nc
cs=0023  ss=002b  ds=002b  es=002b  fs=0053  gs=002b             efl=00010206
jscript9!JsUtil::WeaklyReferencedKeyDictionary,1>::TryGetValueAndRemove+0x1f:
668756f0 f736            div     eax,dword ptr [esi]  ds:002b:059f8cc8=00000000
0:020> k
ChildEBP RetAddr 
06a6bccc 66874949 jscript9!JsUtil::WeaklyReferencedKeyDictionary,1>::TryGetValueAndRemove+0x1f
06a6bcec 668a28ca jscript9!Js::JavascriptWeakMapData::Delete+0x2c
06a6bd10 66537530 jscript9!Js::JavascriptWeakMap::EntryDelete+0xc5
06a6c058 66537028 jscript9!Js::InterpreterStackFrame::Process+0x1e3c
06a6c174 06550fe9 jscript9!Js::InterpreterStackFrame::InterpreterThunk<1>+0x1e8
WARNING: Frame IP not in any known module. Following frames may be wrong.
06a6c180 665319eb 0x6550fe9
06a6c1c0 66532032 jscript9!Js::JavascriptFunction::CallFunction<1>+0x88
06a6c22c 66531f84 jscript9!Js::JavascriptFunction::CallRootFunction+0x93
06a6c274 66531f0b jscript9!ScriptSite::CallRootFunction+0x42
06a6c298 66592bce jscript9!ScriptSite::Execute+0x6c
06a6c320 6660da36 jscript9!ScriptEngine::ExecutePendingScripts+0x1ab
06a6c3a8 6660eeb8 jscript9!ScriptEngine::ParseScriptTextCore+0x29c
06a6c3f8 56866ba5 jscript9!ScriptEngine::ParseScriptText+0x5a
06a6c430 56866ce1 MSHTML!CActiveScriptHolder::ParseScriptText+0x42
06a6c480 565ea155 MSHTML!CJScript9Holder::ParseScriptText+0x6d
06a6c4e8 56867fa3 MSHTML!CScriptCollection::ParseScriptText+0x155
06a6c5d4 56867bf3 MSHTML!CScriptData::CommitCode+0x2d0
06a6c64c 568679db MSHTML!CScriptData::Execute+0x1fe
06a6c660 5655ed1b MSHTML!CHtmScriptParseCtx::Execute+0x8b
06a6c6d8 56518d27 MSHTML!CHtmParseBase::Execute+0x135
06a6c7fc 565efece MSHTML!CHtmPost::Exec+0x474
06a6c814 565efe52 MSHTML!CHtmPost::Run+0x1c
06a6c834 565f11a2 MSHTML!PostManExecute+0x61
06a6c848 565f1103 MSHTML!PostManResume+0x7b
06a6c878 565e152f MSHTML!CHtmPost::OnDwnChanCallback+0x38
06a6c888 56499bb4 MSHTML!CDwnChan::OnMethodCall+0x19
06a6c8cc 56481c3a MSHTML!GlobalWndOnMethodCall+0x12c
06a6c918 74e562fa MSHTML!GlobalWndProc+0x115
06a6c944 74e56d3a user32!InternalCallWinProc+0x23
06a6c9bc 74e577c4 user32!UserCallWinProcCheckWow+0x109
06a6ca1c 74e5788a user32!DispatchMessageWorker+0x3bc
06a6ca2c 574dbe78 user32!DispatchMessageW+0xf
06a6fbec 5753358f IEFRAME!CTabWindow::_TabWindowThreadProc+0x445
06a6fca4 75f01b7c IEFRAME!LCIETab_ThreadProc+0x31c
06a6fcb4 695431cc iertutil!CIsoScope::_InitManagerEntanglementLock+0x53
06a6fce0 75cb338a IEShims!NS_CreateThread::DesktopIE_ThreadProc+0x71
06a6fcec 773e9f72 kernel32!BaseThreadInitThunk+0xe
06a6fd2c 773e9f45 ntdll!__RtlUserThreadStart+0x70
06a6fd44 00000000 ntdll!_RtlUserThreadStart+0x1b

It is caused by a division by zero, so the bug is not exploitable, only a simple DoS.

CVE-2014-3788 and MS14-028

Zero Day Initiative (ZDI) has published another advisory for a heap buffer overflow vulnerability in Cogent DataHub webserver that i found. The bug occured when passing a negative value in the Content-Length header. The original advisory can be read here ZDI-14-135.

Recently i also have been acknowledged by Microsoft for responsible disclosure (through SSD) of two denial of service vulnerabilities affecting the iSCSI Target (CVE-2014-0255 and CVE-2014-0256). MS Bulletin can be found here MS14-028.

Browser Shredders

Blog for a project that i'm a part of has been finally published - http://browser-shredders.blogspot.com. The research has started some time ago, and we already had some nice findings, currently there is not so much content, but this will change after the Hack in The Box talk which will be presented by my two colleges: http://haxpo.nl/hitb2014ams-pilorz-zmyslowski/.

ZDI-13-252 - Cogent DataHub Heap Overflow Remote Code Execution Vulnerability

Zero Day Initiative (ZDI) has published an advisory for a heap overflow vulnerability in Cogent DataHub which i have found few months ago. Full advisory can be read here ZDI-13-252.

Earlier this year i have also found some null pointer dereference bugs leading to a denial of service in DataHub. I will post some PoC's soon.

Funny sudo bug

Around a month ago i was performing a task where i needed to create a user with a very large UID in the system. The required UID happened to be 2147483648 (0x80000000) exactly.

root@hive:~# adduser -u 2147483648 test1

Next i switched to the newly created user and typed sudo.

test1@hive:/$ su test1
test1@hive:/$ sudo

And this was the result:

test1@hive:/$ sudo
sudo: perm stack underflow: Invalid argument
sudo: unknown uid: 2147483647
Segmentation fault

We can see here that the UID value was wrapped to the 2147483647 value (0x7fffffff) followed by a segfault.

We can have some fun with it e.g. creating a user with the 0x7fffffff UID. This way sudo will no longer crash, but it will be called for a different user : ). The bug was tested on the 1.8.5p2 version 32-bit OS. Additional details can be found in the bug report.

Skype Malware Analysis

When i came back from work today and fired up Skype, multiple messages popped up immediately. Some of them in in English and some in Polish, but all leading to the same url with "pictures" of me ; oo. Another interesting fact was that all the messages came from people working at the same company (zomg APT alert ;D).

The messages looked like this:

Messages in English and Polish encouraging to visit the links

We check what is behind the url shortener:

zip file !

Crunchpress seems to be a 'hacked' website:

crunchpress image folder with some aditional content

Lets download and unzip it:

Oh noez! no pics just exe : (

Quick scan @ virustotal.com gives 7/44 and identifies the file as a dropper:

virustotal results

Not surprisingly it downloads something using HTTP protocol:

Actual bad stuff downloaded here

Let's see what we have there. First some quick geo localization request:

hi ho

Next a list of 'unwanted' domain names is downloaded (full list available here).

Anonymous port scanning using proxychains and tor

When testing a web application or doing a reconnaissance Tor Browser Bundle is all we need to hide our true identity, but what about other activities? In this short post i will explain how to stay anonymous during port scanning. We will need the following tools to achieve this goal:

• tor,
• proxychains,
• nmap. 

Proxychains is a proxifier supporting HTTP, SOCKS4 and SOCKS5 proxies. It is shipped with BackTrack Linux by default and already configured to use tor. You can verify this by looking up /etc/proxychain.conf, last line should be like this:

We are ready to fire up nmap:


Now, let me explain what happened there. We run nmap thru proxychains with the following options:

• -sT - full TCP connection scan
• -PN - do not perform host discovery
•  -n - never perform DNS resolution (to prevent DNS leaks from tor)
• -sV - determine service version/info
• -p - ports to scan (for testing purposes i only gave 3 ports to scan, proxying a portscan thru tor makes it really slow, so perhaphs --top-ports  option should be taken in consideration)
• - self explanatory

In the scan log we can see the "chain" that goes from 127.0.0.1:9050 (tor proxy) to our scanned host. It is possible that we will encounter a situation where this scan fails, because tor endpoints are often blocked (the reason is spam or other malicious activity). The solution may be adding a common, public proxy to the "chain". We can do that by simply editing the proxychains.conf and adding a new entry at the end of the [ProxyList] (be sure that random_chain option is disabled).

That's all for tonight, hope somebody will find this information useful.