逆向工程 - 免费使用 - 示例 - 吾爱随笔录

这些天使用 After Free错误变得越来越严重。

我计划使用VTable overwrite演示 Use After Free 漏洞利用。所以，我正在尝试创建一个ATL ActiveX 控件，它容易受到使用Internet Explorer 9 或 10 的Use After Free 错误的影响。

我很难想出一个可用的免费使用后易受攻击的代码。有没有人有这种错误的经验，任何人都可以尝试帮助我。

我也在努力如果我能够让它工作，我会在这里分享：

class User
{
  public:
    virtual void SetUsername() { }
};

class NewUser:public User
{
  char username[20];
  public:
    virtual void SetUserName(char* strUsername) { strcpy(username, strUsername); }
    virtual char* GetUserName() { return username; }
};

STDMETHODIMP CATLActivexControl::CreateUser(BSTR sUserName, DOUBLE* retVal)
{
  USES_CONVERSION;
  char *tmp = W2A(sUserName);
  NewUser *nuser = new NewUser;
  nuser->SetUserName(tmp);

  free(nuser);

  char *xyz = nuser->GetUserNameW();
  return S_OK;
}

我研究了上面的例子，我想出了一个更好的解决方案，它真正触发了“免费使用”。

C++代码

#include "stdafx.h"
#include "ATLStudentActiveXControl.h"

// Virtual Function defination
class User
{
public:
    virtual void Add(char* uName) = 0;
    virtual char* GetName() = 0;
};

class Student : public User
{
private:
    char s_name[30];

public:
    virtual void Add(char* uName) { strncpy(s_name, uName, sizeof(s_name)); }
    virtual char* GetName() { return s_name; }

};

Student *pStudent = new Student;

STDMETHODIMP CATLStudentActiveXControl::Add(BSTR sName)
{
    USES_CONVERSION;
    char *tStudent = W2A(sName);
    pStudent->Add(tStudent);
    return S_OK;
}

STDMETHODIMP CATLStudentActiveXControl::Delete()
{
    free(pStudent);
    return S_OK;
}

STDMETHODIMP CATLStudentActiveXControl::GetName(BSTR* sName)
{
    char *tStudent = pStudent->GetName();
    *sName = A2WBSTR(tStudent);
    return S_OK;
}

HTML代码

<HTML>
<HEAD>
<TITLE>Use After Free - Test Page</TITLE>
<script language="javascript" type="text/javascript">
    function UAF() {
        alert('Start');

        // Assign _studentActiveX variable to ATLStudentActiveXControl
        var _studentActiveX = document.getElementById("ATLStudentActiveXControl");

        // Add a student
        _studentActiveX.Add("StudentName");

        // Uncomment the below line to trigger Use After Free vulnerability
        // _studentActiveX.Delete();

        // Get the name of the added student
        var _studentName = _studentActiveX.GetName();
        alert(_studentName);

        // Delete the student
        _studentActiveX.Delete()

        alert('Done');
    }
</script>
</HEAD>
<BODY>
<OBJECT ID="ATLStudentActiveXControl" CLASSID="CLSID:9EACDFCF-1A2E-462E-9DF6-53E03936DB22"></OBJECT>
<div>
    <p>Demonstrating <b>Use After Free</b> vulnerability.</p>
    <input type="button" onclick="UAF();" value="Use After Free" />
</div>
</BODY>
</HTML>

请分享您的看法。谢谢。