4

I've been reading a lot about Use-after-free and came across this document. It talks about a "Lookaside" injection exploit. The document says to empty the dynamic memory cache, called the Lookaside Linked-List. Then allocate two memory slices of the same size as the object that causes the UAF. Next, fill one of them with shellcode and delete them in a certain order (the shellcode one first). Since the Lookaside is a linked-list,when the UAF object is deleted, this results in the UAF object's vtable pointing to the first deleted object and then that object's vtable pointing to the shellcode object. When the UAF is triggered (vtable is dereferenced) the shellcode is executed. This is my understanding of it.

I was interested in testing this exploit out. I found online an exploit in IE8 (CVE-2013-0025), which is a UAF. I tested it on a Windows XP sp3 vm in which CVE-2013-0025 works, with the following script:

  <html>
   <head>
  <script>
    var data;
    var objArray = new Array(1150);
    setTimeout(function(){
      document.body.style.whiteSpace = "pre-line";
      for(var i =0; i<1150; i++){
          objArray[i] = document.createElement('span');
          objArray[i].className = data += enescape("%aaaa%aaaa");
      }
      setTimeout(function(){document.body.innerHtml = "boo"},50)},50)
</script>
</head>
<body>
<p> </p> <---space in par. is part of exploit
</body>
</html>

This exploit attempts to overrun the deleted object's memory. However I want to try to do this with the lookaside injection instead. I attempted to try to create two objects before the setTimeOut then delete them before the UAF object got deleted. However, I am not sure if I'm understanding how the Lookaside-injection works correctly.

I was wondering how to (or some hints on how to) convert this exploit to use the Lookaside injection, instead of trying to overwrite the old object (VFTABLE exploit)? If it cannot be done with this exploit, I was wondering how to create a toy C++ program as a POC for the lookaside injection? Lastly, I was wondering if the Lookaside injection works in Linux? I was unable to find a reference to this structure in Linux's heap management.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.