$hell on Earth

The new function looks like this:
result = a1;
method_id = a1->method_id;
if ( !method_id || (v3 = method_id - 2) == 0 || v3 == 298 )
{
if ( a1->argc > 0 )
result = (_AS2_ARGS *)sub_441246(a1->this, (int *)a1->argv);
}
return result;
CVE-2016-0196 – Microsoft Windows xxxEndDeferWindowPosEx
Window Use-After-Free Vulnerability
With code execution within the browser due to the type confusion vulnerability, it was time to escalate
privileges. Again, a kernel vulnerability was used for this. The vulnerability is a use-after-free in the win32k
subsystem of a WND object. This type of use-after-free vulnerability is incredibly common due to userland
callbacks. Specifically, kernel code that does not increase reference counts to objects prior to calling a
userland callback would often end up maintaining a stale reference.
The issue lies in the way PostIAMShellHookMessageEx handles WND objects. The safe way of interacting
with a WND object is to store the HWND, which is just a HANDLE to a WND, and use calls to ValidateHwnd
to get a pointer to the actual window object. PostIAMShellHookMessageEx uses a HWND to directly grab
the pointer from the kernel object table. As a result, it skips the checks that ValidateHwnd performs,
such as verifying that the object is still valid. The end result is that a userland callback can be hijacked to
destroy the window within the callback, leading to a use-after-free vulnerability.
34 | <strong>$hell</strong> on Earth: From Browser to System Compromise