$hell on Earth

Exploitation of CVE-2016-0175
Although this seems limited, this was used to increase the size of a window object’s extra bytes. Once
a window object’s extra bytes were modified, calls to SetWindowLongPtr were used to set the size and
address of another window object’s window text. At that point, arbitrary reads were performed through
calls to InternalGetWindowText and arbitrary writes were performed through calls to NtUserDefSetText.
Exploitation at this point occurred by using the arbitrary reads to find the SYSTEM process in order to
steal the SYSTEM token and apply it to the current process. From there, IsPackagedProcess on the
current process was unset and a new process was created as SYSTEM.
CVE-2016-0175 Patch
Microsoft patched this by changing bDeleteLoadRef, such that the return value now matches whether or
not font resources were freed.
Here is the original version of bDeleteLoadRef:
if ( v9 )
{
PFFOBJ::vKill(v5);
v4 = 1;
}
return *(_DWORD *)(*(_DWORD *)v5 + 44) == 0 ? v4 : 0;
Note that v4 is set in the block that also calls vKill. However, the return value is dependent on the reference
count of v5.
After the patch, the return value of bDeleteLoadRef is dependent solely on whether or not vKill was called.
if ( v9 )
{
PFFOBJ::vKill(v5);
v4 = 1;
}
return v4;
46 | <strong>$hell</strong> on Earth: From Browser to System Compromise