https://iamelli0t.github.io/tags/ie/Recent content in Ie on iamelli0t's blogHugoenSat, 10 Apr 2021 00:00:00 +0000https://iamelli0t.github.io/2021/04/10/RPC-Bypass-CFG/Sat, 10 Apr 2021 00:00:00 +0000https://iamelli0t.github.io/2021/04/10/RPC-Bypass-CFG/<p>The general method of browser render process exploit is: after exploiting the vulnerability to obtain user mode arbitrary memory read/write primitive, the vtable of DOM/js object is tampered to hijack the code execution flow. Then VirtualProtect is called by ROP chain to modify the shellcode memory to PAGE_EXECUTE_READWRITE, and the code execution flow is jumped to shellcode by ROP chain finally. After Windows 8.1, Microsoft introduced CFG (Control Flow Guard)[1] mitigation to verify the indirect function call, which mitigates the exploitation of tampering with vtable to get code execution.<br></p>https://iamelli0t.github.io/2021/03/12/CVE-2021-26411/Fri, 12 Mar 2021 00:00:00 +0000https://iamelli0t.github.io/2021/03/12/CVE-2021-26411/<p>In January of this year, Google and Microsoft respectively published blogs revealing attacks on security researchers by an APT group from NK[1][2]. A vulnerability in Internet Explorer used in this attack was fixed as CVE-2021-26411 in Microsoft&rsquo;s Patch Tuesday this month[3]. The vulnerability is triggered when users of the affected version of Internet Explorer access a malicious link constructed by attackers, causing remote code execution.</p> <h2 id="root-cause-analysis">Root cause analysis</h2> <p>The POC which can trigger the vulnerability is shown below:</p>