Writing Exploits with the Elderwood Kit (Part 2)
Summary: Trail of Bits analyzed the Elderwood kit's exploit for CVE-2012-4792, in which the kit user overwrote a freed CButton object by targeting the 21st allocation from the Low Fragmentation Heap after 3000 string allocations and 500 button elements were used to shape the heap. Testing on a Windows XP system with the required Internet Explorer, Flash and Java versions found the exploit achieved payload execution in 60% of attempts under ideal conditions, dropping to about 50% without the heap-hole operations.
Bottom line: Nearly half of the website visitors this exploit should have compromised were not, because the author assumed the freed CButton object would always sit at a fixed position in the freelist rather than understanding heap behavior. The campaign still continued, which suggests reliable exploit code was never a requirement for this group's strategic website compromises.
Read the original at Trail of Bits Blog ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2012-4792
- Related
- CVE-2012-4792: Microsoft Internet Explorer Use-After-Free Vulnerability Known Exploited Vulnerabilities · Jul 23, 2024Threat Spotlight: Group 72 Cyber Risks ·Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026