+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Used with permission by san[at]xfocus.org:
------------------------------------------

The recent wmf vul is really fun, I found some interest things after
analysed it. I attached a very simple wmf file(64 bytes) which can crash
your explorer. You can simply change those 0xcc to your shellcode.

An attach wmf file constructs with a 18 bytes metafile header which
defined as following:

typedef struct _WindowsMetaHeader
{
  WORD FileType; /* Type of metafile (0=memory, 1=disk) */
  WORD HeaderSize; /* Size of header in WORDS (always 9) */
  WORD Version; /* Version of Microsoft Windows used */
  DWORD FileSize; /* Total size of the metafile in WORDs */
  WORD NumOfObjects; /* Number of objects in the file */
  DWORD MaxRecordSize; /* The size of largest record in WORDs */
  WORD NumOfParams; /* Not Used (always 0) */
} WMFHEAD;

and two data records which defined as following:

typedef struct _StandardMetaRecord
{
    DWORD Size; /* Total size of the record in WORDs */
    WORD Function; /* Function number (defined in WINDOWS.H) */
    WORD Parameters[]; /* Parameter values passed to function */
} WMFRECORD;

Somethings that we need to attention:

1. FileSize of _WindowsMetaHeader is in WORDs, don't forget to divide 2;
2. the attack file is larger than 64 bytes;
3. the last record always has a function number of 0000h, a Size of
00000003h, and no Parameters array;
4. the attack record has a function number of 0626h, which defined in
wingdi.h. 26h is important, it will flow to Escape function. I found
it will lead to SetAbortProc only the Parameters[0] is 0009h.

.text:77C4B65C loc_77C4B65C: ; CODE XREF: PlayMetaFileRecord+43#j
.text:77C4B65C ; DATA XREF: .text:off_77C769FE#o
.text:77C4B65C push [ebp+uFlags] ; case 0x26
.text:77C4B65F push ebx
.text:77C4B660 call sub_77C4B68A
.text:77C4B665 cmp eax, edi
.text:77C4B667 mov [ebp+var_4], eax
.text:77C4B66A jnz loc_77C4B424
.text:77C4B670 mov ax, [ebx+6]
.text:77C4B674 cmp ax, 0Fh
.text:77C4B678 jnz loc_77C5FC0A ; flow to Escape
...
.text:77C61062 loc_77C61062: ; CODE XREF: Escape+ECB7#j
.text:77C61062 sub edi, 6
.text:77C61065 jz short loc_77C61090 ; it flow to SetAbortProc only the Parameters[0] is 0009h
...
.text:77C543E7 loc_77C543E7: ; CODE XREF: SetAbortProc+54#j
.text:77C543E7 ; SetAbortProc+10720#j
.text:77C543E7 xor eax, eax
.text:77C543E9 mov [esi+14h], edi ; write callback pointer?
...
.text:77C604C8 owned: ; CODE XREF: sub_77C4B09C+1E4#j
.text:77C604C8 mov eax, [eax+14h] ; the pointer
.text:77C604CB cmp eax, ecx
.text:77C604CD jz loc_77C4B286
.text:77C604D3 push ecx
.text:77C604D4 push edi
.text:77C604D5 call eax ; got it

Best Regards
--
san <san[at]xfocus.org>
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++