Flash Broker-Based Sandbox Escape via Timing Attack Against File Moving

2015-08-19T00:00:00
ID EDB-ID:37842
Type exploitdb
Reporter KeenTeam
Modified 2015-08-19T00:00:00

Description

Flash Broker-Based Sandbox Escape via Timing Attack Against File Moving. CVE-2015-3081. Remote exploit for windows platform

                                        
                                            Source: https://code.google.com/p/google-security-research/issues/detail?id=280&can=1&q=label%3AProduct-Flash%20modified-after%3A2015%2F8%2F17&sort=id

FlashBroker - BrokerMoveFileEx TOCTOU IE PM Sandbox Escape

1. Windows 8.1 Internet Explorer Protected Mode Bypass in FlashBroker

FlashBroker is vulnerable to NTFS junction attack to write an arbitrary file to the filesystem under user permissions.

There is a race condition in FlashBroker BrokerMoveFileEx method. This race can be won by using an oplock to wait for the point where the BrokerMoveFileEx method opens the original file and then making destination to be a junction.

The PoC writes calc.bat to startup folder. It has been tested by injecting the dll into 32-bit low integrity level IE process with Adobe Flash Player 16.0.0.305 (KB3021953) installed. It does not work in IE11 EPM as it needs to write normally to the temporary folder to setup the junction.

2. Credit
Jihui Lu of KeenTeam (@K33nTeam) is credited for the vulnerability.

https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/37842.zip