Adobe Flash Player Exploit - AS3 opaqueBackground UAF

[Byte-ul]

The UaF memory coruption exists inside the AS3 "opaqueBackground" property

setter of the flash.display.DisplayObject class.

DisplayObject - Adobe ActionScript® 3 (AS3 ) API Reference

The DisplayObject source code is not published like the core AS3 classes, so

you have to view opaqueBackground setter in your disassembler.

Affected: Adobe Flash Player 9+ 32/64-bit (since Jun 2006)

Testing:

Open the test "calc.htm" file in your browser and press the button.

on Windows:

Calc.exe should be popped on desktop IE.

Calc.exe should be run as a non-GUI child process in metro IE.

Payload returns 0 from CreateProcessA("calc.exe") inside Chrome/FF sandbox.

You can run Chrome with the --no-sandbox switch to pop the calc.

on OS X:

Calculator is launched in FF or standalone Flash Player projector.

Payload returns 1 from vfork() in Safari/Chrome sandbox (see console logs).

Download: Adobe exp 1.rar

Pass: 123456789

Edited July 11, 2015 by Byte-ul