extraexploit memories

Months and years ago, I spent a lot of nights trying to expose what the cyber security was (is) on the field and not just from an academic point of view, although, my first blog post was quiet close to the academic point of view (the top cc tld called by conficker.C). A lot of posts never completed.  Other posts have been used by other researcher. Here i founded, thanks to mere random clicks sequences, a repository where I founded one of my most interesting (IMHO) posts in my past.. I spent nights to track and logs URLs , was a funny period where all was did just to try to show something. I don't know if this link is trusted or not, so any bad consequence, is not my fault:


"some considerations on Ettercap source code repository breach"

https://www.evernote.com/shard/s9/note/cb2b312e-1a9d-4b3f-91a2-385dfa2469e9/wishi/crazylazy#b=5370c944-5bb8-45c1-b73a-cfe46216db32&n=cb2b312e-1a9d-4b3f-91a2-385dfa2469e9

Another good entry was the BGPlay "movie" during the Egypt protest where Internet was obscured by the Egyptian authorities of that moment:

http://krebsonsecurity.com/2011/01/egypt-unplugged-from-the-internet/

I still remember that  "ugly" movie that I released, but was has been used by a lot of media agencies to show what happens  when a country is isolated by the rest of the World from a Internet connectivity point of view.

Other posts have been mentioned in security advisories and so on. I would like just to say thank you to all the people that in that time have followed me and thanks to them I learned still more. This is the 100th post. The last one :-). Thank you very much to all.

the last/final touch!

It's very sad to recognize and discover that the screenshots on my blog, which for some reason have been saved in the "Gallery" of my Android mobile phone, once cleared from there, will be deleted from the Google cloud! Someone could confirm this ? This blog has been to me a lot although I have ceased to update it ... but with this last touch .. I almost want to finalize it.

what remains of my blog:
http://wayback.archive.org/web/*/http://extraexploit.blogspot.com/

DigiNotar facts - just some links

DigiNotar Certificate Authority breach “Operation Black Tulip”

http://t.co/VC91bjo 

DigiNotar CA compromise
http://community.websense.com/blogs/securitylabs/archive/2011/08/30/diginotar-ca-compromise.aspx 

Certificate hacker probably paid by Iran, say victimised firms
http://computerworld.co.nz/news.nsf/security/certificate-hacker-probably-paid-by-iran-say-victimized-firms

DigiNotar breach - the story so far
http://isc.sans.edu/diary.html?storyid=11500

Iran-Backed Hackers Gained Access To Hundreds Of Giant Websites
http://www.businessinsider.com/diginotar-security-certificates-hacked-by-iran-google-yahoo-twitter-2011-9

Comodo Hacker Claims Credit for DigiNotar Attack

http://threatpost.com/en_us/blogs/comodo-hacker-claims-credit-diginotar-attack-090611 
 
DigiNotar Hacker Comes Out
http://www.f-secure.com/weblog/archives/00002231.html

DigiNotar hacker: I have access to four other certificate authorities
http://www.scmagazineuk.com/diginotar-hacker-i-have-access-to-four-other-certificate-authorities/article/211291/

Striking Back... Comodo Hacker paste
http://pastebin.com/1AxH30em

Fraudulently issued security certificate discovered

http://www.govcert.nl/english/service-provision/knowledge-and-publications/factsheets/factsheet-fraudulently-issued-security-certificate-discovered.html

Is This MITM Attack to Gmail's SSL ?
http://www.google.co.uk/support/forum/p/gmail/thread?tid=2da6158b094b225a&hl=en

Google, Mozilla and Microsoft ban the DigiNotar Certificate Authority in their browsers

http://www.zdnet.com/blog/security/google-mozilla-and-microsoft-ban-the-diginotar-certificate-authority-in-their-browsers/9337?tag=mantle_skin;content

Protecting yourself from attacks that leverage fraudulent DigiNotar digital certificates
http://blogs.technet.com/b/srd/archive/2011/09/04/protecting-yourself-from-attacks-that-leverage-fraudulent-diginotar-digital-certificates.aspx

DigiNotar: Iranians – The Real Target
http://blog.trendmicro.com/diginotar-iranians-the-real-target/

SSL certificates stolen for CIA, MI6, Mossad, and hundreds more by hackers in attack on DigiNotar
http://www.slashgear.com/ssl-certificates-stolen-for-cia-mi6-mossad-and-hundreds-more-by-hackers-in-hack-on-diginotar-05177056/?utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+slashgear+%28SlashGear%29

Operation Black Tulip: Fox-IT's report on the DigiNotar breach
 http://nakedsecurity.sophos.com/2011/09/05/operation-black-tulip-fox-its-report-on-the-diginotar-breach/?utm_source=twitterfeed&utm_medium=twitter&utm_source=twitterfeed&utm_medium=twitter

DigiNotar investigators uncover woeful security
http://www.scmagazine.com.au/News/271072,diginotar-investigators-uncover-woeful-security.aspx

DigiNotar Attack Analysis
http://sseguranca.blogspot.com/2011/09/diginotar-cassl-e-netnames-dns-ataques.html

Why Diginotar may turn out more important than Stuxnet 
http://www.securelist.com/en/blog/208193111/Why_Diginotar_may_turn_out_more_important_than_Stuxnet

Operation Shady RAT - HTran

HTran and the Advanced Persistent Threat
http://www.secureworks.com/research/threats/htran/

The code  http://www.pudn.com/downloads119/sourcecode/windows/network/detail508294.html.
(appears also in the Secureworks analysis)

What follows it's an abstract of the code:

an old bug for a new job ? CVE-2004-0194

A couple of months ago I receive an interesting challenge for get the final (I think) step in the job selection path for a big company (not a well known exploit research company but probably if you are reading this post you are using once of their os). The challenge it consist in the writing an exploit for the CVE-2004-0194. Obviously, at the first step I did follow, was a good googling acrivity. With my surprise I didn't get anything. I did found only the original advisory in a lot of version . The original is at the following link http://archives.neohapsis.com/archives/vulnwatch/2004-q1/0051.html that is an old NGSSoftware Insight Security Research Advisory:

This issue was detected in the 5.1 version of Adobe Reader (if you want try you cand find it here: http://www.oldversion.com/download/acrobat51.exe).This issue was related to a bug that it's triggered due a misuses of sprintf for format the OutputDebugString during the XFDF parsing. The origianl XFDF schema use the UTF-8 encoding. For fit well the unicode shell code via Metasploit module I have to choose another encoding like this one:

<?xml version="1.0" encoding="ISO-8859-1"?>
Anyway what follows is the proof of concept that launch calc.exe For this task I have used a SEH Overwriting technique using the code of not safeseh DLLs.

Also it’s possible download the poc from here: http://www.exploit-db.com/exploits/17488/. Anyay what did happens ? Well if I'm still updating this blog is because I haven't get this job although their compliments. Anyway what I did learn? I learn how to write up unicode shell code and that sometimes the encoding techniques are your best friends. What is sound strange is that the cve id is very near to my nightmare: cve-2010-4091. 

So, why I decided to post just now this stuff ? I dunno why . Enjoy it!
Greeting to 0xff for open my mind to the bytes encoding landscape (http://whsbehind.blogspot.com)

TDSS - SRVs list

I just found via pastebin (http://pastebin.com/jWDhEfGB) a domains list related to TDSS. The SRVs , in according with this analysis http://resources.infosecinstitute.com/tdss4-part-2/, are the C&C from where bots receive commands.What's sound a bit strange is that the content in the pastebin above match with the syntax used in the configuration file of the rootkit. Anyway is possible count 2514 entry (or config file ?). I simply sorted the domains reported with the following result:

https://01n02n4cx00.cc/
https://01n02n4cx00.com/
https://01n20n4cx00.com/
https://0imh17agcla.com/
https://10n02n4cx00.com/
https://178.17.164.129/
https://178.17.164.92/
https://1il1il1il.com/
https://1l1i16b0.com/
https://34jh7alm94.asia
https://34jh7alm94.asia/
https://4gat16ag100.com/
https://4tag16ag100.com/
https://61.61.20.132/
https://61.61.20.135/
https://68.168.212.20/
https://68.168.212.21/
https://68b6b6b6.com/
https://69b69b6b96b.com/
https://7gaur15eb71.com/
https://7uagr15eb71.com/
https://86b6b6b6.com/
https://86b6b96b.com/
https://91.193.194.8/
https://91.212.226.67/
https://91.216.122.250/
https://9669b6b96b.com/
https://cap01tchaa.com
https://cap01tchaa.com/
https://cap0itchaa.com/
https://countri1l.com/
https://dg6a51ja813.com/
https://gd6a15ja813.com/
https://i0m71gmak01.com/
https://ikaturi11.com/
https://jna0-0akq8x.com/
https://ka18i7gah10.com/
https://kai817hag10.com/
https://kangojim1.com/
https://kangojjm1.com/
https://kur1k0nona.com/
https://l04undreyk.com/
https://li1i16b0.com/
https://lj1i16b0.com/
https://lkaturi71.com/
https://lkaturl11.com/
https://lkaturl71.com/
https://lo4undreyk.com/
https://n16fa53.com/
https://neywrika.in/
https://nichtadden.in/
https://nl6fa53.com/
https://nyewrika.in/
https://rukkeianno.com/
https://rukkeianno.in/
https://rukkieanno.in/
https://sh01cilewk.com/
https://sho1cilewk.com/
https://u101mnay2k.com/
https://u101mnuy2k.com/
https://xx87lhfda88.com/
https://zna61udha01.com/
https://zna81udha01.com/
https://zz87ihfda88.com/
https://zz87jhfda88.com/
https://zz87lhfda88.com/

Anoter interesting Google dork is "wsrv:=http://" that shown another Pastebin link with a WSRVs domain lists. The WSRVs are the handlers of results of the search provider activity on impacted systems.

DroidKungFu - just some piece of code

Following the trend of the moment, I play a bit with the sample of DroidKungFu retrieved from the  contagiodump malware sample repository. For obtaining the JAR archive I used dex2jar (http://code.google.com/p/dex2jar/downloads/list) after that I extracted the Dalvik Executable Format embedded in the APK. Once obtained the JAR file is very easy obtain the clear code with (for example) Java Decompiler
One of the more interesting thing is that , at least the variant that I analyzed (md5 39D140511C18EBF7384A36113D48463D) use the method DoSearchReport notified using the well know Google Search gadget. Seems that this malware install as legacy app for grant persistence even after remove the rest of malicious packages from device. This is easily readable from the source code as shown in the following screen shots:

In the screenshot above is shown the  begin of DoSearchReport method where is called a custom method named  (updateInfo() ). While the following screenshot shown the place in the DoSeachReport method where all data , collected from impacted devices, are dropped via HTTP POST:

The data collected and sended to the URL are the following (extracted by code):

Some info about the URL (from Robtex):

Other domains related to the 222.186.37.93 IP address: 

Playing a bit more with the URL above I found this IP form request:

This variant seems forged for Chinese users. In the code there are many others evidence of this.

FlashUtil10m_Plugin.exe command line crash

Is interesting observing how nowadays some old style bug are still available. I think that this one is not a security bug but a deeper investigation is left to all whose are interested.Anyway is sufficient pass a single char as command line parameter to this FlashUtil10m_Plugin.exe (also called Flash Player Installer/Uninstaller) for generate a crash. If you are Admin appear something like the following screenshot:

Opening it with a disassembler (in this case IDA) is possible know that is a problem within the parser that handle the command line parameters:

In screen shot above is reported  the function address where the bug is triggered. While in the following screen shot is shown the line of code where is tried an write in an address of kernel32.dll a not readable address:

This bug impact Adobe Flash Player Installer/Uninstaller 10.2 r152 distributed with the latest version of Adobe Flash Player..

cve-2011-0609 - bugix blog analysis

April 4, 2011 - Update:
RSA has release a blog post where is described that in the recently data-breach is been used this issue:
http://blogs.rsa.com/rivner/anatomy-of-an-attack/

March 15, 2011: 
A researcher has just added a very interesting analysis about this 0day:

bugix blog cve-2010-0609 analysis - by villys777
http://bugix-security.blogspot.com/2011/03/cve-2011-0609-adobe-flash-player.html

Adobe Security Advisory APSA11-01
http://www.adobe.com/support/security/advisories/apsa11-01.html

mmspicture.ru - mobile malware depot

Following a well known mailing list (clean-mx aka viruswatch) it was been retrieved the following URL:

http://mmspicture.ru/mms112/mms112.jar (md5: 33EA90E2029478D47D33409B5F48E4EB)

The JAR file is already detected from Virustotal. Playing a bit around the URL path is possible retrieve another JAR file:

http://mmspicture.ru/mms113/mms113.jar

The MD5 (4CC0EBCE1428EE3649C67A13734F2EDE) of this JAR file is not still known around. Anyway, what follows is just a quick analysis of the contents of this file. Open it with Java Decompiler appears like a canonical small JAR apps for mobiles devices (Midlet class):

The main class is named "b" and is extended from Canvas Java class:

As shown above is possible view some Cyrillic strings:

Is also show a reference to a stream (embedded in the JAR) named "info.dat". The code above use this file for decode the stream that as we'll see is the destination phone number of the data gathered from mobile devices. The "info.dat" contains the following string:  75;4x=1?==8:<95

I write a small Java app that use the code for decoding the stream:

The output revealed is the following:

The string obtained is the phone destination number used for receive SMS from the user mobile devices. The content of the SMS body is still under investigation. Probably it send entire phonebook as well the phone number could be a payment number. The SMS is send when the user accept to view the picture in the postcard ("card.png") embedded in the JAR. There is also a file named "readme" which contains an ICQ id:

In according with the countrycode.org web site (http://countrycode.org/russia) the number "+7 497 878542104" is a Russian phone number. Another detail is that the domain mmspicture.ru is attested on one IP (91.201.66.209) where is attested another interesting domain:

Egypt Telecom back online– ASN8452 TE DATA– prefix 81.10.0.0/17

The prefix 81.10.0.0/17 “ALL-Routes” seems announced again to the rest of the world via Telecom Italia Sparkle Autonomous System (ASN 6762). Here the animation made  with BGPlay:

The time range is between the 29 of January 2011 00:00 and 2 of February 2011 08:00 PM (local time). For more info on bgplay see my previous post http://extraexploit.blogspot.com/2011/01/egypt-telecom-as-isolation-bgplay-show.html.

Egypt Telecom AS isolation - BGPlay show it ?

January 31, 2011 – Update:
An interesting snapshot of Egyptian's malware activity. ASN 20928 appears like still active

Egypt's malware activity post internet shutdownhttp://www.unveillance.com/latest-news/egypts-malware-activity-post-internet-shutdown/

Why One Egyptian ISP is Still Online
http://newsgrange.com/why-one-egyptian-isp-is-still-online/

January 29, 2011 – Update:

I try to make the following video to shown what's  happened. BGP Isolation "frame by frame":

January 28, 2011:

Following isolation of the Internet in Egypt, I tried to see if is possible see something with a good tool: BGPlay. As input data I inserted AS8452 (Egypt Telecom) prefix labeled as "all routers". This information I obtained via robtex as follows: http://www.robtex.com/as/as8452.html#bgp. So, the inserted data are the prefix 81.10.0.0/17 and the range date/time in latest 24h:

The result is interesting. For an animation could be better try to insert the value using BGPlay directly. (http://bgplay.routeviews.org/)

The BGP traffic situation at 27/01/2011:

After the BGP withdrawals sequence the situation, now, appear in this mode:

 

The RIPE has also released a tool for check BGP withdrawals and announment requests:

http://stat.ripe.net/egypt/

the sourceforge entry point seems still active

February 3, 2011 - Update:

A discussion on e107 official web site: http://e107.org/comment.php?comment.news.878


February 2, 2011 - Update:

Just another evidence of the sourceforge breach used by a web bot. At least , from the following screenshot, seems that the entrypoint was detected by a web vuln scanner bot. The following figure shown a well known method by web bots to post in some pastebin clone web site the result of their work.

This pastie was released at the end of 2010. The bad thing is that OFF keyword tell to bots admin that php_safe is OFF


January 30, 2011 – Update:
Sourceforge has formally admitted the problems that I have notify in December 2010. My research and my message on full disclosure mailing list about the possible exploiting of a not so new e107 bug that could permit privilege escalation attempts, looks like confirmed. Here the update:

Sourceforge Attack: Full Report
http://sourceforge.net/blog/sourceforge-attack-full-report/

January 28, 2011 - Update:

On Hacker news is reported an update about and seem that the sourceforge server has been compromized:

Sourceforge servers compromised
http://news.ycombinator.com/item?id=2150639

The SourceForge response:
http://sourceforge.net/apps/wordpress/sourceforge/2011/01/27/sourceforge-net-attack-update/

January 22, 2011:

just now I found a post from Imperva http://blog.imperva.com/2011/01/major-websites-govmiledu-are-hacked-and-up-for-sale.html. Intrigued by their results, similar to that published in my previous post approximately one month ago (http://extraexploit.blogspot.com/2010/12/some-considerations-on-ettercap-source.html), I decided to do some check. I noticed that the entry point of source forge is still active. This is what seem possible from the error message that appears on this page. As you can see from this screen shot the problem seems reside in a project home page that include a bugged e107 version:



With further investigation is possible find the page where is placed the vulnerable (to a remote command execution issue) version of e107 . This entry point could be used from a remote script for send system command on the server (http://php-security.org/2010/05/19/mops-2010-035-e107-bbcode-remote-php-code-execution-vulnerability/index.html). The following screen shot is the well common form that expose sourceforge  to this vulnerability:



The problem is that this breach, if confirmed, can be exploited to modify source code so as to fail the trust levels of applications mantained by this software repository.

some considerations on Ettercap source code repository breach

Recently it’s been released a new issue of a zine called “owned and exposed” (http://www.exploit-db.com/papers/15823/). I have to admit I laughed a lot when I saw this picture.

I think that the picture above is the truth of what the security field is today. Anyway , ending my personal considerations, I would show you a mind map that I made during a past research on web bot based botnet and that could be useful to understand how is possible find and use entry point in some very important web sites. As starting point I decided to focusing all the big picture on a generic bot source code. Given a bot is possible,  Googling enough and with some scripting language knowledge, make the rest.

This mind map is not so obvious as well is not so clear what are the links with the title of this post. I will try to describe what I intend with this process represented by this mindmap . During a research of some months ago, I have try to identify 3 contexts where a researcher (color independent)  could be found useful information for raise the level of details. In other words, starting from a bot source code analysis , you are on the first context (1 code analysis). In this context the analysis has generated information like authors (not so useful in this case), code snippet (useful for googling for other bot derived from the analyzed bot for example), crew (again not so useful), and c&c server (VERY USEFUL).

So with code snippet and c&c server is possible try to find many more information. Specifically with a c&c server that command web based bot, sometimes, is possible looking what happens in the c&c channel and coding and running, for example, a fake bot for catching them. The fake bot is linked to the c&c channel (usually an irc server) and start to log everything. The analysis process of what was logged put your mind in the 2nd context (named “intelligence”) . What could be founded is shown in the leafs of 2nd context. From the information gathered from a c&c  is possible to  known, for example, what are the web sites exposed  to a particular Remote File Include. Collecting many of these web site your mind is leaded in the 3rd context.

Usually you have to decide only what do you want to do with the exposed website list obtained from the 2nd context and thanks to someone (bot admin) which launch , for example, bots specialized for scanning for checking if a web site is prone to a specific issue. What is the link with Ettercap (and other cases reported by the zine “owned and exposed” ? If you are the main coder of a project and you decide to put this code in a source repository that expose to the users, exploitable web apps (like for example some old release of e107 csm prone to a remote code execution condition) is possible choose once (or more) of the leafs of the 3rd context. In other words, logging the tons of c&c channels is possible found many other famous web site exposed to this problems.

The following little screenshot make all more clear (I hope). What you see is the result of a fake bot that I coded months ago. In particular, the result of this fake bot is a log file where are logged all message in a c&c channel. The grep command it was launched on this log file. How can see on sourceforge some users accounts offer access to a vulnerable version of the popular CMS e107 (http://php-security.org/2010/05/19/mops-2010-035-e107-bbcode-remote-php-code-execution-vulnerability/index.html).

One note: I decided to put the owning activities in the “counter measures” leaf beacuse  "good and evil" is just a matter of who does things.

For the moment it’s all. Maybe that I will pubblish some more explanation for this process as soon as possible.  Feedback and question are welcome.

Counter measures: don’t expose users with bugged web apps!.

LOIC 1.1.1.15 - Crafted C&C Channel Topic Could Lead A Crash

Following the trend of these days I played (locally) with one of the latest release of LOIC (Low Orbit Ion Cannon DDOS Tool). Inserting a long (not so) string on the topic of a C&C irc channel, there seems to be a memory corruption condition.

 The screen shot above show a crafted topic that trigger the issue. The impacted tested released is the 1.1.1.15. A few more details related to the .NET exception:

Some important notes: I saw on twitter that someone has retweet this post adding "remote code execution".  I never speak about a "remote code execution" condition for this issue.  

Anyway IMHO this issue could be insert in the counter measures list for this kind of threats. Act from a client side perspective some times maybe useful.

cve-2010-4091 exploited ? – 0.2 – Adobe Reader 9.3.0

Starting from the malwaretracker sample (see my previous posts) seem that edx and ecx are set to some interesting values:

cve-2010-4091 exploited ? – 0.1

Trying to reversing the shell code contained within the PDF that seem exploit CVE-2010-4091, in according with the sample reported by MalwareTracker, it’s been founded the following URL:

http://212.117.168.89/ad/fi_16.php

From Robtex:

The URL above at this time is down or not more available. Did really exploited for retrieve malware from womens-puzzle.com ? :) .  Many Thanks to binjo for his support and tools.  For the PDF check my previous post: http://extraexploit.blogspot.com/2010/11/cve-2010-4091-exploited.html 

All this things continues to be weird and funny! (WOMENS-PUZZLE.COM :-) ).  IMPORTANT: The PDF reported is not sure that exploit, really, the CVE-2010-4091

cve-2010-4091 exploited ?

November 24,  2010 – Update:

Looking for other  exploiting attempts I found a Malwaretracker sample where the PDF seem spread via URL that contains:  filepdf.php@v=zday

The following analysis report the objects used within this PDF (that is different from the fulldisclosure PDF):

http://www.malwaretracker.com/pdfsearch.php?hash=0398e68507882a38a26a341058c94653&submit=Search

November 22 , 2010 – update:

Some interesting (and useful) notes about the original full disclosure PDF PoC published on full disclosure mailing list:

Who’s looking for eggs in your PDF?
http://labs.m86security.com/2010/11/whos-looking-for-eggs-in-your-pdf/

November 19, 2010:

This is my latest result. Seem that with a crafted PDF as explained by Haifei Li in his paper (see previous posts for reference), the code flow looks like could be hijacked. At least I have this impression from the debugger response as you can see in this screen shot:

feedback and suggestion are welcome. Some notes: this is only an attempt to try to understand better this issue.  My mistakes in this stage are very likely.

cve-2010-4091 – printSeps - exploitation attempts

November 26, 2010 – update:
This is a very useful  presentation (from Immunity Sec) where is possible get some methods for approach the reversing of  Java script engine in Adobe Reader context:

Attacking Embedded Languages
http://www.immunitysec.com/downloads/ID_reCON_2008.odp

November 16, 2010 – update:
In previous post I didn’t report where is the place in the AcroRD32.dll where the memory corruption is triggered (as result of the use after free bug).  The following screen shot is the leak screen shot:

At first view, the AcroRd32.dll offset 0094450, seem a zone involved with Acro Heap Manager, so this could confirm some of my doubts for the question like “where to play whit this bug ?”. So, IMHO, this bug is due from the double handling mechanism of the heap. In other words what the OS heap management has previously freed may be that the Adobe Heap Manager try to free again with the result as show.  I hope to release a more detailed analysis as soon as possible.

November 11, 2010
In my previous post (http://extraexploit.blogspot.com/2010/11/full-disclosure-xplpdf-adober-reader-94.html)  it’s been followed  the timeline and what is called exposure time for this bug that seem have a bit strange history. After my initial analysis,  only few details has been released about. But after play a bit with this flaw I can confirm once of the latest and most clear comments fromVUPEN via Twitter:

“exploiting the PDF printSeps was complicated. It involves allocating/freeing chained blocks before triggering the flaw”

After this tweet I started to looking for more informations about. So IMHO a good support for “allocating/freeing before trigger” the flaw may be get from” heaplib” as well documented in

http://www.blackhat.com/presentations/bh-europe-07/Sotirov/Presentation/bh-eu-07-sotirov-apr19.pdf

Is possible fitting the heaplib.js for Adobe Reader and insert inside a crafted PDF for obtaining the heap handling ? For this goal code be usefull play with what is called Acro Managing Pool. A very interesting reference is from a Fortinet researcher:

http://www.fortiguard.com/papers/Adobe_Readers_Custom_Memory_Management_a_Heap_of_Trouble.pdf

The heaplib.js for Internet Explorer is here:
https://www.metasploit.com/redmine/projects/framework/repository/entry/lib/rex/exploitation/heaplib.js.b64

Anyway what I could say from my experience with this flaw is that the PDF posted on full disclosure seem leaks of something and using a debugger may lead you on the wrong way sometimes. Are only ideas which could be wrong as well right. Feedback are welcome.

full disclosure xpl.pdf Adober Reader 9.4 poc - printSeps() - cve-2010-4091

November 26,2010 – Update:

Thank you, Mario, but our printSeps() is in another castle !
http://esec-lab.sogeti.com/dotclear/index.php?post/2010/11/26/Thank-you-Mario-but-our-printSeps%28%29-is-in-another-castle

November 22, 2010 – Update:

Who’s looking for eggs in your PDF?  (reported also in  cve-2010-4091 exploited ?)
http://labs.m86security.com/2010/11/whos-looking-for-eggs-in-your-pdf/

November 16, 2010 – Update:

Security updates available for Adobe Reader and Acrobat – ABSP10-28
http://www.adobe.com/support/security/bulletins/apsb10-28.html

November 9, 2010 – Update:

Adobe  PSIRT released - CVE-2010-4091
http://blogs.adobe.com/psirt/2010/11

US-CERT response:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2010-4091

November 8, 2010 – Update 2:

VUPEN confirms the "remote code execution"
http://www.vupen.com/english/advisories/2010/2890
http://www.vupen.com/english/zerodays

November 8, 2010 – Update 1:

Some screenshots of my brief analysis for this bug.  The vtable where is referenced the PrintSeps() method:

 

 

 

 

 

 

 

 

 

 

 

 

 

the location where the Javascript code is being processed:

 

Where Adobe Reader 9.4 crash after PrintSeps is processed:

November 5, 2010 – Update:

emerging threats Snort sign
 http://permalink.gmane.org/gmane.comp.security.ids.snort.emerging-sigs/7437

eEye report as remote code execution
http://www.eeye.com/Resources/Security-Center/Research/Zero-Day-Tracker/2010/20101104

Adobe response:
http://blogs.adobe.com/psirt/2010/11/potential-issue-in-adobe-reader.html

November 4, 2010:
The vulnerable method seem: printSeps():

 

more info:

The original xpl.pdf is retrived via
http://seclists.org/fulldisclosure/2010/Nov/23

Xanda
http://twitter.xanda.org/

fuzzyd00r
http://fuzzyd00r.blogspot.com/2010/04/adobe-acrobat-javascript.html

PasteBIN
http://pastebin.com/h9GVyJhQ