Exploit Adobe Reader 10.1.4 - JP2KLib&CoolType Crash (PoC)

[Exploiter]

EDB-ID

22878

Проверка EDB

1. Пройдено

Автор

COOLKAVEH

Тип уязвимости

DOS

Платформа

WINDOWS

CVE

null

Дата публикации

2012-11-21

Title    :  Adobe Reader 10.1.4 JP2KLib&CoolType WriteAV Vulnerability
Version  :  10.1.4.38
Date     :  2012-11-20
Vendor   :  http://www.adobe.com/
Impact   :  Med/High
Contact  :  coolkaveh [at] rocketmail.com
Twitter  :  @coolkaveh
tested   :  XP SP3 ENG
Author   :  coolkaveh
================================================================================
Thanks to @Binjo and others for all support and help
================================================================================
Details:
================================================================================
The parsing routine is really complicated :D
Write AV by some kind of not properly initialized array
But the parameters of memmove, the counter
And destiny pointer seems controllable with data from flatedecoded data.
The wierd thing is the stream encoded with flatedecode can't decode properly
via zlib.decompress, but Adobe seems decode it correctly,
The esi points to a 0x10 length buffer, which contains word or dword calculated
from decoded data, after some integrity checks, it'll reach the memove.
.text:08088FCE        mov    eax, esi        ; jumptable 08087D44 case 8
.text:08088FD0        lea    ecx, [ebp+64h+var_1E0]
.text:08088FD6        sub    eax, ecx
.text:08088FD8        and    eax, 0FFFFFFFCh
.text:08088FDB        cmp    eax, 10h
.text:08088FDE        jl      loc_8088496    ; jumptable 08087D2D cases 0,2
.text:08088FE4        push    4
.text:08088FE6        pop    eax
.text:08088FE7        sub    esi, eax
.text:08088FE9        movsx  edi, word ptr [esi+2] ; ff6b -> ffffff6b
.text:08088FED        sub    esi, eax
.text:08088FEF        movsx  ecx, word ptr [esi+2] ; 0
.text:08088FF3        sub    esi, eax
.text:08088FF5        movsx  edx, word ptr [esi+2] ; 0
.text:08088FF9        sub    esi, eax
.text:08088FFB        mov    eax, [ebx+358h]
.text:08089001        mov    [ebp+64h+var_68], edx
.text:08089004        movsx  edx, word ptr [esi+2] ; 0
.text:08089008        mov    [ebp+64h+var_88], ecx
.text:0808900B        mov    [ebp+64h+var_98], edx ; index
[...]
.text:0808906A        cmp    edx, 3          ; var_98, can't great than 3
.text:0808906D        ja      loc_8087D00    ; jumptable 08087D7F case 2
.text:08089073        test    ecx, ecx
.text:08089075        jl      loc_8087D00    ; jumptable 08087D7F case 2
.text:0808907B        add    ecx, edi
.text:0808907D        cmp    ecx, [ebx+360h]
.text:08089083        jg      loc_8087D00    ; jumptable 08087D7F case 2
.text:08089089        mov    ecx, [ebp+64h+var_68]
.text:0808908C        test    ecx, ecx
.text:0808908E        jl      loc_8087D00    ; jumptable 08087D7F case 2
.text:08089094        add    ecx, edi
.text:08089096        cmp    ecx, [ebx+edx*8+38Ch]
.text:0808909D        jg      loc_8087D00    ; jumptable 08087D7F case 2
.text:080890A3        mov    ecx, edi
.text:080890A5        shl    ecx, 2
.text:080890A8        push    ecx            ; size_t
.text:080890A9        mov    ecx, [ebp+64h+var_88]
.text:080890AC        lea    eax, [eax+ecx*4]
.text:080890AF        mov    ecx, [ebp+64h+var_68]
.text:080890B2        push    eax            ; void *
.text:080890B3        mov    eax, [ebp+64h+var_98]
.text:080890B6        mov    eax, [ebx+eax*8+390h] ; ebx+390h seems a array pointer
.text:080890BD
.text:080890BD loc_80890BD:                        ; CODE XREF: sub_80875AE+1A1B
.text:080890BD        lea    eax, [eax+ecx*4]
.text:080890C0        push    eax            ; void *
.text:080890C1        call    ds:memmove

Here, ecx points to a buffer, which contains data the routine used to parse.

.text:0808B103        cmp    eax, 0FEh
.text:0808B108        jg      short loc_808B12A
.text:0808B10A        movzx  edx, byte ptr [ecx] ; byte ptr [ecx] = 0x29
.text:0808B10D        add    eax, 0FFFFFF05h
.text:0808B112        shl    eax, 8
.text:0808B115        inc    ecx
.text:0808B116        mov    [ebp+64h+var_78], ecx
.text:0808B119        push    0FFFFFF94h
.text:0808B11B        or      eax, edx
.text:0808B11D        pop    ecx
.text:0808B11E        sub    ecx, eax
.text:0808B120        shl    ecx, 10h
.text:0808B123        mov    [esi], ecx      ; ecx = ff6b
.text:0808B125        jmp    loc_80889B5

This issue needs more investigation , so
Stay in touch
============================================================================================
first memory corruption @ CoolType MSVCR90!memmove
============================================================================================
(d44.c10): Access violation - code c0000005 (first chance)
First chance exceptions are reported before any exception handling.
This exception may be expected and handled.
eax=02644c14 
ebx=02643008 
ecx=3fffff6b 
edx=00000000 
esi=02644e68 
edi=00000000
eip=7855b36a 
esp=0012d4d8 
ebp=0012d4e0 iopl=0         nv up ei pl nz na pe nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00010206
C:\WINDOWS\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_d495ac4e\MSVCR90.dll - 
MSVCR90!memmove+0x5a:
7855b36a f3a5            rep movs dword ptr es:[edi],dword ptr [esi]

Exception Sub-Type: Write Access Violation

Stack Trace:
MSVCR90!memmove+0x5a
CoolType!CTInit+0x34db9
CoolType+0x14cae
Instruction Address: 0x000000007855b36a
Short Description: WriteAV
============================================================================================
Second memory corruption @ JP2KLib JP2KLib!CIEParamsAreDefaults
============================================================================================
(d0.6a8): Access violation - code c0000005 (first chance)
First chance exceptions are reported before any exception handling.
This exception may be expected and handled.
eax=028a56f0 
ebx=018126e4 
ecx=00000000 
edx=00000000 
esi=0196893c 
edi=00000004
eip=022ea797 esp=022ada98 ebp=022adb1c iopl=0         nv up ei pl nz ac po nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00010212
*** ERROR: Symbol file could not be found.  Defaulted to export symbols for C:\Program Files\Adobe\Reader 11.0\Reader\JP2KLib.dll - 
JP2KLib!CIEParamsAreDefaults+0x871:
022ea797 89411c          mov     dword ptr [ecx+1Ch],eax ds:0023:0000001c=????????

JP2KLib!CIEParamsAreDefaults+0x871:
022ea797 89411c          mov     dword ptr [ecx+1Ch],eax ds:0023:0000001c=????????

Exception Sub-Type: Write Access Violation

Stack Trace:
JP2KLib!CIEParamsAreDefaults+0x871
JP2KLib!CIEParamsAreDefaults+0x2091
JP2KLib!JP2KCopyRect+0x6fef
MSVCR90!malloc+0x79
AcroRd32!CTJPEGRotateOptions::operator=+0x2268
AcroRd32!AVAcroALM_Destroy+0x84a64
MSVCR90!malloc+0x79
AcroRd32!CTJPEGRotateOptions::operator=+0x29e7
AcroRd32!AVAcroALM_Destroy+0x13886
AcroRd32!AVAcroALM_Destroy+0x7394a
AcroRd32!AVAcroALM_Destroy+0x73ff2
MSVCR90!memcmp+0x1717
AcroRd32!AVAcroALM_Destroy+0x51cbd
AcroRd32!AVAcroALM_Destroy+0x537e8
AcroRd32!AVAcroALM_Destroy+0x1a3a
AcroRd32!AVAcroALM_Destroy+0x9304b
Instruction Address: 0x00000000022ea797

Short Description: WriteAV

============================================================================================
Proof of concept :
CoolType
http://www36.zippyshare.com/v/25032778/file.html
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/22878-1.rar

JP2KLib
http://www7.zippyshare.com/v/22655486/file.html
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/22878-2.rar