CVE-2016-1019：Magnitude攻击工具里的flash漏洞

摘要： flash被淘汰的原因之一

虽然最新版本21.0.0.197也存在这个漏洞，不过因为Adobe 在Flash Player21.0.0.182版本中引入了新的漏洞缓解方式，因此这个漏洞在这个版本中起不到什么作用。这次是Adobe处理漏洞问题的一大举动。

利用传输链做坏事

Magnitude EK更新了它的传输链。它在链里增加了一道“门”，有点像Angler EK，先收集屏幕的尺寸和色彩深度。

fig1.jpg

然后服务器为防止被用户的防毒软件发现用了另一个页面响应。

fig2.jpg

Magnitude EK通过发送JSON来双重释放这个漏洞（cve-2015-2419）和一个Flash loader。

fig3.jpg

Flash攻击

这个漏洞（cve-2015-2419）的特点是在攻击者的控制下会导致Flash内存分配器自主分配缓冲区。然后攻击者就可以在里面创建一个长度为0xffffffff的字节数组任意读写存储器。而且，在我们查看过程中发现侵入代码及其一些功能和之前HackingTeam泄露的漏洞入侵代码很相似，都是从另一个服务器下载恶意程序。

fig4.jpg

附录

res://\Program%20Files%20(x86)\Fiddler2\Fiddler.exe/#3/#32512

res://\Program%20Files\Fiddler2\Fiddler.exe/#3/#32512

res://\Program%20Files%20(x86)\VMware\VMware Tools\TPAutoConnSvc.exe/#2/#26567

res://\Program%20Files\VMware\VMware Tools\TPAutoConnSvc.exe/#2/#26567

res://\Program%20Files%20(x86)\VMware\VMware Tools\TPAutoConnSvc.exe/#2/#30996

res://\Program%20Files\VMware\VMware Tools\TPAutoConnSvc.exe/#2/#30996

res://\Program%20Files%20(x86)\Oracle\VirtualBox Guest Additions\uninst.exe/#2/#110

res://\Program%20Files\Oracle\VirtualBox Guest Additions\uninst.exe/#2/#110

res://\Program%20Files%20(x86)\Parallels\Parallels Tools\Applications\setup_nativelook.exe/#2/#204

res://\Program%20Files\Parallels\Parallels Tools\Applications\setup_nativelook.exe/#2/#204

res://\Program%20Files%20(x86)\Malwarebytes Anti-Malware\mbamext.dll/#2/202

res://\Program%20Files\Malwarebytes Anti-Malware\mbamext.dll/#2/202

res://\Program%20Files%20(x86)\Malwarebytes Anti-Malware\unins000.exe/#2/DISKIMAGE

res://\Program%20Files\Malwarebytes Anti-Malware\unins000.exe/#2/DISKIMAGE

res://\Program%20Files%20(x86)\Malwarebytes Anti-Exploit\mbae.exe/#2/200

res://\Program%20Files\Malwarebytes Anti-Exploit\mbae.exe/#2/200

res://\Program%20Files%20(x86)\Malwarebytes Anti-Exploit\mbae.exe/#2/201

res://\Program%20Files\Malwarebytes Anti-Exploit\mbae.exe/#2/201

res://\Program%20Files%20(x86)\Malwarebytes Anti-Exploit\unins000.exe/#2/DISKIMAGE

res://\Program%20Files\Malwarebytes Anti-Exploit\unins000.exe/#2/DISKIMAGE

res://\Program%20Files%20(x86)\Trend Micro\Titanium\TmConfig.dll/#2/#30994

res://\Program%20Files\Trend Micro\Titanium\TmConfig.dll/#2/#30994

res://\Program%20Files%20(x86)\Trend Micro\Titanium\TmSystemChecking.dll/#2/#30994

res://\Program%20Files\Trend Micro\Titanium\TmSystemChecking.dll/#2/#30994

res://\Program%20Files%20(x86)\Kaspersky Lab\Kaspersky Anti-Virus 6.0 for Windows Workstations\shellex.dll/#2/#102

res://\Program%20Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0 for Windows Workstations\shellex.dll/#2/#102

res://\Program%20Files%20(x86)\Kaspersky Lab\Kaspersky Anti-Virus 6.0\shellex.dll/#2/#102

res://\Program%20Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\shellex.dll/#2/#102

res://\Program%20Files%20(x86)\Kaspersky Lab\Kaspersky Anti-Virus 7.0\shellex.dll/#2/#102

res://\Program%20Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\shellex.dll/#2/#102

res://\Program%20Files%20(x86)\Kaspersky Lab\Kaspersky Anti-Virus 2009\mfc42.dll/#2/#26567

res://\Program%20Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\mfc42.dll/#2/#26567

res://\Program%20Files%20(x86)\Kaspersky Lab\Kaspersky Anti-Virus 2010\mfc42.dll/#2/#26567

res://\Program%20Files\Kaspersky Lab\Kaspersky Anti-Virus 2010\mfc42.dll/#2/#26567

res://\Program%20Files%20(x86)\Kaspersky Lab\Kaspersky Anti-Virus 2011\avzkrnl.dll/#2/BBALL

res://\Program%20Files\Kaspersky Lab\Kaspersky Anti-Virus 2011\avzkrnl.dll/#2/BBALL

res://\Program%20Files%20(x86)\Kaspersky Lab\Kaspersky Anti-Virus 2012\x86\mfc42.dll/#2/#26567

res://\Program%20Files\Kaspersky Lab\Kaspersky Anti-Virus 2012\x86\mfc42.dll/#2/#26567

res://\Program%20Files%20(x86)\Kaspersky Lab\Kaspersky Anti-Virus 2013\x86\mfc42.dll/#2/#26567

res://\Program%20Files\Kaspersky Lab\Kaspersky Anti-Virus 2013\x86\mfc42.dll/#2/#26567

res://\Program%20Files%20(x86)\Kaspersky Lab\Kaspersky Anti-Virus 14.0.0\x86\mfc42.dll/#2/#26567

res://\Program%20Files\Kaspersky Lab\Kaspersky Anti-Virus 14.0.0\x86\mfc42.dll/#2/#26567

res://\Program%20Files%20(x86)\Kaspersky Lab\Kaspersky Anti-Virus 15.0.0\x86\mfc42.dll/#2/#26567

res://\Program%20Files\Kaspersky Lab\Kaspersky Anti-Virus 15.0.0\x86\mfc42.dll/#2/#26567

res://\Program%20Files%20(x86)\Kaspersky Lab\Kaspersky Anti-Virus 15.0.1\x86\mfc42.dll/#2/#26567

res://\Program%20Files\Kaspersky Lab\Kaspersky Anti-Virus 15.0.1\x86\mfc42.dll/#2/#26567

res://\Program%20Files%20(x86)\Kaspersky Lab\Kaspersky Anti-Virus 15.0.2\x86\mfc42.dll/#2/#26567

res://\Program%20Files\Kaspersky Lab\Kaspersky Anti-Virus 15.0.2\x86\mfc42.dll/#2/#26567

res://\Program%20Files%20(x86)\Kaspersky Lab\Kaspersky Anti-Virus 16.0.0\x86\mfc42.dll/#2/#26567

res://\Program%20Files\Kaspersky Lab\Kaspersky Anti-Virus 16.0.0\x86\mfc42.dll/#2/#26567

res://\Program%20Files%20(x86)\Kaspersky Lab\Kaspersky Internet Security 6.0\shellex.dll/#2/#102

res://\Program%20Files\Kaspersky Lab\Kaspersky Internet Security 6.0\shellex.dll/#2/#102

res://\Program%20Files%20(x86)\Kaspersky Lab\Kaspersky Internet Security 7.0\shellex.dll/#2/#102

res://\Program%20Files\Kaspersky Lab\Kaspersky Internet Security 7.0\shellex.dll/#2/#102

res://\Program%20Files%20(x86)\Kaspersky Lab\Kaspersky Internet Security 2009\mfc42.dll/#2/#26567

res://\Program%20Files\Kaspersky Lab\Kaspersky Internet Security 2009\mfc42.dll/#2/#26567

res://\Program%20Files%20(x86)\Kaspersky Lab\Kaspersky Internet Security 2010\mfc42.dll/#2/#26567

res://\Program%20Files\Kaspersky Lab\Kaspersky Internet Security 2010\mfc42.dll/#2/#26567

res://\Program%20Files%20(x86)\Kaspersky Lab\Kaspersky Internet Security 2011\avzkrnl.dll/#2/BBALL

res://\Program%20Files\Kaspersky Lab\Kaspersky Internet Security 2011\avzkrnl.dll/#2/BBALL

res://\Program%20Files%20(x86)\Kaspersky Lab\Kaspersky Internet Security 2012\x86\mfc42.dll/#2/#26567

res://\Program%20Files\Kaspersky Lab\Kaspersky Internet Security 2012\x86\mfc42.dll/#2/#26567

res://\Program%20Files%20(x86)\Kaspersky Lab\Kaspersky Internet Security 2013\x86\mfc42.dll/#2/#26567

res://\Program%20Files\Kaspersky Lab\Kaspersky Internet Security 2013\x86\mfc42.dll/#2/#26567

res://\Program%20Files%20(x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\x86\mfc42.dll/#2/#26567

res://\Program%20Files\Kaspersky Lab\Kaspersky Internet Security 14.0.0\x86\mfc42.dll/#2/#26567

res://\Program%20Files%20(x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\x86\mfc42.dll/#2/#26567

res://\Program%20Files\Kaspersky Lab\Kaspersky Internet Security 15.0.0\x86\mfc42.dll/#2/#26567

res://\Program%20Files%20(x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.1\x86\mfc42.dll/#2/#26567

res://\Program%20Files\Kaspersky Lab\Kaspersky Internet Security 15.0.1\x86\mfc42.dll/#2/#26567

res://\Program%20Files%20(x86)\Kaspersky Lab\Kaspersky Internet Security 16.0.0\x86\mfc42.dll/#2/#26567

res://\Program%20Files\Kaspersky Lab\Kaspersky Internet Security 16.0.0\x86\mfc42.dll/#2/#26567

res://\Program%20Files%20(x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.2\x86\mfc42.dll/#2/#26567

res://\Program%20Files\Kaspersky Lab\Kaspersky Internet Security 15.0.2\x86\mfc42.dll/#2/#26567

res://\Program%20Files%20(x86)\Kaspersky Lab\Kaspersky Total Security 14.0.0\x86\mfc42.dll/#2/#26567

res://\Program%20Files\Kaspersky Lab\Kaspersky Total Security 14.0.0\x86\mfc42.dll/#2/#26567

res://\Program%20Files%20(x86)\Kaspersky Lab\Kaspersky Total Security 15.0.0\x86\mfc42.dll/#2/#26567

res://\Program%20Files\Kaspersky Lab\Kaspersky Total Security 15.0.0\x86\mfc42.dll/#2/#26567

res://\Program%20Files%20(x86)\Kaspersky Lab\Kaspersky Total Security 15.0.1\x86\mfc42.dll/#2/#26567

res://\Program%20Files\Kaspersky Lab\Kaspersky Total Security 15.0.1\x86\mfc42.dll/#2/#26567

res://\Program%20Files%20(x86)\Kaspersky Lab\Kaspersky Total Security 15.0.2\x86\mfc42.dll/#2/#26567

res://\Program%20Files\Kaspersky Lab\Kaspersky Total Security 15.0.2\x86\mfc42.dll/#2/#26567

res://\Program%20Files%20(x86)\Kaspersky Lab\Kaspersky Total Security 16.0.0\x86\mfc42.dll/#2/#26567

res://\Program%20Files\Kaspersky Lab\Kaspersky Total Security 16.0.0\x86\mfc42.dll/#2/#26567

res://\Program%20Files%20(x86)\Kaspersky Lab\Kaspersky PURE 2.0\x86\mfc42.dll/#2/#26567

res://\Program%20Files\Kaspersky Lab\Kaspersky PURE 2.0\x86\mfc42.dll/#2/#26567

res://\Program%20Files%20(x86)\Kaspersky Lab\Kaspersky PURE 3.0\x86\mfc42.dll/#2/#26567

res://\Program%20Files\Kaspersky Lab\Kaspersky PURE 3.0\x86\mfc42.dll/#2/#26567

res://\Program%20Files%20(x86)\Kaspersky Lab\Kaspersky CRYSTAL 3.0\x86\mfc42.dll/#2/#26567

res://\Program%20Files\Kaspersky Lab\Kaspersky CRYSTAL 3.0\x86\mfc42.dll/#2/#26567

res://\Program%20Files%20(x86)\Kaspersky Lab\Kaspersky PURE\mfc42.dll/#2/#26567

res://\Program%20Files\Kaspersky Lab\Kaspersky PURE\mfc42.dll/#2/#26567


本文翻译自：https://www.fireeye.com/blog/threat-research/2016/04/cve-2016-1019_a_new.html



上一篇：虚拟化漏洞：CVE-2015...
下一篇：一种绕过XSS安全机制的新型...

资讯推荐

01

315晚会揭示网安之乱

——来自热月科技

02

诚挚邀请

——来自热月科技

03

中神网盾一周年宣言：将持续发力培养网安实战人才

04

2020年大学生网络安全知识竞赛，百校巡讲开通线上直播课

05

9项免费安全保障，中神网盾助力政企打赢疫情防控阻击战！

——来自安界网

06

后渗透之meterpreter使用攻略

07

wireshark使用方法总结

08

热烈庆贺：中神网盾参与出席“中国网络空间安全协会第一届会员代...

——来自安界网

09

安全合作，实践分享，捍卫信任——中神网盾受邀出席“2019京...

——来自安界网

大家关注

01

RFID破解之小区电动车充电卡

02

一篇文章带你了解反序列化漏洞

03

“2020年大学生网络安全知识竞赛”启动

04

利用shadowsocks和proxychains为kali...

05

Windows下安装和使用Masscan

06

如何破解压缩文件密码-省时省力的方法

07

中国蚁剑下载、安装、使用教程

08

CE修改器基本操作——实战破解软件

09

通过简单工具对IPsec VPN进行渗透测试

10

CobaltStrike进阶篇-批量上线