Exploit-DB #17104
Description: RealNetworks RealGames StubbyUtil.ShellCtl.1 - ActiveX Control Multiple Remote Command Executions
Type: remote
Platform: windows
Date: 2011-04-03
Author: rgod

Exploit:
RealNetworks RealGames StubbyUtil.ShellCtl.1 ActiveX Control 
(InstallerDlg.dll v2.6.0.445) Multiple Remote Commands Execution 
and Code Execution Vulnerabilities

tested against Internet Explorer 9, Vista sp2

download url: http://www.gamehouse.com/

background:

When choosing to play with theese online games ex. the game called
"My Farm Life" (see url: http://www.gamehouse.com/download-games/my-farm-life )
you download an installer called GameHouse-Installer_am-myfarmlife_gamehouse_.exe

This setup program installs an ActiveX with the following settings:

CLSID: {80AB3FB6-9660-416C-BE8D-0E2E8AC3138B}
Progid: StubbyUtil.ShellCtl.1
Binary Path: C:\Program Files\RealArcade\Installer\bin\InstallerDlg.dll
Safe For Initialization (Registry): True
Safe For Scripting (Registry): True

This control is safe for scripting and safe for initialization,
so Internet Explorer will allow scripting of this control from
remote.

vulnerability:

This control has four methods implemented insecurely:

ShellExec()      -> allows to launch arbitrary commands
ShellExecRunAs() -> allows to launch arbitrary commands
CreateShortcut() -> allows to create arbitrary executable files inside the automatic
                    startup folders
CopyDocument()   -> allows to copy arbitrary executable files from a remote
                    network share to local folders, ex. automatic startup folders

other attacks are possible including information disclosure and file deletion, 
see typelib:

class IShellCtl { /* GUID={0D60A064-2009-4623-8FC1-F99CAC01037E} */
	/* DISPID=[PII_REDACTED] */
	function QueryInterface(
		/* VT_PTR [26] [in] --> ? [29]  */ &$riid,
		/* VT_PTR [26] [out] --> VT_PTR [26]  */ &$ppvObj 
		)
	{
	}
	/* DISPID=[PII_REDACTED] */
	/* VT_UI4 [19] */
	function AddRef(
		)
	{
	}
	/* DISPID=[PII_REDACTED] */
	/* VT_UI4 [19] */
	function Release(
		)
	{
	}
	/* DISPID=[PII_REDACTED] */
	function GetTypeInfoCount(
		/* VT_PTR [26] [out] --> VT_UINT [23]  */ &$pctinfo 
		)
	{
	}
	/* DISPID=[PII_REDACTED] */
	function GetTypeInfo(
		/* VT_UINT [23] [in] */ $itinfo,
		/* VT_UI4 [19] [in] */ $lcid,
		/* VT_PTR [26] [out] --> VT_PTR [26]  */ &$pptinfo 
		)
	{
	}
	/* DISPID=[PII_REDACTED] */
	function GetIDsOfNames(
		/* VT_PTR [26] [in] --> ? [29]  */ &$riid,
		/* VT_PTR [26] [in] --> VT_PTR [26]  */ &$rgszNames,
		/* VT_UINT [23] [in] */ $cNames,
		/* VT_UI4 [19] [in] */ $lcid,
		/* VT_PTR [26] [out] --> VT_I4 [3]  */ &$rgdispid 
		)
	{
	}
	/* DISPID=[PII_REDACTED] */
	function Invoke(
		/* VT_I4 [3] [in] */ $dispidMember,
		/* VT_PTR [26] [in] --> ? [29]  */ &$riid,
		/* VT_UI4 [19] [in] */ $lcid,
		/* VT_UI2 [18] [in] */ $wFlags,
		/* VT_PTR [26] [in] --> ? [29]  */ &$pdispparams,
		/* VT_PTR [26] [out] --> VT_VARIANT [12]  */ &$pvarResult,
		/* VT_PTR [26] [out] --> ? [29]  */ &$pexcepinfo,
		/* VT_PTR [26] [out] --> VT_UINT [23]  */ &$puArgErr 
		)
	{
	}
	/* DISPID=1 */
	function CreateShortcut(
		/* VT_PTR [26] [in] --> VT_BSTR [8]  */ &$name,
		/* VT_PTR [26] [in] --> VT_BSTR [8]  */ &$target,
		/* VT_PTR [26] [in] --> VT_BSTR [8]  */ &$icon,
		/* VT_PTR [26] [in] --> VT_BSTR [8]  */ &$workingDir,
		/* VT_PTR [26] [in] --> VT_BSTR [8]  */ &$args 
		)
	{
		/* method CreateShortcut */
	}
	/* DISPID=2 */
	function DeleteShortcut(
		/* VT_PTR [26] [in] --> VT_BSTR [8]  */ &$name 
		)
	{
		/* method DeleteShortcut */
	}
	/* DISPID=3 */
	/* VT_BSTR [8] */
	function ModuleFileName(
		)
	{
		/* method ModuleFileName */
	}
	/* DISPID=4 */
	/* VT_BSTR [8] */
	function GetSpecialFolder(
		/* VT_UI4 [19] [in] */ $__MIDL_0025 
		)
	{
		/* method GetSpecialFolder */
	}
	/* DISPID=5 */
	/* VT_BOOL [11] */
	function CheckWnd(
		/* VT_PTR [26] [in] --> VT_BSTR [8]  */ &$__MIDL_0026 
		)
	{
		/* method CheckWnd */
	}
	/* DISPID=6 */
	/* VT_BSTR [8] */
	function ExistingTPS(
		/* VT_PTR [26] [in] --> VT_BSTR [8]  */ &$__MIDL_0028 
		)
	{
		/* method ExistingTPS */
	}
	/* DISPID=7 */
	function SetWorkingDir(
		/* VT_PTR [26] [in] --> VT_BSTR [8]  */ &$__MIDL_0030 
		)
	{
		/* method SetWorkingDir */
	}
	/* DISPID=8 */
	/* VT_BSTR [8] */
	function GetWorkingDir(
		)
	{
		/* method GetWorkingDir */
	}
	/* DISPID=9 */
	/* VT_R8 [5] */
	function OSVersion(
		)
	{
		/* method OSVersion */
	}
	/* DISPID=10 */
	/* VT_BSTR [8] */
	function GetSystemID(
		)
	{
		/* method GetSystemID */
	}
	/* DISPID=11 */
	function InstallFromCD(
		/* VT_BSTR [8] [in] */ $GameID,
		/* VT_BSTR [8] [in] */ $GameName,
		/* VT_BSTR [8] [in] */ $Tps,
		/* VT_BSTR [8] [in] */ $GameLang,
		/* VT_BSTR [8] [in] */ $CDPath,
		/* VT_BSTR [8] [in] */ $StoreFront 
		)
	{
		/* method InstallFromCD */
	}
	/* DISPID=12 */
	/* VT_UI4 [19] */
	function KillProcess(
		/* VT_BSTR [8] [in] */ $__MIDL_0033 
		)
	{
		/* method KillProcess */
	}
	/* DISPID=13 */
	function RefreshAddRemovePrograms(
		)
	{
		/* method RefreshAddRemovePrograms */
	}
	/* DISPID=14 */
	function ShellExec(
		/* VT_BSTR [8] [in] */ $FilePath,
		/* VT_BSTR [8] [in] */ $Params 
		)
	{
		/* method ShellExec */
	}
	/* DISPID=15 */
	function ShellExecRunAs(
		/* VT_BSTR [8] [in] */ $FilePath,
		/* VT_BSTR [8] [in] */ $Params 
		)
	{
		/* method ShellExecRunAs */
	}
	/* DISPID=16 */
	/* VT_BSTR [8] */
	function PlatformInfo(
		)
	{
		/* method PlatformInfo */
	}
	/* DISPID=17 */
	/* VT_BSTR [8] */
	function GetAvailableDrive(
		/* VT_INT [22] [in] */ $reqSpace 
		)
	{
		/* method GetAvailableDrive */
	}
	/* DISPID=18 */
	/* VT_BOOL [11] */
	function InitializeStamp(
		/* VT_BSTR [8] [in] */ $exeName,
		/* VT_INT [22] [in] */ $offset 
		)
	{
		/* method InitializeStamp */
	}
	/* DISPID=19 */
	/* VT_BSTR [8] */
	function GetContentID(
		)
	{
		/* method GetContentID */
	}
	/* DISPID=20 */
	/* VT_BSTR [8] */
	function GetTrackingID(
		)
	{
		/* method GetTrackingID */
	}
	/* DISPID=21 */