Exploit RealNetworks RealGames StubbyUtil.ProcessMgr.1 - ActiveX Control Multiple Remote Command Executions

[Exploiter]

EDB-ID

17105

Проверка EDB

1. Пройдено

Автор

RGOD

Тип уязвимости

REMOTE

Платформа

WINDOWS

CVE

null

Дата публикации

2011-04-03

RealNetworks RealGames StubbyUtil.ProcessMgr.1 ActiveX Control 
(InstallerDlg.dll v2.6.0.445) Multiple Remote Commands Execution 
Vulnerabilities

tested against Internet Explorer 9, Vista sp2

download url: http://www.gamehouse.com/

background:

When choosing to play with theese online games ex. the game called
"My Farm Life" (see url: http://www.gamehouse.com/download-games/my-farm-life )
you download an installer called GameHouse-Installer_am-myfarmlife_gamehouse_.exe

This setup program installs an ActiveX with the following settings:

CLSID: {5818813E-D53D-47A5-ABBB-37E2A07056B5}
Progid: StubbyUtil.ProcessMgr.1
Binary Path: C:\Program Files\RealArcade\Installer\bin\InstallerDlg.dll
Safe For Initialization (Registry): True
Safe For Scripting (Registry): True

This control is safe for scripting and safe for initialization,
so Internet Explorer will allow scripting of this control from
remote.

vulnerability:

This control has four methods implemented insecurely:

CreateVistaTaskLow()      -> allows to launch arbitrary commands
Exec()                    -> allows to launch arbitrary commands
ExecLow()                 -> allows to launch arbitrary commands
ShellExec()               -> allows to launch arbitrary executables

other attacks are possible , 
see typelib:

class IProcessMgr { /* GUID={860450DB-79C1-44E4-96E0-C89144E4B444} */
	/* DISPID=1610612736 */
	function QueryInterface(
		/* VT_PTR [26] [in] --> ? [29]  */ &$riid,
		/* VT_PTR [26] [out] --> VT_PTR [26]  */ &$ppvObj 
		)
	{
	}
	/* DISPID=1610612737 */
	/* VT_UI4 [19] */
	function AddRef(
		)
	{
	}
	/* DISPID=1610612738 */
	/* VT_UI4 [19] */
	function Release(
		)
	{
	}
	/* DISPID=1610678272 */
	function GetTypeInfoCount(
		/* VT_PTR [26] [out] --> VT_UINT [23]  */ &$pctinfo 
		)
	{
	}
	/* DISPID=1610678273 */
	function GetTypeInfo(
		/* VT_UINT [23] [in] */ $itinfo,
		/* VT_UI4 [19] [in] */ $lcid,
		/* VT_PTR [26] [out] --> VT_PTR [26]  */ &$pptinfo 
		)
	{
	}
	/* DISPID=1610678274 */
	function GetIDsOfNames(
		/* VT_PTR [26] [in] --> ? [29]  */ &$riid,
		/* VT_PTR [26] [in] --> VT_PTR [26]  */ &$rgszNames,
		/* VT_UINT [23] [in] */ $cNames,
		/* VT_UI4 [19] [in] */ $lcid,
		/* VT_PTR [26] [out] --> VT_I4 [3]  */ &$rgdispid 
		)
	{
	}
	/* DISPID=1610678275 */
	function Invoke(
		/* VT_I4 [3] [in] */ $dispidMember,
		/* VT_PTR [26] [in] --> ? [29]  */ &$riid,
		/* VT_UI4 [19] [in] */ $lcid,
		/* VT_UI2 [18] [in] */ $wFlags,
		/* VT_PTR [26] [in] --> ? [29]  */ &$pdispparams,
		/* VT_PTR [26] [out] --> VT_VARIANT [12]  */ &$pvarResult,
		/* VT_PTR [26] [out] --> ? [29]  */ &$pexcepinfo,
		/* VT_PTR [26] [out] --> VT_UINT [23]  */ &$puArgErr 
		)
	{
	}
	/* DISPID=1 */
	/* VT_BOOL [11] */
	function Exec(
		/* VT_PTR [26] [in] --> VT_BSTR [8]  */ &$mod,
		/* VT_PTR [26] [in] --> VT_BSTR [8]  */ &$cmdline,
		/* VT_BOOL [11] [in] */ $__MIDL_0097,
		/* VT_BOOL [11] [in] */ $__MIDL_0098,
		/* VT_PTR [26] [in] --> VT_BSTR [8]  */ &$__MIDL_0099 
		)
	{
		/* method Exec */
	}
	/* DISPID=2 */
	/* VT_BOOL [11] */
	function IsFinished(
		)
	{
	}
	/* DISPID=3 */
	/* VT_UI4 [19] */
	function CreateNamedMutex(
		/* VT_BSTR [8] [in] */ $__MIDL_0102 
		)
	{
	}
	/* DISPID=4 */
	function ReleaseMutex(
		/* VT_UI4 [19] [in] */ $__MIDL_0104 
		)
	{
	}
	/* DISPID=5 */
	function CloseMutex(
		/* VT_UI4 [19] [in] */ $__MIDL_0105 
		)
	{
	}
	/* DISPID=6 */
	/* VT_BOOL [11] */
	function ObtainMutex(
		/* VT_UI4 [19] [in] */ $__MIDL_0106 
		)
	{
	}
	/* DISPID=7 */
	/* VT_BOOL [11] */
	function WaitOnMutex(
		/* VT_UI4 [19] [in] */ $__MIDL_0108,
		/* VT_INT [22] [in] */ $__MIDL_0109 
		)
	{
	}
	/* DISPID=8 */
	function CloseEvent(
		/* VT_UI4 [19] [in] */ $__MIDL_0111 
		)
	{
	}
	/* DISPID=9 */
	function FireEvent(
		/* VT_UI4 [19] [in] */ $__MIDL_0112 
		)
	{
	}
	/* DISPID=10 */
	/* VT_UI4 [19] */
	function CreateNamedEvent(
		/* VT_BSTR [8] [in] */ $__MIDL_0113 
		)
	{
	}
	/* DISPID=11 */
	/* VT_UI4 [19] */
	function ExitCode(
		)
	{
	}
	/* DISPID=12 */
	function CreateVistaTaskLow(
		/* VT_BSTR [8] [in] */ $bstrExecutablePath,
		/* VT_BSTR [8] [in] */ $bstrArguments,
		/* VT_BSTR [8] [in] */ $workDir 
		)
	{
	}
	/* DISPID=13 */
	/* VT_BOOL [11] */
	function ExecLow(
		/* VT_BSTR [8] [in] */ $__MIDL_0116,
		/* VT_BSTR [8] [in] */ $cmdline,
		/* VT_PTR [26] [in] --> VT_BSTR [8]  */ &$workDir 
		)
	{
	}
	/* DISPID=14 */
	function ShellExec(
		/* VT_BSTR [8] [in] */ $__MIDL_0117 
		)
	{
	}
	/* DISPID=15 */
	function Sleep(
		/* VT_UI4 [19] [in] */ $__MIDL_0118 
		)
	{
	}
}


binary info:
>lm -vm
    Image path: C:\Program Files\RealArcade\Installer\bin\InstallerDlg.dll
    Image name: InstallerDlg.dll
    Timestamp:        Mon Mar 14 14:22:44 2011 (4D7E6B04)
    CheckSum:         00000000
    ImageSize:        00064000
    File version:     2.6.0.445
    Product version:  2.6.0.445
    File flags:       0 (Mask 3F)
    File OS:          4 Unknown Win32
    File type:        2.0 Dll
    File date:        00000000.00000000
    Translations:     0409.04b0
    ProductName:      InstallerDlg Module
    InternalName:     InstallerDlg
    OriginalFilename: InstallerDlg.dll
    ProductVersion:   2.6.0.445
    FileVersion:      2.6.0.445
    FileDescription:  InstallerDlg Module
    LegalCopyright:   Copyright 2010

poc: 
pocs availiable here: http://retrogod.altervista.org/9sg_realgames_ii.html
                      https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/35560-2.zip (9sg_StubbyUtil.ProcessMgr.1.zip)