rapid7/metasploit-framework — pull request #3027 by OJ (2014-02-23 11:37:32+00:00)
Title: Updated the Ultra Minit HTTP bof exploit

After exploiting this application manually I decided to make this an MSF exploit, only to find that other people had beaten me to it. However, the existing exploit was broken in a few ways, and this commit makes those problems go away. They include:

* Correct use of alpha chars in the buffer leading up to the payload which results in bad chars being avoided. Bad chars muck with the offsets because they get expanded.
* Adjustment of the payload so that it runs in another thread instead of in the thread of the request handler. This prevents the session from being killed after the hard-coded 60-second timeout that is baked into the application.
* The handler thread terminates itself so that the process doesn't crash.
* Extra targets were added based on the machines I had access to.

The exploit uses the application addresses where possible for things like `VirtualAlloc`, `CreateThread` and `TerminateThread` so that they're portable across instances.

This exploit doesn't bypass ASLR because the `EIP` overwrite would need to contain an address which doesn't contain a `NULL` byte. `NULL` bytes result in the payload being truncated and appends `\r\n` resulting in a bad address anyway.

I need the likes of @wchen-r7 and @jvazquez-r7 to show me the ways of bypassing ASLR in cases like this so that it can be exploited on more up to date operating systems.

I need to be able to prepend a custom set of shellcode to the payload because this allocates memory, creates the new thread, and shuts the current thread down nicely. However I couldn't see a way of getting this included with the chosen payload _before_ it is encoded. As a result, the payload appended to the custom shellcode encoded, and ends up being double-encoded. This isn't a huge issue as it doesn't really add much weight to the payload and there's plenty of space for it to move.

Tested on Windows 2k Server, Windows XP SP0/SP2/SP3, Windows 2003 Server, all 32-bit. Payloads that were tested are bind/reverse meterpreter, bind/reverse vncinject, bind/reverse shell.

My first MSF exploit, so let me know if I'm doing anything stupid!

Shout out to @todb-r7 ... I told you I'd bring my work into MSF :)