Real-time collaboration for Jupyter Notebooks, Linux Terminals, LaTeX, VS Code, R IDE, and more,
all in one place.

1

2
class MetasploitModule < Msf::Exploit::Remote
3
  include Exploit::Remote::Tcp
4
  Rank = ManualRanking
5

6
  def initialize(info = {})
7
    super(update_info(info,
8
      'Name'           => 'Exploit Auto-Targeting for Windows',
9
      'Description'    => %q{ This module is a test bed for automatic targeting for Windows exploits. },
10
      'Author'         => [ 'thelightcosine' ],
11
      'License'        => MSF_LICENSE,
12
      'Privileged'     => true,
13
      'DefaultOptions' =>
14
        {
15
          'WfsDelay'     => 10,
16
          'EXITFUNC' => 'thread'
17
        },
18
      'Payload'        =>
19
        {
20
          'Space'        => 3072,
21
          'DisableNops'  => true
22
        },
23
      'Platform'       => 'win',
24
      'Arch'           => [ARCH_X86, ARCH_X64],
25
      'Targets'        =>
26
        [
27
          ['Windows 2000 Universal',
28
           {
29
             'Ret'       => 0x001f1cb0,
30
             'Scratch'   => 0x00020408,
31
           }
32
          ], # JMP EDI SVCHOST.EXE
33

34
          #
35
          # Standard return-to-ESI without NX bypass
36
          # Warning: DO NOT CHANGE THE OFFSET OF THIS TARGET
37
          #
38
          ['Windows XP SP0/SP1 Universal',
39
           {
40
             'Ret'       => 0x01001361,
41
             'Scratch'   => 0x00020408,
42
           }
43
          ], # JMP ESI SVCHOST.EXE
44

45
          # Standard return-to-ESI without NX bypass
46
          ['Windows 2003 SP0 Universal',
47
           {
48
             'Ret'       => 0x0100129e,
49
             'Scratch'   => 0x00020408,
50
           }
51
          ], # JMP ESI SVCHOST.EXE
52
          # Metasploit's NX bypass for XP SP2/SP3
53
          ['Windows XP SP3 English (NX)',
54
           {
55
             'Ret'       => 0x6f88f807,
56
             'DisableNX' => 0x6f8917c2,
57
             'Scratch'   => 0x00020408
58
           }
59
          ]
60

61
        ],
62
      'DisclosureDate' => '1999-01-01'
63
    ))
64

65
    deregister_options('RPORT')
66
  end
67

68
  def exploit
69
    print_status("This exploit doesn't actually do anything")
70
    print_status "Target Selected: #{target.name}"
71
  end
72

73

74
end
75