Real-time collaboration for Jupyter Notebooks, Linux Terminals, LaTeX, VS Code, R IDE, and more,
all in one place.

1

2
class MetasploitModule < Msf::Exploit::Remote
3
  include Exploit::Remote::Tcp
4

5
  Rank = ManualRanking
6

7
  def initialize(info = {})
8
    super(update_info(info,
9
                      'Name'           => 'Exploit With Existing Automatic Target',
10
                      'Description'    => %q{ This module is a test bed for automatic targeting when there is already an auto target. },
11
                      'Author'         => [ 'thelightcosine' ],
12
                      'License'        => MSF_LICENSE,
13
                      'Privileged'     => true,
14
                      'DefaultOptions' =>
15
                        {
16
                          'WfsDelay'     => 10,
17
                          'EXITFUNC' => 'thread'
18
                        },
19
                      'Payload'        =>
20
                        {
21
                          'Space'        => 3072,
22
                          'DisableNops'  => true
23
                        },
24
                      'Platform'       => 'win',
25
                      'Arch'           => [ARCH_X86, ARCH_X64],
26
                      'Targets'        =>
27
                        [
28
                          ['Automatic Targeting', { 'auto' => true }],
29
                          ['Windows 2000 Universal',
30
                           {
31
                             'Ret'       => 0x001f1cb0,
32
                             'Scratch'   => 0x00020408,
33
                           }
34
                          ], # JMP EDI SVCHOST.EXE
35

36
                          #
37
                          # Standard return-to-ESI without NX bypass
38
                          # Warning: DO NOT CHANGE THE OFFSET OF THIS TARGET
39
                          #
40
                          ['Windows XP SP0/SP1 Universal',
41
                           {
42
                             'Ret'       => 0x01001361,
43
                             'Scratch'   => 0x00020408,
44
                           }
45
                          ], # JMP ESI SVCHOST.EXE
46

47
                          # Standard return-to-ESI without NX bypass
48
                          ['Windows 2003 SP0 Universal',
49
                           {
50
                             'Ret'       => 0x0100129e,
51
                             'Scratch'   => 0x00020408,
52
                           }
53
                          ], # JMP ESI SVCHOST.EXE
54
                          # Metasploit's NX bypass for XP SP2/SP3
55
                          ['Windows XP SP3 English (NX)',
56
                           {
57
                             'Ret'       => 0x6f88f807,
58
                             'DisableNX' => 0x6f8917c2,
59
                             'Scratch'   => 0x00020408
60
                           }
61
                          ]
62

63
                        ],
64
                      'DisclosureDate' => '1999-01-01'
65
          ))
66
  end
67

68
  def exploit
69
    print_status("This exploit doesn't actually do anything")
70

71
  end
72

73

74
end
75